Senior/Staff Security Engineer (U. S. Air Force)

Skylight

2h•$150,000 - $203,000•Remote

About The Position

Skylight is hiring a Senior/Staff Security Engineer to partner with a U.S. Air Force program office responsible for a portfolio of civil engineering systems. The position focuses on automating security evidence generation and mapping Risk Management Framework (RMF) controls so security reviews can happen alongside development and support continuous authorization. The program is moving toward an outcome-driven delivery model with automated testing and security integrated into the software pipeline, beginning with migrating its first application to a Department of Defense software factory. The engineer will work with Skylight colleagues, government personnel, government engineers, and other contractors to understand current delivery, testing, and security processes and improve them. This is new work replacing a traditional support model, and the role includes coaching government partners to sustain security practices after Skylight leaves. Tools and processes may change as the work develops. The position is contingent on Skylight receiving the underlying contract. This is a full-time, exempt, fully remote position. Work must be performed within the United States, excluding U.S. territories. Occasional travel to Montgomery, Alabama, and other U.S. Air Force bases is expected. The expected start date is November 30, 2026, pending contract award. U.S. citizenship, eligibility to obtain a Common Access Card and any contract-required special access, and successful completion of a company background check are required.

Requirements

Able to detect risks by continually reviewing all aspects of an application for vulnerabilities and enumerating them.
Able to mitigate and prevent risks by proactively working with teams to build secure and compliant systems.
Familiarity with common sources of vulnerability information.
Familiarity with regulatory requirements regarding security and compliance.
Experience taking systems through RMF and ATO, ideally in DoD, including authoring control implementations and the body of evidence.
Experience automating security evidence generation or mapping controls under RMF.
Ability to write clean, working, reusable code in at least one programming language.
Experience working on cross-functional teams spanning product, design, engineering, and operations in iterative delivery.
A track record of staying aligned and accountable on remote teams.
A mindset and work approach aligned with Skylight’s core values.
U.S. citizenship.
Ability to obtain a Common Access Card (CAC) and any special access required for the contract.
Successful completion of a company background check.
All work must be conducted within the U.S., excluding U.S. territories.

Nice To Haves

Experience with continuous ATO, eMASS, and POA&M management.
Experience documenting controls inherited from a cloud platform or DoD software factory, such as Cloud One, MDaaS, or Platform One.
Experience with compliance as code, including GitLab CI, Checkmarx or other static code scanning, and SBOM generation.
Experience with cloud infrastructure and infrastructure as code.
Experience delivering technology in government, regulated industries, or other public-benefit settings.

Responsibilities

Automate security evidence generation and map RMF controls to support continuous authorization.
Author control implementations and the body of evidence, including documenting controls inherited from the software factory.
Conduct security audits and risk analyses, and plan and implement remediations.
Translate compliance requirements into practical engineering choices the team can act on.
Build trust with security reviewers and authorizing officials, and explain technical tradeoffs clearly.
Pair with and coach government teams so they can sustain security practices after Skylight leaves.
Work with Skylight and government personnel to learn current delivery processes and identify where testing and security slow down.
Help integrate automated testing and security into the software delivery pipeline as the program migrates its first application to a DoD software factory.

Benefits

Medical insurance
Dental insurance
Vision insurance
Short-term and long-term disability insurance
Life and AD&D insurance
Dependent care FSA, healthcare FSA, and health savings account
Dollar-for-dollar 401(k) match up to 10% of salary, with no vesting period
Flexible paid-time-off policy, generally around 25 days per year
11 paid federal holidays
Up to 12 weeks of paid time off for eligible new birth, adoption, or foster parents
Annual salary increases, annual performance bonus, spot bonuses, and stock options
Business development and sales bonuses
Referral bonuses
Annual $2,000 professional development allowance
Annual $750 allowance for tech-related purchases
Annual $100 swag budget
Flexible, remote-friendly work environment