Cyber Supply Chain Risk Management; C-SCRM) Analyst

Position: Cyber Supply Chain Risk Management (C-SCRM) Analyst

Location: District of Columbia, Maryland, and Virginia - Hybrid, DC

Job : 688

# of Openings: 1

Fortress is building a pipeline of qualified candidates for an upcoming Cyber Supply Chain Risk Management (C-SCRM) Analyst opening. While this role is not immediately open, we expect to fill it soon and want to connect with strong candidates now so we can move quickly when it does. Thank you for your understanding!

Location: Hybrid, DC area

Compensation: $89,000 - $100,000

Employment Type: Full-Time

Travel Requirements: Up to 15%

Clearance Requirement: Active Secret Clearance at time of hire

The Cyber Supply Chain Risk Management (C-SCRM) Analyst supports Fortress's Government Delivery team by identifying, analyzing, and communicating cyber supply chain risks for U.S. Navy programs. This role serves as the analytical engine behind risk discovery - reviewing submitted data, evaluating supply chain risk indicators, interpreting platform findings, and translating raw information into meaningful program and mission impact. Working closely with Management Analysts, Technical Project Managers, Delivery leaders, and technical subject matter experts, the analyst supports risk analysis, reporting, and customer delivery  role offers the opportunity to develop deep expertise in the Fortress C-SCRM Platform, Fortress deliverables, and relevant Navy systems and data, making it an ideal position for someone looking to grow as a trusted subject matter expert in federal cyber supply chain risk.

This is a high-impact role directly tied to customer retention, program quality, and Fortress's continued growth across Navy accounts.

• Analyze cyber supply chain risk data to identify supplier, product, software, hardware, ownership, control, influence, dependency, and vulnerability risks that may impact U.S. Navy programs.
• Review submitted data, including hardware and software bills of materials, for completeness, accuracy, consistency, and indicators of high supply chain risk.
• Evaluate findings within the Fortress C-SCRM Platform and identify risk patterns, anomalies, or areas requiring additional review or escalation.
• Translate raw threat and supply chain data, including indicators such as Foreign Ownership, Control, or Influence (FOCI), compromised software libraries, supplier exposure, product vulnerabilities, or bill of materials concerns, into clear risk narratives and potential mission impacts.
• Develop subject matter expertise in the Fortress C-SCRM Platform, Fortress products, Navy systems, customer data, and program deliverables to support accurate analysis and consistent delivery outcomes.
• Identify, document, and communicate high-risk supply chain findings so internal stakeholders and customer-facing team members understand the risk, impact, and recommended next steps.
• Partner with Management Analysts, Technical Project Managers, and technical subject matter experts to support program-level reporting, risk briefings, deliverable development, and customer milestones.
• Serve as a subject matter expert during customer discussions when needed, including answering questions about risk findings, data interpretation, platform outputs, or deliverable content.
• Document risk findings, assumptions, data limitations, and recommended areas for further review in a clear, defensible, and repeatable manner.
• Support the development and refinement of analytical processes, templates, quality checks, and reporting inputs that improve consistency, efficiency, and confidence in C-SCRM deliverables.
• Use Excel to review, organize, analyze, validate, and summarize supply chain, supplier, platform, bill of materials, or risk data.
• Use PowerPoint to support clear communication of risk findings, trends, impacts, and recommendations in customer-ready or internal briefing materials.
• Apply intermediate AI proficiency to improve research, analysis, summarization, pattern recognition, and workflow efficiency while following Fortress, customer, and security requirements for responsible AI use.
• Maintain awareness of cyber supply chain risk concepts, threat intelligence, supplier risk indicators, software risk, hardware risk, and federal cybersecurity requirements relevant to government and defense customers.
• Protect sensitive customer, supplier, product, and program information in accordance with applicable security, contractual, clearance, and customer requirements.
• Travel up to 15% for potential customer site visits, in-person meetings, or program-related engagements.

• 2–4 years of experience in cyber supply chain risk management, cybersecurity analysis, threat intelligence, supplier risk, risk analysis, federal consulting, government delivery, or a related field.
• Active Secret clearance required at time of hire.
• Experience analyzing…