Senior/Staff Security Engineer (U. S. Air Force)

The role

You will focus on security automation by generating authorization evidence from the pipeline. You will work with a U.S. Air Force program office to implement test automation and security built into the pipeline.

What you will do

• Automate security evidence generation and map controls under RMF to support continuous authorization
• Author control implementations and the body of evidence
• Conduct security audits and risk analyses
• Plan and implement remediations
• Translate compliance requirements into practical engineering choices
• Build trust with security reviewers and authorizing officials
• Pair with and coach government teams

Required qualifications

• Able to detect risks by continually reviewing all aspects of the application for vulnerabilities and enumerating them
• Able to mitigate and prevent risks by proactively working with teams to build secure and compliant systems
• Familiarity with common sources of vulnerability information
• Familiarity with regulatory requirements regarding security and compliance
• Experience taking systems through RMF and ATO, ideally in DoD, including authoring the control implementation and body of evidence
• Experience automating security evidence generation or mapping controls under RMF
• Can write clean, working, and reusable code in at least one programming language
• Experience working on cross-functional teams in iterative delivery
• A track record of staying aligned and accountable on remote teams
• A mindset and work approach that aligns with our core values
• All work must be conducted within the U.S., excluding U.S. territories
• U.S. citizenship required

Nice to have

• Experience with continuous ATO, eMASS, and POA&M management
• Experience documenting inherited controls from a cloud platform or DoD software factory (Cloud One, MDaaS, Platform One, or similar)
• Experience with compliance as code, including GitLab CI, Checkmarx or other static code scanning, and SBOM generation
• Experience with cloud infrastructure and infrastructure as code
• Experience delivering technology in government, regulated industries, or other public-benefit settings

Benefits

• Medical insurance, dental insurance, vision insurance
• Short-term and long-term disability insurance
• Life and AD&D insurance
• Dependent care FSA, healthcare FSA, health savings account
• Dollar-for-dollar 401(k) match up to 10% of your salary with no vesting period
• Flexible paid-time-off policy (generally around 25 days per year), plus 11 paid federal holidays
• Up to 12 weeks paid-time-off for all eligible new birth, adoption, or foster parents
• Performance rewards, including annual salary increase, annual performance bonus, spot bonuses, and stock options
• Business development / sales bonuses
• Referral bonuses
• Annual $2,000 allowance for professional development
• Annual $750 allowance for tech-related purchases

Before you apply

• Role is contingent on Skylight being awarded the underlying contract
• Must be able to obtain a Common Access Card (CAC) and any special access required
• Must complete a company background check successfully
• U.S. citizenship required to be eligible for employment

About the company

Skylight is a digital consultancy using design and technology to help government agencies deliver better public services.