Cyber Supply Chain Risk Management (C-SCRM) Analyst
- Compensation
- $89K–$100K
- Location
- District of Columbia, Maryland, and Virginia - Hybrid, DC
- Work setup
- Hybrid
- Seniority
- Not specified
- Employment
- Full time
- Experience
- 2+ years
- Category
- Logistics
- Posted
Skills
Must have
- 2–4 years of experience in cyber supply chain risk management, cybersecurity analysis, threat intelligence, supplier risk, risk analysis, federal consulting, government delivery, or a related field.
- Active Secret clearance required at time of hire.
- Experience analyzing technical, supplier, product, vendor, threat, bill of materials, or risk data and translating findings into clear business, operational, or mission impact.
- Understanding of cyber supply chain risk concepts, including supplier risk, software risk, hardware risk, third-party risk, ownership/control concerns, threat exposure, and vulnerability or compromise
- Ability to review data for accuracy, completeness, and risk significance while documenting findings clearly and objectively.
- Ability to learn specialized platforms, customer systems, product workflows, and data structures quickly and apply that knowledge to risk analysis and deliverable development.
- Proficiency with Microsoft Excel, including the ability to organize, filter, compare, review, and summarize data.
- Proficiency with Microsoft PowerPoint, including the ability to support clear, professional presentations and briefing materials.
- Strong written communication skills with the ability to summarize complex risk information for internal stakeholders, program teams, and occasional customer-facing discussions.
- Ability to serve as a subject matter expert on risk findings, platform outputs, and deliverable content when needed.
- Ability to work effectively in a hybrid environment in the Washington, DC area.
- Ability to collaborate with project managers, analysts, technical teams, and delivery leaders while operating with moderate independence.
- Intermediate proficiency using AI tools to support research, analysis, summarization, and productivity while applying sound judgment, validation, and responsible-use practices.
- Ability to travel up to 15% for customer on-site visits, in-person meetings, or program-related engagements.
- Ability to handle sensitive information and comply with applicable security, confidentiality, clearance, and customer requirements.
Nice to have
- Security+ certification or other related cybersecurity, risk management, supply chain risk, or information assurance certification.
- Experience supporting Department of Defense, Department of Navy, federal civilian, or defense industrial base customers.
- Experience with C-SCRM, SCRM, vendor risk management, third-party risk management, software supply chain risk, hardware supply chain risk, cyber threat intelligence, or product assurance.
- Familiarity with FOCI, SBOM, HBOM, supplier risk scoring, vulnerability data, compromised software libraries, or product assurance workflows.
- Experience reviewing bills of materials, supplier data, software component data, hardware component data, product data, or platform-generated risk findings.
- Experience using data analysis, case management, risk management, cybersecurity, or reporting platforms to evaluate and communicate risk.
- Familiarity with federal cybersecurity frameworks, standards, or guidance such as NIST, CMMC, FedRAMP, RMF, or DoD cybersecurity requirements.
- Experience producing written findings, risk summaries, briefing inputs, or analytical reports for government or regulated customers.
Full description
Cyber Supply Chain Risk Management (C-SCRM) AnalystLocation: Hybrid – Onsite at Pax River approximately 2 day per week (6x per month) with the ability to flex as needed
Compensation: $89,000 - $100,000
Employment Type: Full-Time
Travel Requirements: Up to 15%
Clearance Requirement: Active Secret Clearance at time of hire
What you can expect as the Cyber Supply Chain Risk Management (C-SCRM) Analyst at Fortress...
The Cyber Supply Chain Risk Management (C-SCRM) Analyst supports Fortress's Government Delivery team by identifying, analyzing, and communicating cyber supply chain risks for U.S. Navy programs. This role serves as the analytical engine behind risk discovery - reviewing submitted data, evaluating supply chain risk indicators, interpreting platform findings, and translating raw information into meaningful program and mission impact. Working closely with Management Analysts, Technical Project Managers, Delivery leaders, and technical subject matter experts, the analyst supports risk analysis, reporting, and customer delivery at scale. The role offers the opportunity to develop deep expertise in the Fortress C-SCRM Platform, Fortress deliverables, and relevant Navy systems and data, making it an ideal position for someone looking to grow as a trusted subject matter expert in federal cyber supply chain risk. This is a high-impact role directly tied to customer retention, program quality, and Fortress's continued growth across Navy accounts.
Responsibilities Include:
- Analyze cyber supply chain risk data to identify supplier, product, software, hardware, ownership, control, influence, dependency, and vulnerability risks that may impact U.S. Navy programs.
- Review submitted data, including hardware and software bills of materials, for completeness, accuracy, consistency, and indicators of high supply chain risk.
- Evaluate findings within the Fortress C-SCRM Platform and identify risk patterns, anomalies, or areas requiring additional review or escalation.
- Translate raw threat and supply chain data, including indicators such as Foreign Ownership, Control, or Influence (FOCI), compromised software libraries, supplier exposure, product vulnerabilities, or bill of materials concerns, into clear risk narratives and potential mission impacts.
- Develop subject matter expertise in the Fortress C-SCRM Platform, Fortress products, Navy systems, customer data, and program deliverables to support accurate analysis and consistent delivery outcomes.
- Identify, document, and communicate high-risk supply chain findings so internal stakeholders and customer-facing team members understand the risk, impact, and recommended next steps.