Principal / Sr Principal Cybersecurity Analyst - 19526 - Roy Utah

Northrop Grumman•Roy, UT

1d•$98,400 - $184,200•Onsite

About The Position

The Northrop Grumman CIDO Classified Solutions team is seeking a Principal/Senior Principal Cyber Analyst to support IT hardware lifecycle planning, strict hardware accountability and rigorous Cybersecurity Supply Chain Management (C-SCRM) compliance. This role directly aligns with Department of Defense (DoD) instructions and NIST Special Publications (SP) 800-53 (CM-8) and 800-161. The selected candidate will be required to work on-site, full-time at our Roy, Utah location. The Cyber Analyst establishes full transparency, security, and strict accountability for all information and communications technology (ICT) hardware assets. This role spans the entire asset lifecycle: secure procurement, chain-of-custody tracking, deployment, continuous monitoring, and compliant decommissioning. The officer mitigates foundational supply chain threats—such as counterfeit components, unauthorized tampering, and malicious firmware—while strictly maintaining the baseline system inventory mandated by DoD frameworks.

Requirements

Master's Degree with 3 years of experience; OR a Bachelor's Degree with 5 years of experience; OR an Associate's Degree with 7 years of experience; OR a High School Diploma (or equivalent) with 9 years of experience is required (for Level 3).
Master's Degree with 6 years of experience; OR a Bachelor's Degree with 8 years of experience; OR an Associate's Degree with 10 years of experience; OR a High School Diploma (or equivalent) with 12 years of experience is required (for Level 4).
3+ years in IT asset management (ITAM), hardware logistics, or inventory control within a DoD-regulated environment, defense industrial base (DIB), or federal agency.
Demonstrable working knowledge of NIST SP 800-161 (C-SCRM), NIST SP 800-53 (specifically Configuration Management controls), and DoD SCRM regulations.
Candidates must be able to obtain the U.S. Government 8140 requirements for the job role – such as CompTIA Security+ CE certification.
Candidates must have the ability to obtain and maintain a U.S. Government Secret (at a minimum) security clearance within a reasonable amount of time.
Candidates must have the ability to obtain, and maintain, access to Special Access Programs as a condition of continued employment.
U.S. Citizenship is required for all positions with a government clearance and certain other restricted positions.

Nice To Haves

9 years with a bachelor's degree, 7 years with a Masters, 4 years with a PhD
Active Secret, Top Secret, SCI, SAP/SAR access, or Polygraph
Security+ CE certification
Advanced hands-on experience with enterprise ITAM/CMDB platforms (e.g., ServiceNow, Jira Service Management, or federal-grade tracking systems) integrated with automated discovery tools
Expert capability to identify, categorize, and document enterprise-level tech components, including servers, switches, cryptographic modules, and end-user devices.
Proven experience executing high-security intake, secure warehouse handling, and strict logistics documentation.

Responsibilities

Execute supplier tiering and risk profiling during procurement to ensure hardware originates from trusted, vetted OEMs.
Inspect inbound IT shipments for signs of supply chain tampering, counterfeit parts, or altered hardware serial configurations.
Maintain continuous operational evidence of C-SCRM controls to satisfy rigorous third-party federal and DoD compliance audits.
Partner with security teams to immediately isolate or flag hardware batches affected by global supply chain vulnerability.
Enforce security and tracking controls directly within the vendor hardware onboarding pipeline.
Log, serialize, and apply physical or digital asset tags to components immediately upon delivery to establish an unbroken chain of custody.
Maintain a pristine, automated inventory baseline linked to change-management workflows, ensuring no unapproved field modifications occur.
Manage the end-of-life process through NSA-approved data destruction methods and certified e-waste partners, gathering verifiable Certificates of Destruction.
Operate and update the central Configuration Management Database (CMDB) or IT Asset Management (ITAM) platform as the single source of truth.
Conduct strict, periodic cycle counts and blind physical audits across secure storage facilities and remote environments.
Investigate and document any data mismatches between physical stock and digital ledger entries, escalating systemic variances to the C-SCRM Program Management Office.