C3.ai

Builds ready-made AI apps for industry and defense

Federal Security Engineer - Federal, Fieldops

Security Engineering & ArchitectureConfirmed live in the last 24 hours

Full-timeTysons, VA, USAIn-person

About the Job

Requirements

A Bachelor's degree in Computer Science, Information Security, or a related field is required.
A minimum of 5 years of experience in information security, DevSecOps, or a related field is required.
Strong understanding of security principles, practices, and technologies is required.
Experience with vulnerability management activities, including CVEs and IOCs, is required.
Experience with Linux and scripting languages such as JavaScript, Shell, and/or Python is required.
Active DoD 8570 IAT II or above certification, such as CISSP or Security+, or the ability to obtain it, is required.
Hands-on experience with SCAP/OpenSCAP tooling and automated STIG scanning and remediation is required.
US citizenship or US permanent residence is required, along with authorization to work in the United States without current or future company sponsorship.
An active security clearance of Secret or higher is required.

Responsibilities

Own per-release gate evidence across the eight gates defined in the Federal Release-Gate Standard, including image CVE disposition, allowlist, SCAP/STIG, FIPS validation, and Federal BOM; releases cannot reach general availability without evidence.
Work with cross-functional teams to build and maintain Continuous Monitoring automation, including a generated Bill of Materials, automated drainable-versus-structural POA&M classification, and a live Continuous Monitoring metrics feed.
Serve as the engineering-level interface with SMX on FedRAMP boundary-register items, including image provenance, patch uplift versus CA-6, and SCAP scope.
Address unique Federal customer security requirements without compromising core solution integrity.
Support high-visibility defense and intelligence projects with stringent security requirements.
Triage and resolve security vulnerabilities reported by Federal customers.
Ensure solutions comply with technical security requirements for domain-specific programs, including STIG and SCAP/OpenSCAP.
Manage hardened container registries, such as Iron Bank and Chainguard, for Federal deployments.
Work with product, engineering, and compliance teams to upstream controls and resolve issues.
Overlay customer-specific controls while maintaining C3 AI's standard security posture.
Discover and remediate security vulnerabilities in Federal systems and applications.
Collaborate with Information Security, Product, Engineering, and Operations to implement security best practices and ensure compliance with industry standards.
Stay up to date with the latest security trends, vulnerabilities, and technologies.

Desired Qualifications

Experience with cloud security and securing cloud-based applications is preferred.
Familiarity with regulatory requirements and industry standards such as NIST 800-53, CMMC, and FedRAMP is preferred.
Experience with security automation and orchestration tools is preferred.
Experience with hardened container registries such as Iron Bank and Chainguard, FIPS 140-2/3 validation, and SBOM generation and traceability tooling is preferred.

C3 AI (NYSE: AI), is the Enterprise AI application software company. C3 AI delivers a family of fully integrated products including the C3 Agentic AI Platform, an end-to-end platform for developing, deploying, and operating enterprise AI applications, C3 AI applications, a portfolio of industry-specific SaaS enterprise AI applications that enable the digital transformation of organizations globally, and C3 Generative AI, a suite of domain-specific generative AI offerings for the enterprise. Learn more at: C3 AI

C3 AI is seeking an experienced Federal Security Engineer to serve as the named technical owner of release-gate evidence, Continuous Monitoring (ConMon) automation, and the security engineering interface with our FedRAMP and ATO boundary partner, for our Federal team in Tysons, Virginia. The ideal candidate will ensure Federal deployments meet C3 AI's rigorous security standards and comply with Federal Security Requirements across the full deployment lifecycle.

This role requires US Citizenship or US Permanent Residence. Active security clearance (Secret or higher) is required.

Responsibilities:

Own per-release gate evidence across the 8 gates defined in the Federal Release-Gate Standard (image CVE disposition, allowlist, SCAP/STIG, FIPS validation, Federal BOM) — no evidence, no GA
Work with cross-functional teams to build and maintain ConMon automation: generated Bill of Materials (BOM), automated drainable-vs-structural POA&M classification, and a live ConMon metrics feed
Serve as the engineering-level interface with SMX on FedRAMP boundary-register items (image provenance, patch-uplift vs. CA-6, SCAP scope)
Address unique Federal customer security requirements without compromising core solution integrity
Support high-visibility defense and intelligence projects with stringent security requirements
Triage and resolve security vulnerabilities reported by Federal customers
Ensure solutions comply with technical security requirements for domain-specific programs (e.g., STIG, SCAP/OpenSCAP)
Manage hardened container registries (e.g., Iron Bank, Chainguard) for Federal deployments
Work with product, engineering, and compliance teams to upstream controls and resolve issues
Overlay customer-specific controls while maintaining C3 AI's standard security posture
Discover and remediate security vulnerabilities in Federal systems and applications
Collaborate with Information Security, Product, Engineering, and Operations to implement security best practices and ensure compliance with industry standards
Stay up-to-date with the latest security trends, vulnerabilities, and technologies

Qualifications:

Bachelor's degree in Computer Science, Information Security, or a related field
Minimum of 5+ years of experience in information security, DevSecOps, or a related field
Strong understanding of security principles, practices, and technologies
Experience with vulnerability management activities (CVEs, IOCs, etc.)
Experience with Linux and scripting languages such as JavaScript, Shell, and/or Python
Excellent problem-solving skills and attention to detail
Strong communication and collaboration skills
Active DoD 8570 IAT II or above certification (e.g., CISSP or Security+), or ability to obtain
Hands-on experience with SCAP/OpenSCAP tooling and automated STIG scanning/remediation

Preferred Qualifications:

Experience with cloud security and securing cloud-based applications
Familiarity with regulatory requirements and industry standards such as NIST 800-53, CMMC, and FedRAMP
Experience with security automation and orchestration tools
Experience with hardened container registries (e.g., Iron Bank, Chainguard), FIPS 140-2/3 validation, and SBOM generation/traceability tooling

Candidates must be authorized to work in the United States without the need for current or future company sponsorship.

C3 AI provides excellent benefits, a competitive compensation package and generous equity plan.

Virginia Base Pay Range

$134,000—$167,000 USD

C3 AI is proud to be an Equal Opportunity and Affirmative Action Employer. We do not discriminate on the basis of any legally protected characteristics, including disabled and veteran status.

Virginia Base Pay Range 134000 - 167000 USD

Requirements at a Glance

Experience Level: Senior
Education: Bachelor's
Work Authorization: No H-1B sponsorship

Benefits

Education - Lifelong learning is a part of C3 AI. That's why we will cover the total cost for employees to earn a master's degree in computer science online. Those who complete the degree get three more big perks—a $25,000 cash bonus, a guaranteed 15% raise and a stock grant.
Relax and recharge - In the United States, C3 AI offers 15 days of paid time off every year. As your tenure with the company grows so does your paid time off! C3 AI also offers 10 paid public holidays around which you can build your vacation leave.
Training - C3 AI holds monthly employee training sessions as well as weekly lunch-and-learns. C3 AI also encourages further education by offering bonuses for the successful completion of select online courses.
Health coverage - C3 AI offers competitive coverage. Our program includes medical, dental, and vision.
401K - C3 AI offers fund options via Charles Schwab for retirement savings.
Equity - Restricted stock units are granted to all full-time C3 AI employees.
Free gym membership - To help keep you at the top of your game, C3 AI offers employees a free gym membership at our state-of-the-art fitness facility.
Catered lunches daily - C3 AI provides a fully stocked snack area and beverage refrigerator that contains everything from energy drinks to sodas and iced tea. Every day C3 AI provides a catered, gourmet lunch so that the team can relax together and share ideas.
Commuter check program - C3 AI offers tax saving commuter benefits program.
Travel assistance - Employees are provided global health insurance while traveling for business
Ping-pong and pool tables - C3 AI has been known to host ping-pong and pool tournaments, allowing you to step away from the monitor. This is the perfect opportunity to enjoy coworkers while hitting a white ball at them.
Friday happy hour - Relax and unwind at the end of the week at C3's weekly Friday Happy Hour. Enjoy good food, good drinks and great company at our office.

About the Company

C3.ai

Builds ready-made AI apps for industry and defense

C3.ai builds software that large companies and government agencies use to create and run AI applications, and it sells ready-made AI apps for industries such as manufacturing, energy, and defense. When it listed on the New York Stock Exchange in 2020 under the ticker AI, its shares more than doubled on the first day. Its platform pulls data from business systems and equipment sensors into one shared model, and its apps predict machine failures, plan inventory, and schedule production. Customers pay mainly through subscriptions, and its C3 Code tool builds apps from plain-English requests. Tom Siebel, who earlier founded Siebel Systems and sold it to Oracle, started C3.ai in 2009, and it is based in Redwood City, California.

Company size: 501-1,000
Company stage: IPO
Headquarters: Redwood City, CA
Founded: 2009

Recently Posted Jobs

Explore more opportunities at C3.ai

See more jobs