System Security Engineer Cyber-Supply Chain Risk Management

PeopleTec•Huntsville, AL

2d•Onsite

About The Position

PeopleTec is seeking a System Security Engineer Cyber-Supply Chain Risk Management (C-SCRM) to support its Huntsville, Alabama location. The role provides technical support to program Lead Engineers, the Cybersecurity Lead, and the Technical Chief within a Project Management Office in PAE Fires. The engineer secures the software supply chain by assessing third-party code, dependencies, and build processes for vulnerabilities and malicious logic before system integration, across design, development, acquisition, integration, testing, fielding, and sustainment. The engineer develops and maintains software bill of materials (SBOM) requirements and program documentation, performs vulnerability and code-provenance analyses, and establishes software analysis requirements for vendor onboarding. The role also involves coordinating with internal program managers and external organizations, including HQDA, ASA(ALT), JIATF 401, ATEC, and AMCOM; presenting C-SCRM findings and improvement plans; and providing technical expertise to peer engineers and related security and engineering teams. Other tasks may be assigned by program leadership.

Requirements

At least 5 years of relevant experience; additional education may be substituted for years of experience.
Demonstrated C-SCRM experience, particularly in the defense or aerospace industries.
Knowledge of SPDX/CycloneDX, Software Composition Analysis (SCA), SAST/DAST, VEX, and FIPS 140-3 validation.
Meet DoDM 8140.03 Defense Cyber Workforce qualification requirements at the Intermediate level in work role 622 (Secure Software Assessor) or 652 (Security Architect).
Strong knowledge of industry standards and defense requirements.
Excellent communication and presentation skills.
Ability to lead and work within a multidisciplinary team.
Previous experience working in a U.S. Government Program Office.
U.S. citizenship.
Active DoD Secret clearance upon hire and ability to maintain that clearance during employment.
Bachelor's degree in Computer Science, Engineering, or a related technical discipline.
Willingness to travel 25%.

Nice To Haves

Top Secret clearance preferred.
DoDI 8140.03 qualification at the Advanced level for work role 622 (Secure Software Assessor) or 652 (Security Architect).

Responsibilities

Provide technical support and security engineering for C-SCRM across the system lifecycle, from design and development through acquisition, integration, testing, fielding, and sustainment.
Develop recommended SBOM requirements for procured and open-source software.
Author and maintain the recommended Consolidated Program SBOM, Third-Party Software Vulnerability Reports, and Supplier Secure Software Attestation Forms for Government review and approval.
Perform in-depth vulnerability analysis and code-provenance checks on third-party libraries.
Establish Software Composition Analysis (SCA) and Static Analysis (SAST) requirements for vendor onboarding.
Manage C-SCRM processes to support compliance with defense and industry standards.
Coordinate C-SCRM technical and programmatic objectives with internal teams and external organizations, including HQDA, ASA(ALT), JIATF 401, ATEC, and AMCOM.
Prepare and present C-SCRM findings, reports, and improvement plans to senior management and stakeholders.
Conduct strategic planning and coordination to support program objectives.
Provide technical expertise to peer engineers in Technology Security, Program Protection, Cyber Security, and Technical Management teams.
Use digital tools and methodologies to analyze supply chain risks, manufacturer and supplier relationships, and foreign ownership and controlling influence.
Perform other tasks as assigned by the program Lead Engineers, Cybersecurity Lead, and/or Technical Chief.