Sr. Cyber Supply Chain Risk Management SME (C-SCRM) (Intelligence Analyst 4) - 18827

Requisition Number: 18827 

Required Travel: 0 - 10% 

Employment Type: Full Time/Salaried/Exempt

Security Clearance: Ability to Obtain  

Level of Experience: Mid HI

 

This opportunity resides with Command, Control, Communications, Computers, Cyber, Intelligence, Surveillance and Reconnaissance (C5ISR), a business group within HII’s Mission Technologies division. From towers to processors, we design, develop, integrate and manage the sensors, systems and other assets necessary to support integrated intelligence, surveillance and reconnaissance (ISR) operations, exploitation and analysis for the Intelligence Community, the military services, geographic and functional combatant commands and DoD agencies. 

 

Meet HII’s Mission Technologies Division
Our team of more than 7,000 professionals worldwide delivers all-domain expertise and advanced technologies in service of mission partners across the globe. Mission Technologies is leading the next evolution of national defense – the data evolution - by accelerating a breadth of national security solutions for government and commercial customers. Our capabilities range from C5ISR, AI and Big Data, cyber operations and synthetic training environments to fleet sustainment, environmental remediation and the largest family of unmanned underwater vehicles in every class. Find the role that’s right for you. Apply today. We look forward to meeting you.

 

To learn more about Mission Technologies, click here for a short video: https://vimeo.com/732533072 

 

Who We Are

HII-Mission Technologies is seeking a Senior Cyber Supply Chain Risk Management (C-SCRM) Consultant for a hybrid of telework and work at the client’s site in Baltimore (Woodlawn) MD. This position requires experience in supply chain management and risk assessment/mitigation methods along with strong background in cybersecurity. The candidate selected for this position will support the Director, Division of Strategic Information (DSI), Center for Medicare and Medicaid Services (CMS) and other government personnel. Day to day activities include working with other contractors on the C-SCRM line of effort as they pertain to cyber supply chain risk management, especially those related to Information and Communications Technology (ICT) assets.

What You Will Do

• Advise CMS DSI personnel on cybersecurity supply chain risk management (C-SCRM) policy and standard operating procedures.
• Identify all CMS vendors/suppliers who have ICT products/services that connect to or traverse Centers for Medicare & Medicaid Services (CMS) networks. This includes analyzing active contracts lists and reviewing completed Information Security Certification forms.
• Review/evaluate products against known threats, known exploitable vulnerabilities (KEVs), and Common Vulnerabilities and Exposures (CVEs).
• Develop and maintain processes related to C-SCRM and ICT risk assessments.
• Analyze C-SCRM-related data and convey the threat level to senior leadership along with a recommendation on how to best mitigate risk.
• Evaluate and monitor software supplier adherence to Secure Software Development Framework (SSDF) attestations and other cybersecurity contractual requirements (especially for Executive Order defined critical software)
• Review and evaluate software supplier SBOMs for supply chain risks, and provide cyber-focused risk mitigation recommendations within Supply Chain Risk Assessments
• Review and evaluate existing and prospective suppliers Service Organization Control (SOC) 2 reports.
• Review, evaluate, and continuously monitor prospective and existing supplier cyber hygiene, illuminated through 3rd party due diligence tools or other government tools.
• Develop the supplier cyber evaluation portion of the supply chain risk assessment reports.
• Collaborate and liaison with CMS' cybersecurity staff to gather and include relevant information into reports.
• Identify resources used to conduct or enhance the SCRA assessment and collaborate with the government to obtain access.
• Contribute to development and evaluation of pre-acquisition vendor/supplier questionnaires.
• Assist with development and implementation of cyber-related supplier risk event/ incident responses.
• Identify resources used to conduct or enhance the SCRA assessment and collaborate with the government to obtain access.

What We Are Looking For

• 9 years relevant experience with Bachelors in related field; 7 years relevant experience with Masters in related field; 4 years relevant experience with PhD or Juris Doctorate in related field; or High School Diploma or equivalent and 13 years relevant experience
• Familiarity with cybersecurity practices to int