Blitzy is a Cambridge, MA based AI software development platform on a mission to revolutionize the software development life cycle by autonomously building custom software to unlock the next industrial revolution. We're transforming how enterprises build software, turning enterprise requirements into enterprise grade code with an agentic software development platform that can autonomously execute 80% of the quantum of software development work. We're backed by multiple tier 1 investors, and have proven success as founders of previous start-ups.
OUR CULTURE
Who we are:
Led by two pioneering co-founders we are one of the fastest growing companies in the U.S., creating our own category of enterprise autonomous software development. We automate thousands of hours of software development for our customers, which includes strong representation within the Fortune 500.
How we work:
- We move Blitzy Fast: Time is both our company’s and our clients’ most precious asset. We move quickly and decisively to innovate internally and deliver exceptional software externally.
- Championship Mindset: We operate like a professional sports team. We win as a team by holding ourselves and each other to high standards, collaborating in-person, and remaining focused on the mission.
- Passion for Invention: We’re pushing the frontier of what’s possible, requiring constant innovation and iteration.
- We Work for the Customer: We focus on delivering outsized value to the customers we work with and expanding those relationships into deep, meaningful partnerships.
ABOUT THE ROLE
As an Application Engineer focused on Government Security and Compliance, you will bridge the gap between Blitzy’s autonomous code-generation platform and the strict regulatory requirements of public sector clients. You will lead the technical deployment, hardening, and accreditation readiness of Blitzy across both Platform-as-a-Service (PaaS) in a hardened DevSecOps environment and isolated customer-hosted environments, starting with FedRAMP authorization and expanding into higher-impact government compliance frameworks.
RESPONSIBILITIES
- Design, implement, and maintain technical security controls across Blitzy’s PaaS and customer-hosted deployments to achieve and sustain FedRAMP Moderate (Class C) and High (Class D) compliance baselines.
- Engineer repeatable, containerized deployment patterns using Infrastructure-as-Code (IaC) for air-gapped, GovCloud, and on-premises customer environments.
- Establish continuous monitoring, automated container scanning, and static/dynamic application security testing (SAST/DAST) pipelines to meet strict federal Plan of Action and Milestones (POA&M) timelines.
- Build dashboards within Blitzy’s hardened DevSecOps environment to report on Blitzy’s vulnerability management posture, significant software changes, security incidents / tickets, and POA&M remediation.
- Implement and maintain FedRAMP supply chain security controls such as SBOMs, image signing and provenance.
- Collaborate with internal security engineers, Third-Party Assessment Organizations (3PAOs), and agency Authorizing Officials (AOs) to supply technical evidence, system diagrams, and System Security Plan (SSP) artifacts.
- Configure secure data boundaries, FIPS 140-3 validated cryptography, and zero-trust identity controls around Blitzy’s codebase ingestion and multi-agent inference workflows.
- Work alongside Forward Deployed Engineers and public sector solutions teams to integrate Blitzy into complex, legacy government software estates while preserving agency security postures.
- Build a scalable compliance foundation that transitions smoothly from the initial FedRAMP traditional Rev5 path to the automation-first 20x model and towards DoD Impact Levels (IL4/IL5/IL6).
QUALIFICATIONS
- 5+ years of hands-on experience building, deploying, and hardening production cloud applications in regulated enterprise or federal environments.
- Deep FedRAMP & NIST Expertise: Proven track record engineering systems compliant with deep FedRAMP and NIST SP 800-53 security controls, including hands-on participation in Authority to Operate (ATO) lifecycles.
- Strong proficiency deploying and managing workloads across AWS GovCloud, Azure Government, or air-gapped Kubernetes clusters using Terraform, Helm, and CI/CD automation.
- Demonstrated experience implementing DISA STIGs, CIS Benchmarks, FIPS-compliant encryption, RBAC, and zero-trust networking architectures.
- Strong coding skills in Python, Go, TypeScript, or similar languages to automate compliance checks, build deployment tooling, and troubleshoot complex distributed systems.
- Ability to translate technical system architectures into clear compliance documentation, boundary diagrams, and audit evidence for 3PAOs and government stakeholders.
Compensation: $125,000-$185,000 + Bonus + Equity
Blitzy is an equal opportunity employer committed to building a diverse and inclusive team. We believe different perspectives make us stronger. Base salary ranges are determined by country, role, level, experience, and skills. The range displayed on each job posting reflects Blitzy’s good faith determination of the minimum and maximum targets for new hire salaries across all locations. Individual pay is determined by related factors, including job skills, experience, and relevant education or training, which may impact a final offer. Your Talent Partner can share more about the specific salary range during the hiring process
