Cyber Security SBOM Manager

Job-ID29485552Reference26-29061Description:Business Initiative/Purpose: (Goal, Business Impact, Accomplishments from the work)Lead/Manage the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring. This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.This role combines technical leadership, application security expertise, and SDLC integration, ensuring SBOM practices are embedded across vendor onboarding, secure development, and continuous monitoring workflows.The manager will oversee the definition of secure software supply chain practices, risk attribution models, and governance processes while partnering across Application Security, Engineering, Vendor Risk, and Procurement teams.This is a fully on-site position based in Atlanta, GA. Teammates are expected to be in the office five days a week.Bachelor Degree: (Required, Preferred or Not Required)Bachelor’s degree in Computer Science, Cybersecurity, or related field.Role Responsibilities: (what they will be doing)Cyber Security Manager to lead the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring. This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.Other responsibilities include but not limited to:SBOM Program Leadership & StrategyLead end-to-end SBOM program implementation (collection, ingestion, analysis, remediation, continuous monitoring).Define SBOM governance, standards, and enforcement mechanisms across vendors and internal applications.Establish risk scoring methodologies for software components, libraries, and dependencies.Drive integration of SBOM processes into procurement, onboarding, and vendor lifecycle management.Application Security & SDLC IntegrationEmbed SBOM generation and validation into CI/CD pipelines and SDLC processes.Partner with AppSec teams to identify vulnerable components, insecure dependencies, and supply chain attack risks.Define secure software development patterns and standards for open-source usage.Lead threat modeling and attack path analysis focused on software supply chain risks.Tooling, Ingestion, and AnalysisOwn implementation, and tuning of SBOM tooling platforms.Oversee ingestion pipelines for SBOM formats (e.g., SPDX, CycloneDX).Correlate SBOM data with vulnerability intelligence (e.g., CVE, VEX) to identify risk exposure.Ensure prioritization logic focuses on exploitability, business impact, and exposure.Vendor Risk & Remediation OversightEstablish contractual SBOM requirements and fallback mechanisms (e.g., VEX reporting or binary analysis).Lead remediation engagement with vendors on vulnerable software components.Define escalation paths for non-compliant or high-risk vendors.Partner with Procurement and TPRM to embed SBOM obligations into sourcing processes.Continuous Monitoring & Threat Intelligence AlignmentIntegrate SBOM outputs into continuous monitoring and detection workflows.Align with SOC and Threat Intelligence teams to identify emerging software supply chain threats.Develop detection use cases tied to vulnerable software, exposed dependencies, and exploitation campaigns.Build TP-SOC playbooks for: Software supply chain incidents (Log4j-type scenarios), provide rapid blast radius analysis across suppliers, coordinate supplier remediation and escalation, and establish thresholds for risk-based decision making.Process Optimization & GovernanceMove organization beyond questionnaire-based vendor risk into technical software risk assessment.Build repeatable workflows for ingestion, analysis, triage, and reporting.Define KPIs, metrics, and reporting dashboards for executive visibility.Lead cross-functional collaboration and influence adoption of standards.Define and implement target SBOM architecture, including-: API-based ingestion pipelines, normalization and enrichment layers, and integration with TPRM and SOC ecosystems.Enable automation-first model for scale and rapid ingestion.Define a pragmatic approach to Vulnerability Exploitability Exchange (VEX) adoption: used as a target-state enhancement.Must Have Skills/Prior Experiences: (Vendor should not submit any candidate that does not have these skills/prior experience.)10+ years of cybersecurity experience with focus on application security or software supply chain risk.Strong expertise in secure SDLC, CI/CD pipelines, and application architecture.Hands-on experience with SBOM standards (SPDX, CycloneDX) and vulnerability management.Proven experience leading security programs or teams.Deep understanding of: Open-source risk and dependency management.Modern software architectures (microservices, APIs, containers).Cloud platforms (AWS, Azure, GCP).Experience in threat modeling and application security testing.Ability to translate technical risk into business impact and influence senior stakeholders.Plus/Nice to Have Skills/Prior Experiences:(Hiring Manager DOES NOT require these skills/ prior experience. However candidates with any of these will be looked at first.)SCA tools or dependency scanning.SBOM formats (CycloneDX, SPDX).Threat intelligence or vulnerability databasesKnowledge of SDLC and CI/CD processes.Experience in third-party/vendor risk or supply chain security.Certifications such as Security+, GSEC, CISSP, CSSLP or similar.Experience in financial services or regulated environments.Knowledge of VEX, vulnerability exploitability scoring, and threat intelligence integration.Experience working with software composition analysis (SCA) tools.Strong communication skills with ability to influence engineering, procurement, and executive teams. EEO “Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of – Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans.”