Sbom Engineer Jobs

2 jobs found

2d ago

System Security Engineer Cyber-Supply Chain Risk Management

PeopleTec, Inc. Huntsville, AL

Huntsville, AL

2d ago

Full time Application Security Cybersecurity Tools Dynamic Application Security Testing

Apply Now

Job Description

PeopleTec, Inc. is seeking a System Security Engineer for Cyber-Supply Chain Risk Management (C-SCRM) to support the Huntsville, AL location onsite. In this role, you will help strengthen the software supply chain by analyzing third-party code, dependencies, and build processes, then translating results into findings and improvement plans for senior leadership through the program PMO.

Why this role

Support a program mission by securing software across the full system lifecycle: design, development, acquisition, integration, testing, fielding, and sustainment.
Own and maintain core supply chain artifacts including SBOM governance, vulnerability reporting, and supplier secure software attestation forms.
Collaborate across a multidisciplinary set of teams and coordinate objectives with internal and external organizations.
Deliver clear, actionable reporting by preparing C-SCRM findings, reports, and improvement plans for senior management and stakeholders.

Responsibilities

Provide technical support and security engineering for C-SCRM across the system lifecycle (design, development, acquisition, integration, testing, fielding, and sustainment).
Mandate and manage Software Bills of Materials (SBOMs) for all procured and open-source software.
Perform deep-dive vulnerability analysis and code provenance checks on third-party libraries.
Establish Software Composition Analysis (SCA) and Static Analysis (SAST) requirements within vendor onboarding.
Develop and maintain the Consolidated Program SBOM, Third-Party Software Vulnerability Reports, and Supplier Secure Software Attestation Forms.
Ensure compliance with defense and industry standards by effectively managing C-SCRM processes.
Interface with internal teams and external organizations to coordinate C-SCRM objectives and strategies.
Prepare and present C-SCRM findings, reports, and improvement plans to senior management and stakeholders.
Conduct strategic planning and coordination aligned to program objectives.
Provide technical expertise to peer engineers within Technology Security, Program Protection, Cyber Security, and Technical Management teams.
Use digital tools and methodologies to analyze supply chain risks, manufacturer/supplier relationships, and foreign ownership and controlling influence.
Complete other tasks as assigned by the Chief Engineer and/or Technical Chief.

Requirements

5+ years of relevant experience. Additional education may be substituted for years of experience.
Demonstrated experience in C-SCRM, particularly in defense or aerospace contexts.
Knowledge of SPDX/CycloneDX, SCA, SAST/DAST, VEX, and FIPS 140-3 validation.
Must meet minimum DoDI 8140.03 Defense Cyber Workforce qualification requirements in one of the following work roles:
- 622 (Secure Software Assessor) at the Intermediate level, or
- 652 (Security Architect) at the Intermediate level.
Strong knowledge of industry standards and defense requirements.
Excellent communication and presentation skills.
Ability to lead and work within a multidisciplinary team.
Previous experience working in a U.S. Government Program Office (required).
Travel: 25%.
U.S. Citizenship required.
DoD Secret clearance is required. Candidates must have an active Secret clearance upon hire and the ability to maintain it.

Technologies

SPDX, CycloneDX
Software Composition Analysis (SCA)
SAST/DAST
VEX
FIPS 140-3

Preferred

Top Secret clearance preferred.
DoDI 8140.03 qualification at the Advanced level for work role 622 (Secure Software Assessor) or 652 (Security Architect).

Program support & coordination

You will provide technical support to the program’s Chief Engineer and Technical Chief, securing the software supply chain by evaluating third-party code, dependencies, and build processes for vulnerabilities and malicious logic before integration across the lifecycle. The role also involves coordination and synchronization of C-SCRM technical and programmatic objectives with internal PMs across PAE Fires and external organizations including HQDA, ASA(ALT), JIATF 401, ATEC, AMCOM, and others.

View full job page →

1mo ago

Application Security Engineer, AI & Automation

Skill Remote 🌍 Remote

Remote

1mo ago Closed

$90 - $92/hr Contract Ai Governance Ai Security Application Security

This position is no longer accepting applications (closed Aug 22, 2026).

Job Description

Benefits and why you’ll thrive in this role

Skill offers a remote, contract opportunity for a senior Application Security Engineer focused on AI powered automation. This role provides the flexibility of a remote arrangement, a competitive hourly range of USD 90 to 92, and the chance to shape security tooling that leverages frontier large language models for vulnerability identification, code reasoning, triage acceleration, and automated remediation. You will collaborate with distributed teams to impact how security is integrated into developer workflows, with emphasis on unified triage, software supply chain defense, and governance for new AI capabilities across the enterprise.

Responsibilities

AI and Automation Engineering: Test, implement, and optimize application security tooling that uses frontier LLMs to identify vulnerabilities, reason about code, speed triage, and drive automated remediation.
Modern Triage and Incident Response: Deliver unified triage coverage for SCA, SAST, and DAST findings. Lead rapid assessment and routing of threat intelligence escalations and critical patch events (PatchNow).
Software Supply Chain Defense: Strengthen open-source dependency selection, package intake, and SBOM visibility. Build guardrails to detect malicious packages and enforce security policies across developer pipelines.
Secure Developer Workflows: Assess and secure developer environments, including IDEs, plugins/extensions, package managers, and AI coding assistants against malicious code and unsafe configurations.
AI Governance Support: Assist with technical proofs of value, data handling reviews, and model output evaluations required to safely onboard new AI capabilities across the enterprise.

Requirements

Experience: 3+ years of hands-on Application Security, with deep familiarity across the vulnerability lifecycle (SCA, SAST, DAST, and manual verification).
Automation Mindset: Strong engineering fundamentals with scripting languages (Python, Go), APIs, CI/CD pipelines (GitHub Actions, GitLab CI), and developer tool integrations.
AI Curiosity: Practical familiarity or hands-on experimentation with frontier models, AI coding assistants (e.g., Copilot), prompt engineering, or AI orchestration frameworks.
Supply Chain Knowledge: Experience securing software supply chains, package managers, and third-party dependencies against modern attack vectors.
Communication: Ability to translate complex vulnerabilities into clear, actionable remediation guidance for software engineering teams.

Technologies

Python
Go
GitHub Actions
GitLab CI
Copilot

Bonus Points

Contributions to open-source security tools or AI/LLM security projects (for example, OWASP Top 10 for LLMs).
Experience building custom integrations or LLM agents to automate security analyst workflows.

View full job page →

Get Sbom Engineer Jobs alerts

New Sbom Engineer Jobs, daily.