Senior/Staff Security Engineer (U. S. Air Force)

Description

The company is a digital consultancy that uses design and technology to help government agencies deliver better public services.

It works with all levels of government to reinvent how public services reach families, patients, and many others.

Security engineers here keep current with modern security practice, help teams adopt new processes, tools, and fixes, and work in cross-functional teams to shape security practice across the software development life cycle. They know modern software development well.

The company is partnering with a U.S. Air Force program office that runs civil engineering systems used by civil engineering, security forces, and services staff, including readiness managers, range personnel, and fire and emergency services.

Today releases are slow: testing is manual, security review comes after development ends, and code freeze to production can last a month or more. The plan is an outcome-driven model with test automation and security built into the pipeline, starting by moving the first application onto a DoD software factory. Leadership wants this office to be the model other Air Force offices adopt.

Your focus is security automation, producing authorization evidence from the pipeline so security review runs alongside development.

Your first 30 days go to working with the company team and government staff, learning how changes reach users now, and finding where testing and security slow delivery. Because this replaces a traditional support model, you will also coach government partners so they can keep these practices going once the company's involvement ends. You will work alongside government engineers and other contractors while tools and processes change.

This role depends on the company winning the underlying contract. If it does not, the company will tell you promptly and discuss other suitable opportunities.

Interviews include a preliminary screen, a skills interview, a behavioral interview, and a reverse interview where you meet the team, usually four conversations over two to three weeks.

Responsibilities

• Automate the generation of security evidence and map RMF controls to support continuous authorization.
• Write control implementations and the body of evidence, including documentation for controls inherited from the software factory.
• Run security audits and risk analyses, then plan and carry out remediations.
• Turn compliance requirements into engineering decisions the team can act on.
• Earn the confidence of security reviewers and authorizing officials, and explain technical tradeoffs in plain terms.
• Work with government teams and coach them so they can keep these security practices running after the company exits.

Requirements

• Ability to spot risks by continually reviewing every part of an application for vulnerabilities and listing them.
• Ability to prevent and reduce risks by working with teams to build secure, compliant systems.
• Familiarity with common sources of vulnerability information.
• Familiarity with security and compliance regulations.
• Experience taking systems through RMF and ATO, ideally in DoD, including writing the control implementation and body of evidence.
• Experience automating security evidence generation or mapping controls under RMF.
• Ability to write clean, reusable, working code in at least one programming language.
• Experience on cross-functional teams (product, design, engineering, ops) doing iterative delivery.
• Track record of staying aligned and accountable on remote teams.
• Work approach that fits the company's core values.
• Nice to have: experience with continuous ATO, eMASS, and POA&M management.
• Nice to have: experience documenting inherited controls from a cloud platform or DoD software factory such as Cloud One, MDaaS, Platform One, or similar.
• Nice to have: experience with compliance as code, including GitLab CI, Checkmarx or other static code scanning, and SBOM generation.
• Nice to have: experience with cloud infrastructure and infrastructure as code.
• Nice to have: experience delivering technology in government, regulated industries, or other public-benefit settings.
• Some openings on federal contracts require a degree, with additional years of experience accepted in its place.

Conditions

Fully remote.

Occasional travel to Montgomery, AL, and other U.S. Air Force bases.

Target start date is November 30, 2026, pending contract award.

Full-time, exempt position.

Work must be done within the U.S., excluding U.S. territories.

U.S. citizenship is required for this role.

You must be able to obtain a Common Access Card (CAC) and any special access the contract requires.

Salary is set by interview results and your seniority. Current salary ranges for Security Engineer roles: Associate $90,000 to $125,000; Security Engineer I $120,000 to $140,000; Security Engineer II $135,000 to $160,000; Senior $150,000 to $185,000; Staff $170,000 to $203,000; Principal $180,000 to $230,000.

The company considers candidates with a range of backgrounds and experience, even if you do not meet every qualification.

Benefits

• Medical, dental, and vision insurance.
• Disability insurance, both short-term and long-term.
• Life insurance and AD&D coverage.
• FSAs for dependent care and healthcare, plus a health savings account.
• Dollar-for-dollar 401(k) match up to 10% of salary, with no vesting period.
• Flexible paid time off, generally around 25 days per year, plus 11 paid federal holidays.
• Up to 12 weeks paid time off for eligible new birth, adoption, or foster parents.
• Performance rewards: annual salary increase, annual performance bonus, spot bonuses, and stock options.
• Business development and sales bonuses.
• Referral bonuses.
• Annual $2,000 professional development allowance.
• Annual $750 allowance for tech-related purchases.
• Annual swag budget of $100 for company merchandise such as hoodies and hats.
• Flexible, remote-friendly work setup.