System Engineer SCRM

The SCRM Analyst supports the mission of the National Security Agency Cybersecurity Collaboration Center by identifying, assessing, and mitigating supply chain risks impacting National Security Systems (NSS), critical Defense Industrial Base (DIB) infrastructure, and U.S. Government technology environments. The analyst conducts research and analysis on commercial technologies, software, hardware, cloud providers, vendors, and foreign ownership/control/influence (FOCI) concerns to support informed risk-based decisions and national security objectives.

This position requires strong analytical capabilities, cybersecurity knowledge, intelligence research skills, and the ability to collaborate across government, industry, and interagency partners to strengthen supply chain security and operational resilience.

• Conduct supply chain risk assessments on software, hardware, cloud services, telecommunications technologies, and third-party vendors supporting U.S. Government and National Security Systems.
• Perform due diligence research using commercial and government intelligence sources, open-source intelligence (OSINT), threat intelligence platforms, and supply chain illumination tools.
• Identify potential foreign ownership, control, or influence (FOCI) concerns, cybersecurity risks, malicious cyber activity, counterfeit risks, insider threats, and vendor credibility concerns.
• Analyze software supply chain risks including:
  • Software Bills of Materials (SBOMs)
  • Open-source software (OSS)
  • Vulnerability management
  • Secure software development practices
  • Dependency and component risks
• Evaluate vendor compliance with federal cybersecurity and supply chain security policies, standards, and directives.
• Produce detailed analytical reports, risk assessments, executive summaries, and briefing materials for senior leadership and mission stakeholders.
• Support interagency collaboration efforts involving supply chain security initiatives, exclusion/removal order analysis, and federal risk mitigation activities.
• Conduct infrastructure and corporate attribution research including:
  • Corporate ownership structures
  • Leadership analysis
  • Network infrastructure
  • Domain/IP analysis
  • Foreign business relationships
  • Contract validation
• Monitor emerging threats to the technology supply chain and provide actionable recommendations to leadership and operational teams.
• Collaborate with intelligence, cybersecurity, acquisition, counterintelligence, legal, and policy stakeholders to support enterprise-wide SCRM initiatives.
• Assist in the development of supply chain risk methodologies, scoring models, assessment frameworks, and mitigation strategies.
• Support evaluation and operational use of supply chain illumination and cybersecurity assessment tools.

TS/SCI w/Polygraph to start.

(U) Fourteen (14) years experience as a SE in programs and contracts of similar scope, type and complexity is required. Bachelor’s degree in System Engineering, Computer Science, Information Systems, Engineering Science, Engineering Management, or related discipline from an accredited college or university is required. Five (5) years of additional SE experience may be substituted for a bachelor’s degree.

Preferred certifications may include:

• Security+
• CISSP
• Certified SCRM Professional
• AWS/Azure cloud certifications
• Certified Threat Intelligence Analyst (CTIA)
• Network or systems certifications

$190,000-$220,000. This represents the typical salary range for this position, but is not guaranteed. Salary is based on experience, location and contractual requirements which could fall outside of the range listed.