Director - Product Cybersecurity Supply Chain Risk Management

RTX is hiring a Director of Product Cybersecurity Supply Chain Risk Management to lead cyber supply chain risk strategy and execution across the product lifecycle. The role integrates supplier risk oversight, secure-by-design practices, vulnerability and counterfeit risk management, and assurance into engineering and supply chain workflows for DoD and commercial aerospace programs.

Responsibilities:

• Lead the Cyber Supply Chain Risk Management (C‑SCRM) strategy and execution for products, with clear focus on supplier, component, and lifecycle assurance for DoD and commercial aerospace programs
• Partner with RTX leadership (Engineering, Supply Chain, Enterprise Services, Quality) to define C‑SCRM strategy, coordinate key initiatives, and identify cyber supply chain risks to RTX products and services
• Support DoD and commercial aerospace pursuits by defining secure supplier product development and assurance practices and integrating them into RFPs, proposals, and contract language (e.g., SBOM/HBOM, provenance, assurance artifacts)
• Drive Supplier Product Cybersecurity Risk Assessments and Assurance activities, including evaluation of development practices, provenance, counterfeit controls, and alignment to relevant standards
• Define and drive cyber supply chain requirements for supplier‑provided components, firmware, software , and services, ensuring traceability from mission/safety‑critical functions down to sub‑tier suppliers
• Integrate C‑SCRM controls into the product lifecycle and acquisition lifecycle, including architecture trades, supplier selection, verification planning, and sustainment/maintenance channels
• Deliver clear, actionable reporting on cyber supply chain risk posture, vulnerabilities, counterfeit exposure, and trends to executive and senior leaders
• Advise leadership on emerging C‑SCRM threats (e.g., firmware implants, silicon backdoors, compromised build pipelines, gray‑market infiltration), regulatory developments, and strategic investment needs
• Represent RTX in cross‑industry and government forums related to C‑SCRM, aerospace assurance, and supply chain security, as appropriate
• Establish, track, and continuously refine Product Cybersecurity C‑SCRM KPIs and metrics

Requirements:

• Typically requires a University Degree or equivalent experience and a minimum 14 years of experience, or an Advanced Degree and a minimum 12 years experience
• Minimum of 12 years experience in product, cybersecurity, or supply chain fields
• Experience guiding programs through secure engineering and assurance processes, including generation and review of key artifacts such as:
  • Mission critical function trees.
  • Supplier to function mapping matrices.
  • SBOMs, HBOMs, provenance maps, and trusted component registries.
  • Threat models and compromise scenario libraries tied to mission/safety impacts
• Experience communicating and negotiating with external bodies (government customers, regulators, standards organizations, prime/sub tier suppliers) on C SCRM, assurance, and quality expectations
• The ability to obtain and maintain a U.S. government issued security clearance is required
• U.S. citizenship is required, as only U.S. citizens are eligible for a security clearance
• U.S. citizenship is required, as only U.S. citizens are authorized to access certain necessary systems
• Active and existing security clearance required after day 1
• Demonstrated ability to influence senior leadership and drive alignment across engineering, supply chain, quality, and program teams with differing priorities