Federal Security Engineer: Release-Gate & ConMon Expert

Socket.dev; Tysons (VA); On-site; USD 134,000 - 167,000; Full time

Benefits offered by this job

Competitive compensation

Generous equity plan

Excellent benefits

Job summary

C3 AI in Tysons, Virginia, seeks an experienced Federal Security Engineer to own release-gate evidence and ConMon automation for our Federal deployments, ensuring compliance with security standards across the deployment lifecycle. The role requires US Citizenship or US Permanent Residence, with active security clearance preferred.

You will collaborate with product, engineering, and compliance teams to meet STIG, SCAP/OpenSCAP, and FedRAMP requirements while maintaining the integrity of the C3 AI

Qualifications

• Bachelor's degree in Computer Science, Information Security, or a related field.
• 5+ years of experience in information security, DevSecOps, or a related field.
• Experience with vulnerability management activities (CVEs, IOCs, etc.).
• Active DoD 8570 IAT II or above certification (e.g., CISSP or Security+), or ability to obtain.
• Hands‑on experience with SCAP/OpenSCAP tooling and automated STIG scanning/remediation.

Responsibilities

• Own per-release gate evidence across the 8 gates defined in the Federal Release-Gate Standard (image CVE disposition, allowlist, SCAP/STIG, FIPS validation, Federal BOM).
• Work with cross-functional teams to build and maintain ConMon automation: BOM, POA&M classification, and a live ConMon metrics feed
• Serve as the engineering-level interface with SMX on FedRAMP boundary-register items (image provenance, patch-uplift vs. CA-6, SCAP scope)
• Address unique Federal customer security requirements without compromising core solution integrity
• Support high-visibility defense and intelligence projects with stringent security requirements
• Triage and resolve security vulnerabilities reported by Federal customers
• Ensure solutions comply with technical security requirements for domain-specific programs (e.g., STIG, SCAP/OpenSCAP)
• Manage hardened container registries (e.g., Iron Bank, Chainguard) for Federal deployments
• Work with product, engineering, and compliance teams to upstream controls and resolve issues
• Overlay customer-specific controls while maintaining C3 AI's standard security posture
• Discover and remediate security vulnerabilities in Federal systems and applications
• Collaborate with Information Security, Product, Engineering, and Operations to implement security best practices and ensure compliance with industry standards
• Stay up-to-date with the latest security trends, vulnerabilities, and technologies

Skills

Security principles

DevSecOps

Vulnerability management

Linux

Scripting

Problem solving

Communication

DoD 8570 IAT II+

SCAP/OpenSCAP tooling

Education

Bachelor's degree in CS/Info Security

Tools

SCAP/OpenSCAP tooling

Stig scanning

Container security tooling

Job description

C3 AI in Tysons, Virginia, seeks an experienced Federal Security Engineer to own release-gate evidence and ConMon automation for our Federal deployments, ensuring compliance with security standards across the deployment lifecycle. The role requires US Citizenship or US Permanent Residence, with active security clearance preferred.

You will collaborate with product, engineering, and compliance teams to meet STIG, SCAP/OpenSCAP, and FedRAMP requirements while maintaining the integrity of the C3 AI