> Markdown version of [/jobs/ext/3543868-system-engineer-ii-sbom](https://www.wearedevelopers.com/jobs/ext/3543868-system-engineer-ii-sbom). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# System Engineer II - SBOM

- **Company:** Black Eagle Defense
- **Location:** Fort Meade, MD, United States
- **Salary:** $128,000.0 - $185,000.0
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, Systems Engineering, Cloud Engineering, CompTIA Security+, Information Systems, Github, Apache Maven, NuGet, Open Source Technology, Package Management Systems, Commercial Software, Software Architecture, Reverse Engineering, Secure Coding, Software Engineering, Software Vulnerability Management, Software Repository, Software Security, Malware, Cyber Threat Analysis, Sonatype Nexus, Information Technology, Free and Open-Source Software, Npm(Software), Static Application Security Testing, Dynamic Application Security Testing
- **Published:** October 2, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9209022/system-engineer-ii-sbom

## About the Role

* SBOM Analysis & Standards: Conduct Software Bill of Materials (SBOM) analysis on commercial software products, platforms, and applications; analyze dependencies, transitive dependencies, and third-party libraries; validate SBOM formats and standards including SPDX, CycloneDX, and SWID tags., QUALIFICATIONS Fourteen (14) years of experience as a System Engineer supporting systems engineering, analytical engineering, or technical analysis activities on programs and contracts of similar scope, type, and complexity within complex enterprise or mission systems environments. Requires a Bachelor's degree in System Engineering, Computer Science, Information Systems, Engineering Science, Engineering Management, or a related discipline from an accredited college or university; five (5) years of additional systems engineering experience may be substituted for the bachelor's degree.

Demonstrated experience in:

 * Software supply chain security, cybersecurity analysis, application security, or Supply Chain Risk Management (SCRM).
 * Strong understanding of Software Bills of Materials (SBOMs), open-source software (OSS) ecosystems, Software Composition Analysis (SCA), vulnerability management, and secure software development practices.
 * Familiarity with Common Criteria, NIAP evaluation concepts, NIST cybersecurity guidance, and federal software security initiatives.
 * Working knowledge of software package managers and code repositories, including npm, PyPI, Maven, NuGet, and GitHub.
 * Analyzing complex software dependency structures to identify risk indicators and supply chain vulnerabilities.
 * Authoring technical analytical reports and communicating complex security findings to both technical and non-technical audiences.
 * Information Assurance (IA) and cybersecurity architectures, concepts, and standards, alongside relevant DoD, IC, and federal (e.g., NIST) policies, directives, and strategic planning instructions.

Desired Skills

 * Certifications: Preferred industry certifications such as CISSP, CSSLP, Security+, GIAC, Certified SCRM Professional, or specialized cloud/application security certifications.
 * SBOM & Analysis Tooling: Hands-on experience with SBOM and software composition analysis tools including Dependency-Track, Syft, Grype, Black Duck, Snyk, Sonatype Nexus, Mend.io, and Anchore.
 * Application Security Testing: Familiarity with Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), malware analysis, reverse engineering, and code signing validation.
 * Supply Chain Threat Vectors: In-depth understanding of supply chain attacks, dependency confusion, typosquatting, build system compromise, and malicious open-source package activity.
 * Vendor Security & Architecture: Experience evaluating software vendor security maturity and secure development lifecycle (SDLC) practices, along with knowledge of cloud-native software architectures and container security.