Senior Product Engineer (Security Focus)

About GovlyGovly is an Insight Partners and YC backed Series A high-growth startup that is modernizing and bringing AI to B2G workflows and operations. Our AI-powered market intelligence platform helps government contractors find, win, and collaborate on public sector opportunities. The Govly platform is trusted by leading OEMs, VARs, distributors, and prime contractors to navigate the complex world of government procurement. We are a fast-moving, innovative company, shipping new features at a rapid pace to keep our customers ahead of the curve. Recently, our models and AI tools have captured the attention of the US Army who awarded us a Direct to Phase II SBIR to build them an Agentic AI tool that dramatically accelerates their procurement process. We delivered our MVP last September (12 months ahead of schedule) and looking to secure a Phase III in the coming months and need to accelerate our expansion across the Federal Government. Our GuidepostsEverything is possiblePrioritize actionTalk to usersMove fastBe kindBuild things that people loveThe RoleWe are hiring a Senior Product Engineer to join our team of 8 engineers. You will work across the full stack — building features, fixing bugs, and shipping product alongside the rest of the team.Your immediate priority will be owning our cloud infrastructure, security posture, and compliance work, including getting us through FedRAMP and IL5 authorization. This is not a siloed DevOps role — it is a product engineering role where infrastructure and security are the current focus.This role will start as an individual contributor with end-to-end ownership. Team growth will be driven by results and business needs, not assumed on day one.What You Will OwnEnd-to-end feature development across the Govly platformAll DevOps for our commercial and government cloud environments, including cost optimization, performance tuning, potential service migrations, and moving toward infrastructure-as-codeOur CMMC enclave for commercial customers handling CUICVE monitoring and patching across all Govly repositoriesDatabase performance optimization and reportingReliable, obfuscated data pipelines from production to staging to development environmentsCompliant data flow from our commercial environment to our government environmentCompliance framework management, including documentation and process (e.g., SOC 2 via Vanta)Ad hoc compliance questions and customer security questionnairesWhat You Will DoUse a deep understanding of the problems our customers face to build software that people loveDrive end-to-end implementations of features: design data models, build APIs, implement frontend components, write testsBuild and manage secure AWS infrastructure across commercial and government environmentsMove from managed Kubernetes configs toward proper IaC (Terraform, CloudFormation, or similar)Lead FedRAMP authorization end-to-end — architecture, documentation, control implementation, continuous monitoringMonitor CVEs and ensure all dependencies and infrastructure are patched and up to dateBuild and maintain reliable prod-to-staging-to-dev data dumps with proper obfuscationDesign and implement compliant data transfer between commercial and government environmentsImprove database performance, query optimization, and reporting infrastructureWhat You Are Expected to Be Excellent AtGetting things done quickly and utilizing Claude Code and MCPs to augment your workflowWriting code across the stack — Ruby/Rails, TypeScript/React, Postgres, Redis, and ElasticsearchBuilding and securing cloud environments on AWSDatabase administration, performance tuning, and query optimizationInfrastructure-as-code and CI/CD pipeline designContext-switching between product work and infrastructureWhat We Are Looking ForStrong product engineering background — you have shipped features, not just managed infrastructureComfortable working across the stack, whether it is building APIs in Rails, writing SQL, or driving out user-facing features in ReactExperience building and securing AWS environments with production workloadsExperie