5+ years of hands-on experience in regulated enterprise or federal environments.
Expertise in FedRAMP and NIST SP 800-53 security controls, with ATO lifecycle experience.
Proficient in deploying workloads on AWS GovCloud, Azure Government, or air-gapped Kubernetes using Terraform and CI/CD.
Experience with DISA STIGs, CIS Benchmarks, FIPS-compliant encryption, RBAC, and zero-trust architectures.
Strong coding skills in Python, Go, TypeScript, or similar for automation and troubleshooting.
Ability to create clear compliance documentation and boundary diagrams for audits.
Responsibilities
Design and maintain security controls for FedRAMP compliance in PaaS and customer-hosted deployments.
Engineer containerized deployment patterns using Infrastructure-as-Code for various environments.
Establish continuous monitoring and automated security testing pipelines to meet federal timelines.
Build dashboards to report on vulnerability management and security incidents.
Implement FedRAMP supply chain security controls like SBOMs and image signing.
Collaborate with security engineers and assessment organizations to provide technical evidence and documentation.
Configure secure data boundaries and zero-trust identity controls around codebase workflows.
Integrate Blitzy into legacy government software while maintaining security postures.
Benefits
Flexible work environment with remote options.
Opportunities for professional development and training.
Access to cutting-edge technology and tools.
Collaborative team culture focused on innovation.
Health and wellness programs.
Full Job Description
About the Role
As an Application Engineer focused on Government Security and Compliance, you will bridge the gap between Blitzy's autonomous code-generation platform and the strict regulatory requirements of public sector clients. You will lead the technical deployment, hardening, and accreditation readiness of Blitzy across both Platform-as-a-Service (PaaS) in a hardened DevSecOps environment and isolated customer-hosted environments, starting with FedRAMP authorization and expanding into higher-impact government compliance frameworks.
Responsibilities
Design, implement, and maintain technical security controls across Blitzy's PaaS and customer-hosted deployments to achieve and sustain FedRAMP Moderate (Class C) and High (Class D) compliance baselines.
Engineer repeatable, containerized deployment patterns using Infrastructure-as-Code (IaC) for air-gapped, GovCloud, and on-premises customer environments.
Establish continuous monitoring, automated container scanning, and static/dynamic application security testing (SAST/DAST) pipelines to meet strict federal Plan of Action and Milestones (POA&M) timelines.
Build dashboards within Blitzy's hardened DevSecOps environment to report on Blitzy's vulnerability management posture, significant software changes, security incidents / tickets, and POA&M remediation.
Implement and maintain FedRAMP supply chain security controls such as SBOMs, image signing and provenance.
Collaborate with internal security engineers, Third-Party Assessment Organizations (3PAOs), and agency Authorizing Officials (AOs) to supply technical evidence, system diagrams, and System Security Plan (SSP) artifacts.
Configure secure data boundaries, FIPS 140-3 validated cryptography, and zero-trust identity controls around Blitzy's codebase ingestion and multi-agent inference workflows.
Work alongside Forward Deployed Engineers and public sector solutions teams to integrate Blitzy into complex, legacy government software estates while preserving agency security postures.
Build a scalable compliance foundation that transitions smoothly from the initial FedRAMP traditional Rev5 path to the automation-first 20x model and towards DoD Impact Levels (IL4/IL5/IL6).
Qualifications
5+ years of hands-on experience building, deploying, and hardening production cloud applications in regulated enterprise or federal environments.
Deep FedRAMP & NIST Expertise: Proven track record engineering systems compliant with deep FedRAMP and NIST SP 800-53 security controls, including hands-on participation in Authority to Operate (ATO) lifecycles.
Strong proficiency deploying and managing workloads across AWS GovCloud, Azure Government, or air-gapped Kubernetes clusters using Terraform, Helm, and CI/CD automation.
Demonstrated experience implementing DISA STIGs, CIS Benchmarks, FIPS-compliant encryption, RBAC, and zero-trust networking architectures.
Strong coding skills in Python, Go, TypeScript, or similar languages to automate compliance checks, build deployment tooling, and troubleshoot complex distributed systems.
Ability to translate technical system architectures into clear compliance documentation, boundary diagrams, and audit evidence for 3PAOs and government stakeholders.
