Senior/Staff Security Engineer (U. S. Air Force)

📋 Job Overview

Skylight is a digital consultancy using design and technology to help government agencies deliver better public services. We’re at the forefront of a civic movement to reinvent how all levels of government serve families, patients, and many others in today’s digital world. If you want to play a part in driving this critical movement forward, we’d love for you to join our growing team of public interest technologists. The work we do matters.

🏢 About Skylight

Skylight is a digital consultancy using design and technology to help government agencies deliver better public services. We’re at the forefront of a civic movement to reinvent how all levels of government serve families, patients, and many others in today’s digital world. If you want to play a part in driving this critical movement forward, we’d love for you to join our growing team of public interest technologists. The work we do matters.

🎯 The Role

At Skylight, security engineers stay up to date with the cutting edge of security and help teams implement new processes, tools, and remediations. They’re familiar with modern software development and work in cross-functional teams to inform and guide security best practices at all stages of the software development life cycle.

Skylight is partnering with a U.S. Air Force program office that runs a portfolio of civil engineering systems. These systems serve users across civil engineering, security forces, and services, including readiness managers, range personnel, and fire and emergency services. Releases are slow today. Regression testing is manual, security review happens after development finishes, and code freeze to production can take a month or more. We’ll move the program to an outcome-driven model with test automation and security built into the pipeline, starting with migrating the first application onto a DoD software factory. Leadership wants this office to become the model other Air Force offices adopt.

In this role, you’ll focus on security automation: generating authorization evidence from the pipeline so security review happens alongside development instead of after it.

✅ Key Responsibilities

• Automate security evidence generation and map controls under RMF to support continuous authorization
• Author control implementations and the body of evidence, including documenting controls inherited from the software factory
• Conduct security audits and risk analyses, and plan and implement remediations
• Translate compliance requirements into practical engineering choices the team can act on
• Build trust with security reviewers and authorizing officials, and explain technical tradeoffs clearly
• Pair with and coach government teams so they can sustain these security practices after we leave

📌 Required Qualifications

• Able to detect risks by continually reviewing all aspects of the application for vulnerabilities and enumerating them
• Able to mitigate and prevent risks by proactively working with teams to build secure and compliant systems
• Familiarity with common sources of vulnerability information
• Familiarity with regulatory requirements regarding security and compliance
• Experience taking systems through RMF and ATO, ideally in DoD, including authoring the control implementation and body of evidence
• Experience automating security evidence generation or mapping controls under RMF
• Can write clean, working, and reusable code in at least one programming language
• Experience working on cross-functional teams (product, design, engineering, ops) in iterative delivery
• A track record of staying aligned and accountable on remote teams
• A mindset and work approach that aligns with our core values

⭐ Desirable Experience

• Experience with continuous ATO, eMASS, and POA&M management
• Experience documenting inherited controls from a cloud platform or DoD software factory (Cloud One, MDaaS, Platform One, or similar)
• Experience with compliance as code, including GitLab CI, Checkmarx or other static code scanning, and SBOM generation
• Experience with cloud infrastructure and infrastructure as code
• Experience delivering technology in government, regulated industries, or other public-benefit settings

🎁 Benefits

Medical insurance, dental insurance, vision insurance
Short-term and long-term disability insurance
Life and AD&D insurance
Dependent care FSA, healthcare FSA, health savings account
Dollar-for-dollar 401(k) match up to 10% of your salary with no vesting period
Flexible paid-time-off policy (generally around 25 days per year), plus 11 paid federal holidays
Up to 12 weeks paid-time-off for all eligible new birth, adoption, or foster parents
Performance rewards, including annual salary increase, annual performance bonus, spot bonuses, and stock options
Business development / sales bonuses
Referral bonuses
Annual $2,000 allowance for professional development
Annual $750 allowance for tech-related purchases
Annual swag budget of $100 to display your Skylight pride with some merchandise (hoodies, hats, and more)
Flexible, remote-friendly work environment
An environment that empowers you to unleash your superpowers for public good

🛂 Visa & Eligibility

• All work must be conducted within the U.S., excluding U.S. territories.
• This contract requires U.S. citizenship to be eligible for employment.
• You must be able to obtain a Common Access Card (CAC) and any special access required for this contract.
• You must complete a company background check successfully.