SBOM & Supply-Chain Security Analyst

Gormat; Maryland; On-site; USD 110,000 - 150,000; Full time

Job summary

Gormat is seeking a Software Analyst to perform in-depth SBOM analysis and software supply chain assessments for government-grade environments. You will evaluate dependencies, provenance, and third-party practices to identify risk vectors and enhance transparency.

The role requires strong technical analysis, cybersecurity knowledge, and the ability to assess software ecosystems from security and supply chain perspectives. Familiarity with SBOM standards and federal guidance is preferred.

Qualifications

• Experience in software supply chain security, cybersecurity analysis, application security, or SCRM.
• Knowledge of SBOMs, OSS ecosystems, and software composition analysis (SCA).
• Familiarity with Common Criteria, NIAP concepts, NIST guidance, and federal software security initiatives.
• Experience with package managers such as npm, PyPI, Maven, NuGet, and GitHub repos.
• Ability to analyze complex dependency structures and communicate findings clearly.

Responsibilities

• Conduct SBOM analysis on commercial software undergoing evaluation or review.
• Identify supply chain risks from dependencies and third-party libraries.
• Validate SBOM formats like SPDX, CycloneDX, and SWID tags.
• Assess software provenance, code lineage, and component authenticity.
• Identify known vulnerabilities through CVE, KEV, and threat intel databases.
• Evaluate OSS and foreign-developed components for risk and end-of-life status.
• Perform risk analyses aligned with NIST SSDF and EO 14028.
• Research software vendors and assess secure development practices.

Skills

SBOM analysis

OSS risk analysis

Cybersecurity analysis

Software supply chain

Dependency management

Vulnerability assessment

Education

Bachelor's degree in System Engineering

Tools

Dependency-Track

Syft

Grype

Black Duck

Snyk

Nexus

Mend.io

Anchore

Job description

Gormat is seeking a Software Analyst to perform in-depth SBOM analysis and software supply chain assessments for government-grade environments. You will evaluate dependencies, provenance, and third-party practices to identify risk vectors and enhance transparency.

The role requires strong technical analysis, cybersecurity knowledge, and the ability to assess software ecosystems from security and supply chain perspectives. Familiarity with SBOM standards and federal guidance is preferred.