System Engineer II - SBOM Security Clearance

Job Description SALARY RANGE $128,000 - $185,000/year. DUTIES As a successful candidate for the Systems Engineer II (Software Analyst) role, you will support the mission of the National Information Assurance Partnership (NIAP) by conducting in‑depth software assurance and Software Bill of Materials (SBOM) analysis for commercial technologies seeking evaluation, authorization, or deployment within National Security Systems (NSS) and sensitive U.S. Government environments.

In this capacity, you will focus heavily on software supply chain transparency, software provenance, open‑source software (OSS) risk analysis, vulnerability identification, and vendor cybersecurity practices. You will evaluate software components, dependencies, development practices, and third‑party supplier risks to mitigate potential threats to system confidentiality, integrity, and availability, leveraging strong technical analysis and cybersecurity knowledge to assess software ecosystems across the full lifecycle.

* SBOM Analysis & Standards:
Conduct Software Bill of Materials (SBOM) analysis on commercial software products, platforms, and applications; analyze dependencies, transitive dependencies, and third‑party libraries; validate SBOM formats and standards including SPDX, CycloneDX, and SWID tags.

• Vulnerability & Provenance Assessment:
  Assess software provenance, code lineage, package integrity, and component authenticity; identify known vulnerabilities and weaknesses through CVE analysis, KEV review, vulnerability databases, and threat intelligence sources.
• Supply Chain & Open‑Source Risk Evaluation:
  Evaluate security risks associated with open‑source software (OSS), foreign‑developed components, end‑of‑life dependencies, unmaintained libraries, and software obfuscation; conduct due diligence research on vendors, developers, maintainers, and ecosystems.
• Secure Development & Architecture Review:
  Analyze vendor development practices (secure coding, build pipeline security, CI/CD protections, dependency/patch management, code signing); review deployment architectures for attack vectors and support Common Criteria evaluations.
• Compliance, Reporting & Threat Monitoring:
  Perform supply chain assessments aligned with NIST SSDF, Executive Order 14028, federal software assurance guidance, and NIAP protection profiles; produce technical reports and briefings; monitor emerging supply chain threats, malware campaigns, and malicious package activity.

Fourteen (14) years of experience as a System Engineer supporting systems engineering, analytical engineering, or technical analysis activities on programs and contracts of similar scope, type, and complexity within complex enterprise or mission systems environments. Requires a Bachelor's degree in System Engineering, Computer Science, Information Systems, Engineering Science, Engineering Management, or a related discipline from an accredited college or university; five (5) years of additional systems engineering experience may be substituted for the bachelor's degree.

Demonstrated experience in:

• * Software supply chain security, cybersecurity analysis, application security, or Supply Chain Risk Management (SCRM).
• Strong understanding of Software Bills of Materials (SBOMs), open‑source software (OSS) ecosystems, Software Composition Analysis (SCA), vulnerability management, and secure software development practices.
• Familiarity with Common Criteria, NIAP evaluation concepts, NIST cybersecurity guidance, and federal software security initiatives.
• Working knowledge of software package managers and code repositories, including npm, PyPI, Maven, NuGet, and Git Hub.
• Analyzing complex software dependency structures to identify risk indicators and supply chain…