Principal / Sr. Principal Software Engineer - Software Assurance

Northrop Grumman•El Segundo, CA

1d•$114,000 - $213,400•Onsite

About The Position

Northrop Grumman’s Aeronautics Sector is seeking a Principal or Sr. Principal Software Engineer - Software Assurance for its Research and Advanced Development team in El Segundo, California. The role supports advanced concept creation, rapid prototyping, demonstrations, and technical challenges involving survivability, autonomy, and battle management. The position is onsite and contingent on program funding; the start date will be determined after funding confirmation. The engineer will develop and maintain software assurance documentation and plans, configure and maintain security analysis tools in collaboration with DevOps and System Security Engineering, and assess supplier software and firmware for vulnerabilities. The role includes reviewing automated findings, recommending mitigations, supporting code-signing and secure build/deployment tooling, and sustaining assurance activities across program phases from 2027 through 2031. The role may be filled at the Principal or Sr. Principal level depending on qualifications. A clearance is not required to start, but the candidate must be able to obtain and maintain a U.S. Government clearance and Special Access Program (SAP) access within a reasonable time as determined by business needs. Travel is 10% of the time. Relocation assistance may be available.

Requirements

For Principal level: Bachelor of Science degree in a STEM discipline and 5 years of engineering-related experience, or a STEM master's degree and 3 years of related engineering experience.
For Sr. Principal level: Bachelor of Science degree in a STEM discipline and 8 years of engineering-related experience, or a STEM master's degree and 6 years of related engineering experience, or a STEM Ph.D. and 4 years of related engineering experience.
Hands-on experience with application security and vulnerability management tools, such as SAST, DAST, container scanning, and vulnerability scanners.
Familiarity with secure development lifecycle practices and configuration of DevOps/CI/CD pipelines.
Ability to analyze scan results, identify vulnerabilities, and develop practical mitigation recommendations.
Strong written and verbal communication skills, including experience writing technical plans or reports.
Ability to collaborate with cross-functional teams, including DevOps, suppliers, customers, and security engineering.
Ability to obtain and maintain a U.S. Government clearance and Special Access Program (SAP) access within a reasonable time as determined by business needs.

Nice To Haves

Bachelor’s degree in Computer Science, Software Engineering, Electrical Engineering, or Cybersecurity, or an advanced degree in a relevant technical discipline.
Direct experience with NIST guidance such as NIST 8397 and PPP or equivalent program protection frameworks.
Experience in software and firmware assurance for complex, multi-supplier systems.
Prior involvement in code-signing implementation and secure build/deployment architectures.
Experience on large government or defense programs, especially in system security or software assurance IPTs.
Familiarity with containerized environments, infrastructure as code, and cloud-native security tooling.
Demonstrated ability to lead or coordinate assurance activities across multiple teams and suppliers.

Responsibilities

Develop and maintain the Software Assurance Evaluation Report (SAER), including its initial template and annual updates.
Develop and update the Software and Firmware Assurance Plan to meet PPP, NIST 8397, and U.S. Government guidance.
Collaborate with DevOps and System Security Engineering to configure and maintain SAST, dynamic analysis, container scanning, vulnerability scanning, and related assurance tools.
Scan supplier software and firmware where compilable, analyze results, and work with suppliers to remediate vulnerabilities.
Review automated tool findings weekly and provide mitigation recommendations to Northrop Grumman teams and the customer.
Support setup and deployment of code-signing tools and related secure build and deployment mechanisms.
Sustain software and firmware assurance activities through baseline, incremental, and option-year phases (2027–2031), including periodic supplier scans and reporting.