System Engineer II - SBOM with Security Clearance

Black Eagle Defense; Fort Meade (MD); On-site; USD 128,000 - 185,000; Full time

Job summary

Black Eagle Defense in Fort Meade, MD, seeks a Systems Engineer II (Software Analyst) to support NIAP software assurance, SBOM analysis, and open‑source risk assessment for NSS and sensitive U.S. Government environments.

You will evaluate software components, dependencies, and vendor cybersecurity practices, perform vulnerability analysis, and prepare technical reports and briefings for senior stakeholders.

Qualifications

• SBOMs, OSS ecosystems, SCA, vulnerability management, and secure software development practices.
• Familiarity with SBOM formats (SPDX, CycloneDX, SWID tags) and vulnerability databases.
• Ability to analyze software provenance, code lineage, and third-party risks.
• Experience evaluating vendor security maturity and secure SDLC practices.

Responsibilities

• Conduct SBOM analysis on commercial software products, platforms, and applications; validate SBOM formats.
• Assess software provenance, dependencies, and component authenticity; identify CVEs.
• Evaluate OSS risk, end-of-life dependencies, and vendor ecosystems; due diligence research.
• Review deployment architectures for security, and support CI/CD and patch management.

Skills

SBOM analysis & standards

Vulnerability & provenance assessment

Supply chain & OSS risk evaluation

Secure development & architecture 2

Compliance, reporting & threatmonitor

Education

Bachelor's degree in System Engineering, Computer Science, Information Systems, Engineering Science, Engineering Management, or related field

Tools

Dependency-Track

Syft

Grype

Black Duck

Snyk

Nexus

Mend.io

Anchore

Job description

Job Description SALARY RANGE $128,000 - $185,000/year. DUTIES As a successful candidate for the Systems Engineer II (Software Analyst) role, you will support the mission of the National Information Assurance Partnership (NIAP) by conducting in‑depth software assurance and Software Bill of Materials (SBOM) analysis for commercial technologies seeking evaluation, authorization, or deployment within National Security Systems (NSS) and sensitive U.S. Government environments. In this capacity, you will focus heavily on software supply chain transparency, software provenance, open‑source software (OSS) risk analysis, vulnerability identification, and vendor cybersecurity practices. You will evaluate software components, dependencies, development practices, and third‑party supplier risks to mitigate potential threats to system confidentiality, integrity, and availability, leveraging strong technical analysis and cybersecurity knowledge to assess software ecosystems across the full lifecycle.

Required Skills

* SBOM Analysis & Standards: Conduct Software Bill of Materials (SBOM) analysis on commercial software products, platforms, and applications; analyze dependencies, transitive dependencies, and third‑party libraries; validate SBOM formats and standards including SPDX, CycloneDX, and SWID tags.

• Vulnerability & Provenance Assessment: Assess software provenance, code lineage, package integrity, and component authenticity; identify known vulnerabilities and weaknesses through CVE analysis, KEV review, vulnerability databases, and threat intelligence sources.
• Supply Chain & Open‑Source Risk Evaluation: Evaluate security risks associated with open‑source software (OSS), foreign‑developed components, end‑of‑life dependencies, unmaintained libraries, and software obfuscation; conduct due diligence research on vendors, developers, maintainers, and ecosystems.
• Secure Development & Architecture Review: Analyze vendor development practices (secure coding, build pipeline security, CI/CD protections, dependency/patch management, code signing); review deployment architectures for attack vectors and support Common Criteria evaluations.
• Compliance, Reporting & Threat Monitoring: Perform supply chain assessments aligned with NIST SSDF, Executive Order 14028, federal software assurance guidance, and NIAP protection profiles; produce technical reports and briefings; monitor emerging supply chain threats, malware campaigns, and malicious package activity.

Qualifications

Fourteen (14) years of experience as a System Engineer supporting systems engineering, analytical engineering, or technical analysis activities on programs and contracts of similar scope, type, and complexity within complex enterprise or mission systems environments. Requires a Bachelor's degree in System Engineering, Computer Science, Information Systems, Engineering Science, Engineering Management, or a related discipline from an accredited college or university; five (5) years of additional systems engineering experience may be substituted for the bachelor's degree. Demonstrated experience in:

• * Software supply chain security, cybersecurity analysis, application security, or Supply Chain Risk Management (SCRM).
• Strong understanding of Software Bills of Materials (SBOMs), open‑source software (OSS) ecosystems, Software Composition Analysis (SCA), vulnerability management, and secure software development practices.
• Familiarity with Common Criteria, NIAP evaluation concepts, NIST cybersecurity guidance, and federal software security initiatives.
• Working knowledge of software package managers and code repositories, including npm, PyPI, Maven, NuGet, and GitHub.
• Analyzing complex software dependency structures to identify risk indicators and supply chain vulnerabilities.
• Authoring technical analytical reports and communicating complex security findings to both technical and non‑technical audiences.
• Information Assurance (IA) and cybersecurity architectures, concepts, and standards, alongside relevant DoD, IC, and federal (e.g., NIST) policies, directives, and strategic planning instructions.

Desired Skills

* Certifications: Preferred industry certifications such as CISSP, CSSLP, Security+, GIAC, Certified SCRM Professional, or specialized cloud/application security certifications.

• SBOM & Analysis Tooling: Hands‑on experience with SBOM and software composition analysis tools including Dependency‑Track, Syft, Grype, Black Duck, Snyk, Sonatype Nexus, Mend.io, and Anchore.
• Application Security Testing: Familiarity with Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), malware analysis, reverse engineering, and code signing validation.
• Supply Chain Threat Vectors: In‑depth understanding of supply chain attacks, dependency confusion, typosquatting, build system compromise, and malicious open‑source package activity.
• Vendor Security & Architecture: Experience evaluating software vendor security maturity and secure development lifecycle (SDLC) practices, along with knowledge of cloud‑native software architectures and container security.