Software Engineer

BluestoneLogic; Washington (District of Columbia); On-site; USD 120,000 - 170,000; Full time

Job summary

BluestoneLogic is seeking a Full-Stack Software Engineer to design, build, and deliver secure, highly interactive applications for mission-focused users. You will own work from loosely defined requirements through deployment using GitHub Actions and AWS.

Ideal candidates have strong experience with Python, Django REST Framework, React, TypeScript, MySQL, Docker Compose, and Git; you will optimize canvas-based interfaces and lead security and compliance reviews.

Qualifications

• Proficient in Python and Django REST Framework for building RESTful services.
• Strong React and TypeScript fundamentals with modern state management.
• Experience with MySQL and relational data modeling.

Responsibilities

• Design, build, and deliver secure, interactive applications for mission-focused users.
• Own work from requirements through deployment using GitHub Actions and AWS.
• Lead security/compliance activities and optimize performance in complex UIs.

Skills

Python

Django REST Framework

React

TypeScript

state management

MySQL

Docker Compose

Git-based development

AI-assisted development

CI/CD

AWS services

Tools

Django REST Polymorphic

GitHub Actions

AWS EC2

S3

ECS

Job description

This job posting is Full-Stack Software Engineer to design, build, and deliver secure, highly interactive applications for mission-focused users. The ideal candidate has strong experience with Python, Django REST Framework, React, TypeScript, modern state management, MySQL, Docker Compose, and Git-based development. You should be comfortable optimizing complex canvas-based interfaces, profiling React performance, designing efficient data models, and making safe, backward-compatible changes in mature codebases. You will own work from loosely defined requirements through deployment, using GitHub Actions and AWS services such as EC2, S3, and ECS, while maintaining robust end-to-end test coverage with tools such as Playwright, Selenium, or Cypress.

This role requires thoughtful use and review of AI coding tools, including the ability to recognize generated-code failures, protect sensitive information, distinguish AI-assisted development from agentic workflows, and apply least-privilege controls to agent tools and permissions. You will also help meet security and compliance requirements by addressing STIG/SCAP findings, Fortify results, and DAST findings from tools such as OWASP ZAP. Success requires a strong product mindset, care for usability in information-dense operator workflows, and the confidence to lead customer meetings, gather requirements, demonstrate work, and clearly explain technical decisions. Experience with GIS technologies, WebSockets, SSO and identity systems is a plus.

Engineering

• Familiarity with Python, Django, and building REST APIs, ideally with Django REST Polymorphic
• Strong React + TypeScript fundamentals, with modern state-management experience (e.g. Redux Toolkit) and experience building interactive, canvas-based applications
• Skilled at React performance debugging and profiling, using the React Profiler / DevTools to find and fix re-render and rendering bottlenecks in rich, highly interactive interfaces
• Comfortable with relational databases (MySQL) and writing efficient queries, including schemas that use polymorphic inheritance
• A track record of safe, incremental changes to a mature codebase, mindful of regressions and backward compatibility
• Experience with containerized development and deployment using Docker Compose
• Proficiency in git workflows as well as maintaining a high level of code hygiene and branch management, with particular care paid to creation of issues, maintaining projects, and creating detailed, verbose pull requests

AI-Assisted Development

• Hands-on with at least one AI coding tool (e.g. Claude Code, Codex), with the judgment to know where it fits and where it can't be used
• A security- and compliance-oriented approach to identifying what information can and can't be shared with AI tools
• Able to read and understand generated code before committing it, and to explain why it works and where it might be wrong from their own understanding
• Capable of reviewing AI-assisted contributions and identifying common LLM hallucinations and failure patterns
• Able to explain the difference between general AI-assisted development and building agentic features/workflows
• Understands how to scope an AI agent's permissions and tool access, granting only what task requires

Testing & delivery

• Experience with CI/CD using GitHub Actions (or similar tooling), including building and deploying to AWS infrastructure (EC2, S3, ECS)
• Experience implementing or maintaining end-to-end test suites using Playwright, Selenium or Cypress

Security & compliance

• Familiarity with STIG compliance and checking tools (SCAP/STIG scanners) and remediating findings
• Experience with Fortify static analysis and remediating flagged vulnerabilities
• Familiarity with dynamic security scanning (OWASP ZAP or similar DAST)

UI/UX

• Experience designing software for specific, known users doing a particular job, thinking in operator workflows and real tasks
• Care for usability, layout, and interaction in complex, information-dense interfaces
• An eye for performance and responsiveness in rich, highly interactive interfaces

Communication

• Comfortable running a meeting with customers and stakeholders, including gathering requirements, demoing work, and answering questions directly
• Able to explain technical concepts and trade-offs clearly to non-technical stakeholders
• Clear about the what and why of a code change in PR descriptions, reviews, and documentation
• Self-starting: takes a loosely defined problem and drives it to a shipped, verified result without close management

Nice to have

• Geospatial / GIS work (Mapbox GL / MapLibre, GeoJSON, Turf)
• Real-time / WebSocket applications (Django Channels)
• SSO / identity systems (OIDC, LDAP, Keycloak) and fine-grained permissions
• Familiarity with other statically typed languages such as C#/.NET, Java, Go, or Rust
• Experience with AWS Bedrock in GovCloud