Software Supply Chain Security Analyst (TS/SCI)

Gormat; Corridor North (MD); On-site; USD 110,000 - 165,000; Full time

Job summary

Gormat is seeking a Software Analyst to conduct SBOM analysis and assess software supply chain security for commercial technologies evaluated for National Security Systems and other sensitive U.S. government environments.

The role emphasizes software provenance, dependency analysis, OSS risk, and vulnerability identification, with rigorous evaluation of SBOM formats, vendor practices, and build pipelines. You will produce technical reports and briefings for technical and non-technical

Qualifications

• Experience in software supply chain security, cybersecurity analysis, or SCRM.
• Strong understanding of SBOMs, OSS ecosystems, and software composition analysis (SCA).
• Familiarity with Common Criteria, NIAP evaluation concepts, NIST guidance, and federal software initiatives.
• Knowledge of software package managers such as npm, PyPI, Maven, NuGet, GitHub.

Responsibilities

• Conduct SBOM analysis on commercial products undergoing evaluation or review.
• Analyze dependencies, transitive dependencies, and third-party libraries for supply chain risks.
• Review SBOM formats (SPDX, CycloneDX, SWID tags) for accuracy and completeness.
• Assess software provenance, code lineage, package integrity, and component authenticity.
• Identify vulnerabilities via CVE analysis, KEV review, and vulnerability databases.
• Evaluate risks from OSS, foreign-developed components, end-of-life dependencies, and unmaintained libraries.
• Perform secure software supply chain assessments aligned with NIST SSDF, EO 14028, and NIAP guidance.
• Conduct vendor due diligence and analyze secure development practices (build pipelines, CI/CD, patching, code signing).
• Review architectures for supply chain attack vectors and support CC evaluations through risk analysis.
• Produce technical reports, risk summaries, and executive briefings; collaborate with stakeholders to improve SBOM use.

Skills

Software analysis

Cybersecurity knowledge

Technical risk analysis

OSS risk analysis

Vulnerability identification

Education

Bachelor's degree in System Engineering, Computer Science, Information Systems, Engineering Science, Engineering Management, or related discipline

Tools

Dependency-Track

Syft

Grype

Black Duck

Snyk

Sonatype Nexus

Mend.io

Anchore

Job description

Gormat is seeking a Software Analyst to conduct SBOM analysis and assess software supply chain security for commercial technologies evaluated for National Security Systems and other sensitive U.S. government environments.

The role emphasizes software provenance, dependency analysis, OSS risk, and vulnerability identification, with rigorous evaluation of SBOM formats, vendor practices, and build pipelines. You will produce technical reports and briefings for technical and non-technical