C3 AI (NYSE: AI), is the Enterprise AI application software company. C3 AI delivers a family of fully integrated products including the C3 Agentic AI Platform, an end-to-end platform for developing, deploying, and operating enterprise AI applications, C3 AI applications, a portfolio of industry-specific SaaS enterprise AI applications that enable the digital transformation of organizations globally, and C3 Generative AI, a suite of domain-specific generative AI offerings for the enterprise. Learn more at: C3 AI
C3 AI is seeking an experienced Federal Security Engineer to serve as the named technical owner of release-gate evidence, Continuous Monitoring (ConMon) automation, and the security engineering interface with our FedRAMP and ATO boundary partner, for our Federal team in Tysons, Virginia. The ideal candidate will ensure Federal deployments meet C3 AI's rigorous security standards and comply with Federal Security Requirements across the full deployment lifecycle.
This role requires US Citizenship or US Permanent Residence. Active security clearance (Secret or higher) is preferred.
Responsibilities:
- Own per-release gate evidence across the 8 gates defined in the Federal Release-Gate Standard (image CVE disposition, allowlist, SCAP/STIG, FIPS validation, Federal BOM) — no evidence, no GA
- Work with cross-functional teams to build and maintain ConMon automation: generated Bill of Materials (BOM), automated drainable-vs-structural POA&M classification, and a live ConMon metrics feed
- Serve as the engineering-level interface with SMX on FedRAMP boundary-register items (image provenance, patch-uplift vs. CA-6, SCAP scope)
- Address unique Federal customer security requirements without compromising core solution integrity
- Support high-visibility defense and intelligence projects with stringent security requirements
- Triage and resolve security vulnerabilities reported by Federal customers
- Ensure solutions comply with technical security requirements for domain-specific programs (e.g., STIG, SCAP/OpenSCAP)
- Manage hardened container registries (e.g., Iron Bank, Chainguard) for Federal deployments
- Work with product, engineering, and compliance teams to upstream controls and resolve issues
- Overlay customer-specific controls while maintaining C3 AI's standard security posture
- Discover and remediate security vulnerabilities in Federal systems and applications
- Collaborate with Information Security, Product, Engineering, and Operations to implement security best practices and ensure compliance with industry standards
- Stay up-to-date with the latest security trends, vulnerabilities, and technologies
Qualifications:
- Bachelor's degree in Computer Science, Information Security, or a related field
- Minimum of 5+ years of experience in information security, DevSecOps, or a related field
- Strong understanding of security principles, practices, and technologies
- Experience with vulnerability management activities (CVEs, IOCs, etc.)
- Experience with Linux and scripting languages such as JavaScript, Shell, and/or Python
- Excellent problem-solving skills and attention to detail
- Strong communication and collaboration skills
- Active DoD 8570 IAT II or above certification (e.g., CISSP or Security+), or ability to obtain
- Hands-on experience with SCAP/OpenSCAP tooling and automated STIG scanning/remediation
Preferred Qualifications:
- Experience with cloud security and securing cloud-based applications
- Familiarity with regulatory requirements and industry standards such as NIST 800-53, CMMC, and FedRAMP
- Experience with security automation and orchestration tools
- Experience with hardened container registries (e.g., Iron Bank, Chainguard), FIPS 140-2/3 validation, and SBOM generation/traceability tooling
Candidates must be authorized to work in the United States without the need for current or future company sponsorship.
C3 AI provides excellent benefits, a competitive compensation package and generous equity plan.
C3 AI is proud to be an Equal Opportunity and Affirmative Action Employer. We do not discriminate on the basis of any legally protected characteristics, including disabled and veteran status.
Skills Required
- Bachelor's degree in Computer Science, Information Security, or a related field
- 5+ years of experience in information security, DevSecOps, or a related field
- Strong understanding of security principles, practices, and technologies
- Experience with vulnerability management, including CVEs and IOCs
- Experience with Linux and scripting languages such as JavaScript, Shell, and/or Python
- Active DoD 8570 IAT II or higher certification, such as CISSP or Security+, or ability to obtain
- Hands-on experience with SCAP/OpenSCAP tooling and automated STIG scanning and remediation
- US citizenship or US permanent residence
- Authorization to work in the United States without current or future company sponsorship
- Experience with cloud security and securing cloud-based applications
- Familiarity with NIST 800-53, CMMC, and FedRAMP
- Experience with security automation and orchestration tools
- Experience with hardened container registries, FIPS 140-2/3 validation, and SBOM generation or traceability tooling
C3 AI Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about C3 AI and has not been reviewed or approved by C3 AI.
-
Fair & Transparent Compensation — Pay is considered competitive to above average for many roles, and compensation stands out more positively than several other aspects of the company. High-end packages are available in certain roles and levels, indicating the ability to pay at or above market when needed.
-
Career-Linked Recognition & Rewards — The company funds an online master’s program that confers a $25,000 completion bonus, a guaranteed 15% raise, and a stock grant. Ongoing internal training and small course-completion bonuses further tie rewards to development milestones.
-
Wellbeing & Lifestyle Benefits — Daily catered lunches, stocked snacks, a free gym membership at the Redwood City HQ, and commuter benefits provide tangible day-to-day perks. Business-travel health coverage and other on-site amenities enhance the workplace experience for those regularly in office.
C3 AI Insights
What We Do
C3 AI is the leading Enterprise AI software provider for accelerating digital transformation. Digital transformation is about leveraging big data and the internet of things to improve performance of assets and predict shortfalls before they happen — all through artificial intelligence and machine learning. Get ahead of supply chain delays before they affect your delivery deadlines. Predict maintenance needs to increase asset uptime, replacing or repairing parts before failure. Reduce energy costs and track sustainability goals in real time, improving building operations and reducing greenhouse gas emissions. Connect disparate health record systems to optimize patient visits and decrease waitlist time. At the core of all C3 AI products is a proprietary, model-driven AI architecture that dramatically enhances data science and application development. The C3 AI Platform allows customers to develop, deploy, and operate large-scale AI, predictive analytics, and IoT applications. And a broad portfolio of turnkey AI applications allows for even faster development and deployment. From reliability and readiness to supply chain optimization and energy management, C3 AI has deep industry expertise to get your enterprise started on its digital transformation.
