Staff/Principal Security Engineer (U. S. Air Force)

Skylight is a digital consultancy that uses design and technology to help government agencies deliver better public services. The Staff/Principal Security Engineer will serve as the security voice across U.S. Air Force modernization efforts by assessing legacy applications, guiding compliant architectures, executing authorization processes, and coaching government engineering teams on secure development practices.

Responsibilities:

• Protect sensitive data by applying security and privacy best practices
• Conduct security audits and risk analyses of legacy applications and their modernized replacements
• Execute Risk Management Framework (RMF), Authorization to Operate (ATO), and continuous ATO (cATO) processes, and carry the security documentation and narrative that supports authorization
• Write security controls and documentation as the build proceeds, so security is a build-time deliverable in the pipeline rather than an audit at the end
• Conduct ongoing research to keep up with industry practices and new attack vectors
• Select and use the right tools, frameworks, languages, and technologies for the job, with a preference for open-source solutions
• Pair with and coach government engineers so secure practices become part of how the teams work

Requirements:

• • Experience taking systems through RMF and ATO, ideally in a DoD context, including authoring the control implementation and body of evidence
• • Able to detect risks by continually reviewing all aspects of the application for vulnerabilities and enumerating them
• • Able to mitigate and prevent risks by proactively working with teams to build secure and compliant systems
• • Familiarity with common sources of vulnerability information
• • Familiarity with regulatory requirements regarding security and compliance
• • Experience working in agile software development
• • Interest in mentoring, coaching, and pairing with government partners so they can carry the work forward
• • Experience working on cross-functional teams (product, design, engineering, ops) in iterative delivery
• • A mindset and work approach that aligns with our core values
• • Some of our available roles are on federal contracts that require a degree or additional years of experience as a substitute
• • All work must be conducted within the U.S., excluding U.S. territories
• • This contract requires U.S. citizenship to be eligible for employment
• • You must be able to obtain and maintain a Common Access Card (CAC), which requires a favorable background check
• • Expect occasional travel to Air Force bases across the U.S., quarterly at most
• • Can write clean, working, and reusable code in at least one programming language
• • Experience with application development, particularly web development and testing frameworks
• • Experience with cloud infrastructure and infrastructure as code
• • Military or government experience
• • Experience delivering technology in government, regulated industries, or other public-benefit settings
• • A track record of staying aligned and accountable on remote teams