Principal Engineer - Classical Cryptography & Architecture

We are looking for a Principal Engineer to own the classical cryptography architecture of our post-quantum cryptography (PQC) hardware acceleration products, targeting hardware security module (HSM) and network-appliance applications. Real-world quantum-safe systems are hybrid systems: classical and post-quantum algorithms operating side by side, with careful key management, crypto agility and migration paths. You will be the senior authority for this classical and hybrid layer, working alongside our PQC architecture leadership. The role demands fluency on both sides of the transition: deep classical mastery combined with a solid working command of the post-quantum algorithms and standards the products are built around.

Responsibilities:

You will own the architecture and implementation strategy of the classical cryptographic functions of the product line: symmetric ciphers and modes (AES/GCM and beyond), hash functions (SHA-2/SHA-3, HMAC/KDF constructions), RSA/ECC offload, and true random number generation and entropy architecture (SP 800-90A/B/C). You will define the hybrid classical/post-quantum schemes (key establishment, dual signatures, composite certificates) and the crypto-agility mechanisms that allow customers to migrate safely, track the standardisation of hybrid and composite approaches (NIST guidance, IETF work on hybrid key establishment in TLS 1.3 and IKEv2, composite certificates) together with our PQC architects, guide RTL and software engineers implementing classical cores, technically evaluate third-party IP, and support FIPS 140-3 and CAVP certification of the classical algorithm suite. You will also own key-management and key-hierarchy architecture across the product, ensuring interoperability with deployed HSM, TLS and IPsec ecosystems.

• Own the classical and hybrid cryptography architecture of the product line: symmetric, hash, RSA/ECC, entropy and key management, and classical/PQC hybrid schemes
• Define crypto-agility and migration mechanisms that let customers move to quantum-safe deployments without breaking existing infrastructure

Requirements:

We are looking for a candidate with a Master’s or PhD in Cryptography, Computer Science, Electrical Engineering or a related field and at least twelve years of experience implementing and architecting classical cryptography in real products, in hardware, software or both. You have deep command of symmetric and asymmetric primitives, modes of operation, key management and entropy generation, and you have taken cryptographic subsystems through FIPS 140-3 or Common Criteria evaluation. You also bring a solid working knowledge of the NIST post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) and their deployment constraints: you do not need to be a lattice specialist, but you must be able to architect hybrid schemes with one.

You understand the practical constraints of deployed security infrastructure (HSMs, PKI, TLS and IPsec ecosystems) and how hybrid classical/post-quantum schemes are standardised and deployed in practice. You write precise specifications, guide implementers effectively, and make sound architecture decisions under real-world interoperability constraints. Fluency in English is required; French or German is an advantage.

• Proven architect of classical cryptographic subsystems with certification experience (FIPS 140-3, CAVP, Common Criteria)
• Practical knowledge of hybrid classical/PQC schemes, crypto agility and key-management architecture, with working command of the NIST PQC standards

Preferred Qualifications: