Security Engineer

C3 AI (NYSE: AI), is the Enterprise AI application software company. C3 AI delivers a family of fully integrated products including the C3 Agentic AI Platform, an end-to-end platform for developing, deploying, and operating enterprise AI applications, C3 AI applications, a portfolio of industry-specific SaaS enterprise AI applications that enable the digital transformation of organizations globally, and C3 Generative AI, a suite of domain-specific generative AI offerings for the enterprise. Learn more at: C3 AI

C3 AI is seeking an experienced Federal Security Engineer to serve as the named technical owner of release-gate evidence, Continuous Monitoring (ConMon) automation, and the security engineering interface with our FedRAMP and ATO boundary partner, for our Federal team in Tysons, Virginia. The ideal candidate will ensure Federal deployments meet C3 AI's rigorous security standards and comply with Federal Security Requirements across the full deployment lifecycle.

This role requires US Citizenship or US Permanent Residence. Active security clearance (Secret or higher) is required.

Responsibilities:

• Own per-release gate evidence across the 8 gates defined in the Federal Release-Gate Standard (image CVE disposition, allowlist, SCAP/STIG, FIPS validation, Federal BOM) — no evidence, no GA
• Work with cross-functional teams to build and maintain ConMon automation: generated Bill of Materials (BOM), automated drainable-vs-structural POA&M classification, and a live ConMon metrics feed
• Serve as the engineering-level interface with SMX on FedRAMP boundary-register items (image provenance, patch-uplift vs. CA-6, SCAP scope)
• Address unique Federal customer security requirements without compromising core solution integrity
• Support high-visibility defense and intelligence projects with stringent security requirements
• Triage and resolve security vulnerabilities reported by Federal customers
• Ensure solutions comply with technical security requirements for domain-specific programs (e.g., STIG, SCAP/OpenSCAP)
• Manage hardened container registries (e.g., Iron Bank, Chainguard) for Federal deployments
•  Work with product, engineering, and compliance teams to upstream controls and resolve issues
• Overlay customer-specific controls while maintaining C3 AI's standard security posture
• Discover and remediate security vulnerabilities in Federal systems and applications
• Collaborate with Information Security, Product, Engineering, and Operations to implement security best practices and ensure compliance with industry standards