Blitzy is a Cambridge, MA based AI software development platform on a mission to revolutionize the software development life cycle by autonomously building custom software to unlock the next industrial revolution. We're transforming how enterprises build software, turning enterprise requirements into enterprise grade code with an agentic software development platform that can autonomously execute 80% of the quantum of software development work. We're backed by multiple tier 1 investors, and have proven success as founders of previous start-ups.

Our Culture

Who we are

Led by two pioneering co-founders we are one of the fastest growing companies in the U.S., creating our own category of enterprise autonomous software development. We automate thousands of hours of software development for our customers, which includes strong representation within the Fortune 500.

How we work

We move Blitzy Fast: Time is both our company’s and our clients’ most precious asset. We move quickly and decisively to innovate internally and deliver exceptional software externally.

Championship Mindset: We operate like a professional sports team. We win as a team by holding ourselves and each other to high standards, collaborating in-person, and remaining focused on the mission.

Passion for Invention: We’re pushing the frontier of what’s possible, requiring constant innovation and iteration.

We Work for the Customer: We focus on delivering outsized value to the customers we work with and expanding those relationships into deep, meaningful partnerships.

About the Role

As an Application Engineer focused on Government Security and Compliance, you will bridge the gap between Blitzy’s autonomous code-generation platform and the strict regulatory requirements of public sector clients. You will lead the technical deployment, hardening, and accreditation readiness of Blitzy across both Platform-as-a-Service (PaaS) in a hardened DevSecOps environment and isolated customer-hosted environments, starting with FedRAMP authorization and expanding into higher-impact government compliance frameworks.

Responsibilities

Design, implement, and maintain technical security controls across Blitzy’s PaaS and customer-hosted deployments to achieve and sustain FedRAMP Moderate (Class C) and High (Class D) compliance baselines.

Engineer repeatable, containerized deployment patterns using Infrastructure-as-Code (IaC) for air-gapped, GovCloud, and on-premises customer environments.

Establish continuous monitoring, automated container scanning, and static/dynamic application security testing (SAST/DAST) pipelines to meet strict federal Plan of Action and Milestones (POA&M) timelines.

Build dashboards within Blitzy’s hardened DevSecOps environment to report on Blitzy’s vulnerability management posture, significant software changes, security incidents / tickets, and POA&M remediation.

Implement and maintain FedRAMP supply chain security controls such as SBOMs, image signing and provenance.

Collaborate with internal security engineers, Third-Party Assessment Organizations (3PAOs), and agency Authorizing Officials (AOs) to supply technical evidence, system diagrams, and System Security Plan (SSP) artifacts.

Configure secure data boundaries, FIPS 140-3 validated cryptography, and zero-trust identity controls around Blitzy’s codebase ingestion and multi-agent inference workflows.

Work alongside Forward Deployed Engineers and public sector solutions teams to integrate Blitzy into complex, legacy government software estates while preserving agency security postures.

Build a scalable compliance foundation that transitions smoothly from the initial FedRAMP traditional Rev5 path to the automation-first 20x model and towards DoD Impact Levels (IL4/IL5/IL6).

Qualifications

5+ years of hands-on experience building, deploying, and hardening production cloud applications in regulated enterprise or federal environments.

Deep FedRAMP & NIST Expertise: Proven track record engineering systems compliant with deep FedRAMP and NIST SP 800-53 security controls, including hands-on participation in Authority to Operate (ATO) lifecycles.