Sr. Analyst - SCRM
Listed on 2026-06-17
-
IT/Tech
Cybersecurity, Information Security
The Sr. Analyst - Supply Chain Risk Management (SCRM) Analyst supports enterprise and program stakeholders in ensuring Maximus, Maximus Federal, and third-party relationships meet U.S. federal and DoD contractual and regulatory obligations. This role helps translate requirements into actionable SCRM governance, due diligence, and monitoring activities aligned to applicable FAR/DFARS clauses (including Section 889 considerations), customer security requirements (e.g., NIST-based controls and RMF/ATO expectations where applicable), and other federal directives affecting supplier and technology risk.
The position partners with procurement, legal, security, IT, and business teams to conduct supplier risk assessments, maintain risk registers and supporting evidence, track remediation and exceptions, and produce compliance‑ready reporting that enables informed leadership decisions and supports audits, assessments, and ongoing federal/DoD growth.
Perform complex risk analyses and risk assessment.
Establish and satisfy Information Assurance (IA) and security requirements based upon the analysis of user, policy, regulatory, and resource demands.
Support customers in the development and implementation of doctrine and policies.
Advise information system owners on client/project security policies and requirements for systems.
Keep abreast of emerging security technologies and make appropriate recommendations regarding the enhancement of the security posture of systems and their implementation.
'- Interpret and operationalize federal and DoD supply chain requirements by mapping applicable FAR/DFARS clauses (including Section 889 considerations) and customer SCRM expectations into enterprise policies, procedures, and control guidance for shared services and third-party providers.
Conduct and document supplier/third-party SCRM due diligence (pre‑award and periodic) for federal and DoD pursuits and programs, including risk questionnaires, evidence reviews, and validation of flow‑downs to subcontractors and cloud/service providers.
Assess, track, and report SCRM control effectiveness using NIST guidance (e.g., NIST SP 800‑161 concepts and NIST SP 800‑53 control families as applicable), maintaining risk registers, corrective action plans, POA&Ms, and supporting evidence to enable audit‑ and assessment‑ready compliance.
Support contract lifecycle governance by advising procurement and program teams on SCRM‑related contract language, required representations, and evidence packages; manage exceptions/waivers and coordinate legal/security reviews to ensure consistent FAR/DFARS compliance decisions.
Perform ongoing SCRM monitoring for high‑risk suppliers (e.g., performance, financial, cybersecurity, and geopolitical indicators), coordinate issue escalation and remediation with internal stakeholders and vendors, and deliver recurring leadership reporting for federal/DoD readiness and program assurance.
'- Please refer to the additional information section of the job requisition for this opening to determine clearance eligibility required.
Bachelor's Degree in related field.
5-7 years of relevant professional experience required.
Equivalent combination of education and experience considered in lieu of degree.
Bachelor’s degree in supply chain, business, information systems, cybersecurity, risk management, or a related field (or equivalent combination of education, training, and experience).
7+ years of experience in supply chain risk management, third‑party/vendor risk management (TPRM), federal compliance, or related risk/governance functions within a regulated environment.
U.S Citizen with ability to obtain a US government security clearance.
Experience supporting federal and/or DoD contract compliance activities (e.g., proposal support, contract onboarding, evidence collection, internal/external audits, and customer assessments).
Strong knowledge of federal acquisition and cybersecurity supply chain requirements, including applicable FAR/DFARS clauses, subcontractor flow‑down concepts, and prohibited/covered telecommunications considerations (e.g.,…
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).