Cyber Supply Chain Risk Management (C-SCRM) Analyst

Fortress Information Security•Washington, DC

6d•$89,000 - $100,000•Hybrid

About The Position

Fortress is building a pipeline of qualified candidates for an upcoming Cyber Supply Chain Risk Management (C-SCRM) Analyst opening. While this role is not immediately open, we expect to fill it soon and want to connect with strong candidates now so we can move quickly when it does. Thank you for your understanding! The Cyber Supply Chain Risk Management (C-SCRM) Analyst supports Fortress's Government Delivery team by identifying, analyzing, and communicating cyber supply chain risks for U.S. Navy programs. This role serves as the analytical engine behind risk discovery - reviewing submitted data, evaluating supply chain risk indicators, interpreting platform findings, and translating raw information into meaningful program and mission impact. Working closely with Management Analysts, Technical Project Managers, Delivery leaders, and technical subject matter experts, the analyst supports risk analysis, reporting, and customer delivery at scale. The role offers the opportunity to develop deep expertise in the Fortress C-SCRM Platform, Fortress deliverables, and relevant Navy systems and data, making it an ideal position for someone looking to grow as a trusted subject matter expert in federal cyber supply chain risk. This is a high-impact role directly tied to customer retention, program quality, and Fortress's continued growth across Navy accounts.

Requirements

2–4 years of experience in cyber supply chain risk management, cybersecurity analysis, threat intelligence, supplier risk, risk analysis, federal consulting, government delivery, or a related field.
Active Secret clearance required at time of hire.
Experience analyzing technical, supplier, product, vendor, threat, bill of materials, or risk data and translating findings into clear business, operational, or mission impact.
Understanding of cyber supply chain risk concepts, including supplier risk, software risk, hardware risk, third-party risk, ownership/control concerns, threat exposure, and vulnerability or compromise indicators.
Ability to review data for accuracy, completeness, and risk significance while documenting findings clearly and objectively.
Ability to learn specialized platforms, customer systems, product workflows, and data structures quickly and apply that knowledge to risk analysis and deliverable development.
Proficiency with Microsoft Excel, including the ability to organize, filter, compare, review, and summarize data.
Proficiency with Microsoft PowerPoint, including the ability to support clear, professional presentations and briefing materials.
Strong written communication skills with the ability to summarize complex risk information for internal stakeholders, program teams, and occasional customer-facing discussions.
Ability to serve as a subject matter expert on risk findings, platform outputs, and deliverable content when needed.
Ability to work effectively in a hybrid environment in the Washington, DC area.
Ability to collaborate with project managers, analysts, technical teams, and delivery leaders while operating with moderate independence.
Intermediate proficiency using AI tools to support research, analysis, summarization, and productivity while applying sound judgment, validation, and responsible-use practices.
Ability to travel up to 15% for customer on-site visits, in-person meetings, or program-related engagements.
Ability to handle sensitive information and comply with applicable security, confidentiality, clearance, and customer requirements.

Nice To Haves

Security+ certification or other related cybersecurity, risk management, supply chain risk, or information assurance certification.
Experience supporting Department of Defense, Department of Navy, federal civilian, or defense industrial base customers.
Experience with C-SCRM, SCRM, vendor risk management, third-party risk management, software supply chain risk, hardware supply chain risk, cyber threat intelligence, or product assurance.
Familiarity with FOCI, SBOM, HBOM, supplier risk scoring, vulnerability data, compromised software libraries, or product assurance workflows.
Experience reviewing bills of materials, supplier data, software component data, hardware component data, product data, or platform-generated risk findings.
Experience using data analysis, case management, risk management, cybersecurity, or reporting platforms to evaluate and communicate risk.
Familiarity with federal cybersecurity frameworks, standards, or guidance such as NIST, CMMC, FedRAMP, RMF, or DoD cybersecurity requirements.
Experience producing written findings, risk summaries, briefing inputs, or analytical reports for government or regulated customers.

Responsibilities

Analyze cyber supply chain risk data to identify supplier, product, software, hardware, ownership, control, influence, dependency, and vulnerability risks that may impact U.S. Navy programs.
Review submitted data, including hardware and software bills of materials, for completeness, accuracy, consistency, and indicators of high supply chain risk.
Evaluate findings within the Fortress C-SCRM Platform and identify risk patterns, anomalies, or areas requiring additional review or escalation.
Translate raw threat and supply chain data, including indicators such as Foreign Ownership, Control, or Influence (FOCI), compromised software libraries, supplier exposure, product vulnerabilities, or bill of materials concerns, into clear risk narratives and potential mission impacts.
Develop subject matter expertise in the Fortress C-SCRM Platform, Fortress products, Navy systems, customer data, and program deliverables to support accurate analysis and consistent delivery outcomes.
Identify, document, and communicate high-risk supply chain findings so internal stakeholders and customer-facing team members understand the risk, impact, and recommended next steps.
Partner with Management Analysts, Technical Project Managers, and technical subject matter experts to support program-level reporting, risk briefings, deliverable development, and customer milestones.
Serve as a subject matter expert during customer discussions when needed, including answering questions about risk findings, data interpretation, platform outputs, or deliverable content.
Document risk findings, assumptions, data limitations, and recommended areas for further review in a clear, defensible, and repeatable manner.
Support the development and refinement of analytical processes, templates, quality checks, and reporting inputs that improve consistency, efficiency, and confidence in C-SCRM deliverables.
Use Excel to review, organize, analyze, validate, and summarize supply chain, supplier, platform, bill of materials, or risk data.
Use PowerPoint to support clear communication of risk findings, trends, impacts, and recommendations in customer-ready or internal briefing materials.
Apply intermediate AI proficiency to improve research, analysis, summarization, pattern recognition, and workflow efficiency while following Fortress, customer, and security requirements for responsible AI use.
Maintain awareness of cyber supply chain risk concepts, threat intelligence, supplier risk indicators, software risk, hardware risk, and federal cybersecurity requirements relevant to government and defense customers.
Protect sensitive customer, supplier, product, and program information in accordance with applicable security, contractual, clearance, and customer requirements.
Travel up to 15% for potential customer site visits, in-person meetings, or program-related engagements.

Benefits

Remote and Hybrid working environment
Competitive pay structure
Medical, dental, vision plans with employees covered up to 90% with highly progressive options for dependents and families
Company paid life, short- and long-term disability insurance
Employee Assistance Program
401(k) match
Flexible Paid Time Off
Parental Leave
professional growth opportunities through succession planning, up-skilling, and certifications
Tuition and certification reimbursement
Employee Referral Programs
Company Sponsored Events