Third Party SBOM Manager

Build TP-SOC playbooks for: Software supply chain incidents (Log4j-type scenarios), provide rapid blast radius analysis across suppliers, coordinate supplier remediation and escalation, and establish thresholds for risk-based decision making. The manager will oversee the definition of secure software supply chain practices, risk attribution models, and governance processes while partnering across Application Security, Engineering, Vendor Risk, and Procurement teams.

Our client, a Commercial Banking company, is looking for a Third Party SBOM Manager for their Atlanta, GA location.
 
Responsibilities:

• This is a fully on-site position based in Atlanta, GA. Teammates are expected to be in the office five days a week.
• Initial/Primary Project Name(s): Third Party Continuous Monitoring- Software Bill of Materials (SBOM) program.
• Business Initiative/Purpose:
• Lead/Manage  the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring.
• This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.
• This role combines technical leadership, application security expertise, and SDLC integration, ensuring SBOM practices are embedded across vendor onboarding, secure development, and continuous monitoring workflows.
• The manager will oversee the definition of secure software supply chain practices, risk attribution models, and governance processes while partnering across  Application Security, Engineering, Vendor Risk, and Procurement teams.
• Cyber Security Manager to lead the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring.
• This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.
• SBOM Program Leadership & Strategy
• Lead end-to-end SBOM program implementation (collection, ingestion, analysis, remediation, continuous monitoring).
• Define SBOM governance, standards, and enforcement mechanisms across vendors and internal applications.
• Establish risk scoring methodologies for software components, libraries, and dependencies.
• Drive integration of SBOM processes into procurement, onboarding, and vendor lifecycle management.
• Application Security & SDLC Integration:
• Embed SBOM generation and validation into CI/CD pipelines and SDLC processes.
• Partner with AppSec teams to identify vulnerable components, insecure dependencies, and supply chain attack risks.
• Define secure software development patterns and standards for open-source usage.
• Lead threat modeling and attack path analysis focused on software supply chain risks.
• Tooling, Ingestion, and Analysis:
• Own implementation, and tuning of SBOM tooling platforms.
• Oversee ingestion pipelines for SBOM formats (e.g., SPDX, CycloneDX).
• Correlate SBOM data with vulnerability intelligence (e.g., CVE, VEX) to identify risk exposure.
• Ensure prioritization logic focuses on exploitability, business impact, and exposure.
• Vendor Risk & Remediation Oversight:
• Establish contractual SBOM requirements and fallback mechanisms (e.g., VEX reporting or binary analysis).
• Lead remediation engagement with vendors on vulnerable software components.
• Define escalation paths for non-compliant or high-risk vendors.
• Partner with Procurement and TPRM to embed SBOM obligations into sourcing processes.
• Continuous Monitoring & Threat Intelligence Alignment:
• Integrate SBOM outputs into continuous monitoring and detection workflows.
• Align with SOC and Threat Intelligence teams to identify emerging software supply chain threats.
• Develop detection use cases tied to vulnerable software, exposed dependencies, and exploitation campaigns.
• Build TP-SOC playbooks for: Software supply chain incidents (Log4j-type scenarios), provide rapid blast radius analysis across suppliers, coordinate supplier remediation and escalation, and establish thresholds for risk-based decision making.
• Process Optimization & Governance:
• Move organization beyond questionnaire-based vendor risk into technical software risk assessment.
• Build repeatable workflows for ingestion, analysis, triage, and reporting.
• Define KPIs, metrics, and reporting dashboards for executive visibility.
• Lead cross-functional collaboration and influence adoption of standards.
• Define and implement target SBOM architecture, including-: API-based ingestion pipelines, normalization and enrichment layers, and integration with TPRM and SOC ecosystems.
• Enable automation-first model for scale and rapid ingestion.
• Define a pragmatic approach to Vulnerability Exploitability Exchange (VEX) adoption: used as a target-state enhancement

 
Requirements:

• 10+ years of cybersecurity experience with focus on application security or software supply chain risk
• Strong expertise in secure SDLC, CI/CD pipelines, and application architecture
• Hands-on experience with SBOM standards (SPDX, CycloneDX) and vulnerability management
• Proven experience leading security programs or teams
• Deep understanding of:
• Open-source risk and dependency management
• Modern software architectures (microservices, APIs, containers)
• Cloud platforms (AWS, Azure, GCP)
• Experience in threat modeling and application security testing
• Ability to translate technical risk into business impact and influence senior stakeholders
• Plus/Nice to Have Skills/Prior Experiences:
• SCA tools or dependency scanning
• SBOM formats (CycloneDX, SPDX)
• Threat intelligence or vulnerability databases
• Knowledge of SDLC and CI/CD processes
• Experience in third-party/vendor risk or supply chain security.
• Certifications such as Security+, GSEC, CISSP, CSSLP or similar.
• Experience in financial services or regulated environments
• Knowledge of VEX, vulnerability exploitability scoring, and threat intelligence integration
• Experience working with software composition analysis (SCA) tools
• Strong communication skills with ability to influence engineering, procurement, and executive teams"

 
Why Should You Apply?

• Health Benefits
• Referral Program
• Excellent growth and advancement opportunities