System Security Engineer Cyber-Supply Chain Risk Management

PeopleTec, Inc. is seeking a System Security Engineer focused on Cyber-Supply Chain Risk Management (C-SCRM) to support its mission in Huntsville, AL. In this role, you will help strengthen the software supply chain by analyzing third-party code, dependencies, and build processes, and by producing C-SCRM findings and improvement plans for senior stakeholders.

The position provides technical support within a PMO environment, covering the full system lifecycle from design and development through sustainment. You will coordinate with internal security and engineering teams as well as external organizations supporting program protection activities, with an emphasis on defensible assurance practices across procured and open-source software.

Responsibilities

• Provide technical support and security engineering for C-SCRM across the system lifecycle, including design, development, acquisition, integration, testing, fielding, and sustainment.
• Mandate and manage Software Bills of Materials (SBOMs) for all procured and open-source software.
• Conduct deep-dive vulnerability analysis and code provenance checks on third-party libraries.
• Establish Software Composition Analysis (SCA) and Static Analysis (SAST) requirements during vendor onboarding.
• Develop and maintain program artifacts including the Consolidated Program SBOM, Third-Party Software Vulnerability Reports, and Supplier Secure Software Attestation Forms.
• Support compliance with defense and industry standards by managing C-SCRM processes effectively.
• Interface with internal teams and external organizations to coordinate C-SCRM objectives and strategies.
• Prepare and present C-SCRM findings, reports, and improvement plans to senior management and relevant stakeholders.
• Perform strategic planning and coordination to support program objectives.
• Provide technical expertise to peer engineers within Technology Security, Program Protection, Cyber Security, and Technical Management teams.
• Use digital tools and methodologies to assess supply chain risk, including manufacturer and supplier relationships and foreign ownership and controlling influence.
• Complete other tasks as assigned by the Chief Engineer and/or Technical Chief.

Requirements

• 5+ years of relevant experience; additional education may be substituted for years of experience.
• Demonstrated experience in C-SCRM, particularly within defense or aerospace contexts.
• Knowledge of SPDX/CycloneDX, Software Composition Analysis (SCA), SAST/DAST, VEX, and FIPS 140-3 validation.
• Must meet minimum DoDI 8140.03 Defense Cyber Workforce qualification requirements in one of the following work roles:
  • 622 (Secure Software Assessor) at the Intermediate level, or
  • 652 (Security Architect) at the Intermediate level.
• Strong knowledge of industry standards and defense requirements.
• Excellent communication and presentation skills.
• Ability to lead and work within a multidisciplinary team.
• Previous experience working in a U.S. Government Program Office (required).
• Travel: 25%.
• U.S. Citizen required.
• An active DoD Secret clearance is required upon hire, and candidates must be able to maintain it throughout employment.

Technologies

• SPDX
• CycloneDX
• Software Composition Analysis (SCA)
• SAST/DAST
• VEX
• FIPS 140-3

Preferred Qualifications

• Top Secret clearance preferred.
• DoDI 8140.03 qualification at the Advanced level for work role 622 (Secure Software Assessor) or 652 (Security Architect).

Opportunity

• Provide technical support to the program’s Chief Engineer and Technical Chief.
• Help secure the software supply chain by analyzing third-party code, dependencies, and build processes for vulnerabilities and malicious logic prior to integration across the system lifecycle.
• Collaborate within a multidisciplinary security and engineering team to support program goals.
• Interface with internal program managers across PAE Fires and external organizations including HQDA, ASA(ALT), JIATF 401, ATEC, AMCOM, and others to coordinate and synchronize C-SCRM technical and programmatic objectives.

Location: Huntsville, AL (onsite)

Education: Bachelor’s degree in Computer Science, Engineering, or a related technical discipline.