An organization’s first quantum hire should match the work it needs done in the next 12 months. For many banks, telecoms, government agencies, and manufacturers, that work is the move to post-quantum cryptography (PQC). Governments have published migration dates, although most of them bind government systems and their suppliers rather than every private organization. Exploring quantum computing applications is optional, and it needs a different person.
QuEra Computing, a neutral-atom hardware vendor, surveyed 291 respondents in December 2025 for its 2026 Quantum Readiness Survey. 37% of them named a lack of skilled staff as a major barrier to quantum adoption. With a small candidate pool, a first hire into a poorly defined role is costly to replace.
Start from the goal
| Goal | First hire | Year-one work | Background to look for |
|---|---|---|---|
| Migrate cryptography to PQC | PQC migration lead | Cryptographic inventory, risk ranking, supplier requirements, migration plan | Enterprise security architecture, public key infrastructure (PKI), program management |
| Explore quantum computing | Quantum applications scientist | Candidate problems, benchmarks on cloud hardware against classical baselines, vendor evaluation | Graduate training in physics, computer science, or applied mathematics, plus the organization’s own domain |
| Set a quantum strategy | Head of quantum program | Exposure and opportunity assessment, budget, vendor relationships, the decision on the next two hires | Technical credibility in quantum and experience running a budget |
Many organizations eventually hire all three. Where a published date applies to the organization or its customers, that date usually sets the order.
Why PQC migration usually comes first
Three governments have set dates:
| Jurisdiction | Source | Dates |
|---|---|---|
| United States | National Security Agency, CNSA 2.0 FAQ | From January 1, 2027, new acquisitions for National Security Systems must comply with the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0), unless otherwise noted. The rule binds NSS buyers and, through their contracts, the vendors that supply them |
| European Union | Coordinated implementation roadmap | Recommendations: Member States start the transition by the end of 2026; high-risk use cases, including critical infrastructure, move to PQC no later than the end of 2030 |
| United Kingdom | National Cyber Security Centre (NCSC), migration timelines | Discovery and an initial plan by 2028; highest-priority migration by 2031; all systems by 2035 |
Our CNSA 2.0 briefing covers the US and EU dates in detail. None of the three governments ties its dates to a forecast of when a cryptanalytically relevant quantum computer (CRQC) will exist. The dates allow for the years a large organization needs to migrate.
Quantum computing exploration has no comparable deadline. An organization that waits a year to hire an applications scientist loses learning time. An organization that waits a year on PQC may miss a published date.
What the first PQC hire actually does
The NCSC guidance says most organizations, and most of their suppliers, should not write their own PQC implementations. That work belongs to a small number of companies that employ cryptography specialists. An enterprise migration uses the standardized algorithms, such as ML-KEM (formerly CRYSTALS-Kyber) for key establishment and ML-DSA (formerly CRYSTALS-Dilithium) for signatures, as delivered by vendors and libraries.
The first hire therefore runs a program. In year one, the PQC migration lead:
- builds an inventory of where the organization uses public key cryptography for key exchange, authentication, and software and firmware signing, including in hardware and in supplier products;
- ranks systems by the sensitivity and lifetime of the data they protect;
- writes PQC requirements into procurement and supplier contracts;
- produces a migration plan with a budget and owners.
The candidates who fit come from enterprise security architecture, PKI operations, and identity and access management, with enough cryptography to read a standard and question a vendor. A research cryptographer who designs algorithms is rarely the right first hire for this job. Quantum vendors are recruiting those specialists too: IonQ listed five cryptography roles on Quantum Careers in November 2026, including a Distinguished PQC Cryptography & Architecture Leader. Our PQC careers guide describes the full range of security roles.
When quantum computing comes first
Some organizations have a business case that justifies exploration now. The usual candidates are molecular simulation in pharmaceuticals and chemicals, and optimization and risk modeling in finance. For them the first hire is an applications scientist who knows the domain.
That person spends year one choosing problems, running small instances on cloud hardware, and comparing every result with the best classical method. Vendor roadmaps are targets. A useful first hire separates what a vendor has demonstrated from what it has announced. Management gets both, in plain terms. Any qubit count in that report should say whether it means physical or logical qubits.
Mistakes to avoid
A title without a mandate
A “Head of Quantum” with no budget and no reporting line to the system owners is unlikely to change those systems. In many organizations the PQC lead reports to the chief information security officer, and the applications scientist to the head of the business unit that wants the problem solved.
One job description for two jobs
A listing that asks for research-level quantum physics and ten years of enterprise PKI describes almost nobody. Our guide to writing a quantum job description shows how to separate required skills from useful ones.
Expecting a breakthrough in year one
A realistic first year of a quantum computing program yields benchmarks, a shortlist of problems, and a recommendation. For a PQC program, it usually yields an inventory and a plan.
Underpricing the role
Quantum companies recruit from the same small pool. The salary snapshot shows what employers on the board advertise. The compensation guide covers equity and benefits.
Options before a full-time hire
Some organizations need an assessment before they can write the job description. The NCSC notes that organizations can use consultancies with deep cryptographic expertise for discovery and assessment. The NCSC is running a pilot scheme to assure those consultancies until March 31, 2027, and is no longer taking expressions of interest. Quantum computing vendors offer cloud access and support for early benchmarking. Organizations that need short-term expert guidance before committing to a full-time hire can reach vetted specialists through Quantum Experts.
After an assessment, the organization can describe the year-one work in its job description.
Running the search
A listing on Quantum Careers reaches candidates who follow quantum roles. State the salary range in the listing. Strong candidates screen employers too, and our guide to recruiting red flags lists the warning signs they look for. For leadership hires, our recruitment team runs retained searches and evaluates candidates against the technical requirements of the role.
