Software Supply Chain Security Specialist

Software Supply Chain SMEThe Software Supply Chain SME serves as the technical authority responsible for securing the end-to-end software supply chain, ensuring the integrity, provenance, and risk posture of all code, dependencies, and artifacts across the SDLC. This role defines and enforces security standards, integrates controls within CI/CD pipelines, and leads enterprise initiatives such as SBOM adoption, artifact signing, and open-source risk management. The SME partners with AppSec, DevSecOps, and engineering teams to embed secure development practices, drive vulnerability remediation, and enhance developer enablement—while providing governance, metrics, and strategic guidance to reduce supply chain risk at scale.Core ResponsibilitiesDefine and own enterprise software supply chain security strategy, roadmap, and governanceEstablish policies and guardrails for SBOM, artifact signing, provenance, and dependency usageEmbed security controls across SDLC, CI/CD pipelines, and artifact repositoriesImplement and enforce SBOM generation, validation, and artifact integrity controlsCollaborate with stakeholders and lead risk-based vulnerability management for open-source and third-party componentsCollaborate with stakeholders and define remediation workflows, SLAs, and exception handling for supply chain risksOwn tooling strategy for SCA, container scanning, and supply chain security automationIntegrate and optimize security tooling within CI/CD for scalable enforcementMaintain inventory and visibility of dependencies, SBOMs, and third-/fourth-party exposurePartner with AppSec, DevSecOps, and platform teams to drive secure development adoptionEnable developers via playbooks, guardrails, and self-service secure consumption patternsDefine metrics and report on supply chain risk posture, remediation effectiveness, and maturityNice-to-HaveExperience with AI/ML pipeline securityExposure to AIBOM / advanced SBOM evolutionKnowledge of zero-trust supply chain modelsQualificationsMinimum of five years related work experience.Undergraduate degree or equivalent combination of training and experience. Graduate degree preferred.7–10+ years in AppSec / DevSecOps / platform securityHands-on experience with SCA + pipeline securityCertifications preferred (CISSP, CSSLP, AAISM or equivalent etc.)Programming/scripting (Python, Java, YAML)Special FactorsSponsorshipVanguard is not offering visa sponsorship for this position.About VanguardAt Vanguard, we don't just have a mission—we're on a mission.To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.How We WorkVanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.