System Engineer II - SBOM & Security Assurance (Clearance)

Black Eagle Defense; Fort Meade (MD); On-site; USD 128,000 - 185,000; Full time

Job summary

Black Eagle Defense in Fort Meade, MD, seeks a Systems Engineer II (Software Analyst) to support NIAP software assurance, SBOM analysis, and open‑source risk assessment for NSS and sensitive U.S. Government environments.

You will evaluate software components, dependencies, and vendor cybersecurity practices, perform vulnerability analysis, and prepare technical reports and briefings for senior stakeholders.

Qualifications

• SBOMs, OSS ecosystems, SCA, vulnerability management, and secure software development practices.
• Familiarity with SBOM formats (SPDX, CycloneDX, SWID tags) and vulnerability databases.
• Ability to analyze software provenance, code lineage, and third-party risks.
• Experience evaluating vendor security maturity and secure SDLC practices.

Responsibilities

• Conduct SBOM analysis on commercial software products, platforms, and applications; validate SBOM formats.
• Assess software provenance, dependencies, and component authenticity; identify CVEs.
• Evaluate OSS risk, end-of-life dependencies, and vendor ecosystems; due diligence research.
• Review deployment architectures for security, and support CI/CD and patch management.

Skills

SBOM analysis & standards

Vulnerability & provenance assessment

Supply chain & OSS risk evaluation

Secure development & architecture 2

Compliance, reporting & threatmonitor

Education

Bachelor's degree in System Engineering, Computer Science, Information Systems, Engineering Science, Engineering Management, or related field

Tools

Dependency-Track

Syft

Grype

Black Duck

Snyk

Nexus

Mend.io

Anchore

Job description

Black Eagle Defense in Fort Meade, MD, seeks a Systems Engineer II (Software Analyst) to support NIAP software assurance, SBOM analysis, and open‑source risk assessment for NSS and sensitive U.S. Government environments.

You will evaluate software components, dependencies, and vendor cybersecurity practices, perform vulnerability analysis, and prepare technical reports and briefings for senior stakeholders.