Cyber Security SBOM Manager

Build TP-SOC playbooks for: Software supply chain incidents (Log4j-type scenarios), provide rapid blast radius analysis across suppliers, coordinate supplier remediation and escalation, and establish thresholds for risk-based decision making. Description : Business Initiative/Purpose: (Goal, Business Impact, Accomplishments from the work) Lead/Manage the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring.

Description:
Business Initiative/Purpose: (Goal, Business Impact, Accomplishments from the work)

• Lead/Manage the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring. This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.
• This role combines technical leadership, application security expertise, and SDLC integration, ensuring SBOM practices are embedded across vendor onboarding, secure development, and continuous monitoring workflows.
• The manager will oversee the definition of secure software supply chain practices, risk attribution models, and governance processes while partnering across Application Security, Engineering, Vendor Risk, and Procurement teams.
• This is a fully on-site position based in Atlanta, GA. Teammates are expected to be in the office five days a week.

Bachelor Degree: (Required, Preferred or Not Required)

• Bachelor’s degree in Computer Science, Cybersecurity, or related field.

Role Responsibilities: (what they will be doing)

• Cyber Security Manager to lead the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring. This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.

Other responsibilities include but not limited to:
SBOM Program Leadership & Strategy

• Lead end-to-end SBOM program implementation (collection, ingestion, analysis, remediation, continuous monitoring).
• Define SBOM governance, standards, and enforcement mechanisms across vendors and internal applications.
• Establish risk scoring methodologies for software components, libraries, and dependencies.
• Drive integration of SBOM processes into procurement, onboarding, and vendor lifecycle management.

Application Security & SDLC Integration

• Embed SBOM generation and validation into CI/CD pipelines and SDLC processes.
• Partner with AppSec teams to identify vulnerable components, insecure dependencies, and supply chain attack risks.
• Define secure software development patterns and standards for open-source usage.
• Lead threat modeling and attack path analysis focused on software supply chain risks.

Tooling, Ingestion, and Analysis

• Own implementation, and tuning of SBOM tooling platforms.
• Oversee ingestion pipelines for SBOM formats (e.g., SPDX, CycloneDX).
• Correlate SBOM data with vulnerability intelligence (e.g., CVE, VEX) to identify risk exposure.
• Ensure prioritization logic focuses on exploitability, business impact, and exposure.

Vendor Risk & Remediation Oversight

• Establish contractual SBOM requirements and fallback mechanisms (e.g., VEX reporting or binary analysis).
• Lead remediation engagement with vendors on vulnerable software components.
• Define escalation paths for non-compliant or high-risk vendors.
• Partner with Procurement and TPRM to embed SBOM obligations into sourcing processes.

Continuous Monitoring & Threat Intelligence Alignment

• Integrate SBOM outputs into continuous monitoring and detection workflows.
• Align with SOC and Threat Intelligence teams to identify emerging software supply chain threats.
• Develop detection use cases tied to vulnerable software, exposed dependencies, and exploitation campaigns.
• Build TP-SOC playbooks for: Software supply chain incidents (Log4j-type scenarios), provide rapid blast radius analysis across suppliers, coordinate supplier remediation and escalation, and establish thresholds for risk-based decision making.

Process Optimization & Governance

• Move organization beyond questionnaire-based vendor risk into technical software risk assessment.
• Build repeatable workflows for ingestion, analysis, triage, and reporting.
• Define KPIs, metrics, and reporting dashboards for executive visibility.
• Lead cross-functional collaboration and influence adoption of standards.
• Define and implement target SBOM architecture, including-: API-based ingestion pipelines, normalization and enrichment layers, and integration with TPRM and SOC ecosystems.
• Enable automation-first model for scale and rapid ingestion.
• Define a pragmatic approach to Vulnerability Exploitability Exchange (VEX) adoption: used as a target-state enhancement.

Must Have Skills/Prior Experiences: (Vendor should not submit any candidate that does not have these skills/prior experience.)

• 10+ years of cybersecurity experience with focus on application security or software supply chain risk.
• Strong expertise in secure SDLC, CI/CD pipelines, and application architecture.
• Hands-on experience with SBOM standards (SPDX, CycloneDX) and vulnerability management.
• Proven experience leading security programs or teams.

Deep understanding of:

• Open-source risk and dependency management.
• Modern software architectures (microservices, APIs, containers).
• Cloud platforms (AWS, Azure, GCP).
• Experience in threat modeling and application security testing.
• Ability to translate technical risk into business impact and influence senior stakeholders.

Plus/Nice to Have Skills/Prior Experiences:(Hiring Manager DOES NOT require these skills/ prior experience. However candidates with any of these will be looked at first.)

• SCA tools or dependency scanning.
• SBOM formats (CycloneDX, SPDX).
• Threat intelligence or vulnerability databases
• Knowledge of SDLC and CI/CD processes.
• Experience in third-party/vendor risk or supply chain security.
• Certifications such as Security+, GSEC, CISSP, CSSLP or similar.
• Experience in financial services or regulated environments.
• Knowledge of VEX, vulnerability exploitability scoring, and threat intelligence integration.
• Experience working with software composition analysis (SCA) tools.
• Strong communication skills with ability to influence engineering, procurement, and executive teams.

EEO
“Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of – Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans.”