CybersecurityJobs.io
← Back to all jobs
PeopleTec, Inc.

System Security Engineer Cyber-Supply Chain Risk Management

PeopleTec, Inc.
Huntsville, AL Full time Posted 3h ago
Cyber Supply Chain Risk Management Cybersecurity Tools Engineer Information Security InfoSec Security Compliance Security Risk Management Security Standards Security Testing Software Security Software Security Assessment
Apply Now

Job Description

System Security Engineer focused on Cyber-Supply Chain Risk Management (C-SCRM), supporting a PMO to identify software supply chain vulnerabilities and malicious logic across the lifecycle.

Responsibilities

  • Provide technical support and security engineering for Cyber-Supply Chain Risk Management across the system lifecycle, including design, development, acquisition, integration, testing, fielding, and sustainment.
  • Define and support SBOM requirements for procured and open-source software.
  • Author and maintain the Consolidated Program SBOM for Government review and approval.
  • Create and maintain Third-Party Software Vulnerability Reports and Supplier Secure Software Attestation Forms for Government review and approval.
  • Conduct deep-dive vulnerability analysis and code provenance checks for third-party libraries.
  • Establish and support Software Composition Analysis (SCA) and Static Analysis (SAST) requirements during vendor onboarding.
  • Manage C-SCRM processes to ensure compliance with defense and industry standards.
  • Coordinate C-SCRM objectives and strategies with internal teams and external organizations.
  • Prepare and present C-SCRM findings, reports, and improvement plans to senior management and stakeholders.
  • Perform strategic planning and coordination in support of program objectives.
  • Provide technical expertise to peer engineers in Technology Security, Program Protection, Cyber Security, and Technical Management teams.
  • Use digital tools and methodologies to assess supply chain risks, including manufacturer and supplier relationships and foreign ownership or controlling influence.
  • Complete other tasks assigned by Program Lead Engineers, Cybersecurity Lead, and/or Technical Chief.

Requirements

  • 5+ years of relevant experience. Additional education may be substituted for years of experience.
  • Demonstrated experience in C-SCRM, particularly in defense or aerospace contexts.
  • Knowledge of SPDX/CycloneDX, SCA, SAST/DAST, VEX, and FIPS 140-3 validation.
  • Must meet minimum DoDM 8140.03 Defense Cyber Workforce qualification requirements in one of the following work roles:
    • 622 (Secure Software Assessor) at the Intermediate level, or
    • 652 (Security Architect) at the Intermediate level.
  • Strong knowledge of industry standards and defense requirements.
  • Excellent communication and presentation skills.
  • Ability to lead and work within a multidisciplinary team.
  • Previous experience working in a U.S. Government Program Office (required).
  • Travel: 25%.
  • U.S. Citizen (required).
  • Active DoD Secret clearance required: Candidates must have an active Secret clearance upon hire and maintain it during employment.

Technologies

  • SPDX, CycloneDX
  • SBOM
  • Consolidated Program SBOM
  • Third-Party Software Vulnerability Reports
  • Supplier Secure Software Attestation Forms
  • Software Composition Analysis (SCA)
  • Static Analysis (SAST), Dynamic Analysis (DAST)
  • VEX
  • FIPS 140-3 validation

Desired Skills

  • Top Secret clearance preferred.
  • DoDI 8140.03 qualification at the Advanced level for work role:
    • 622 (Secure Software Assessor), or
    • 652 (Security Architect).

Location: Huntsville, AL (onsite)

Education: Bachelor’s degree in Computer Science, Engineering, or a related technical discipline

Similar Jobs