M
Cyber Security SBOM Manager
Mindlance
- 🇺🇸 United States
- On-site
- Manager or above
- 20 hours ago
- CI/CD
- AppSec
- Threat Modeling
- Threat Intelligence
- triage
- Vulnerability Management
- Microservices
- AWS
- Azure
- GCP
- GSEC
- CISSP
- CSSLP
20 hours ago
Business Initiative/Purpose: (Goal, Business Impact, Accomplishments from the work)
- Lead/Manage the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring. This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.
- This role combines technical leadership, application security expertise, and SDLC integration, ensuring SBOM practices are embedded across vendor onboarding, secure development, and continuous monitoring workflows.
- The manager will oversee the definition of secure software supply chain practices, risk attribution models, and governance processes while partnering across Application Security, Engineering, Vendor Risk, and Procurement teams.
- This is a fully on-site position based in Atlanta, GA. Teammates are expected to be in the office five days a week.
Bachelor Degree: (Required, Preferred or Not Required)
- Bachelor’s degree in Computer Science, Cybersecurity, or related field.
Role Responsibilities: (what they will be doing)
- Cyber Security Manager to lead the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring. This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.
Other responsibilities include but not limited to:
SBOM Program Leadership & Strategy
- Lead end-to-end SBOM program implementation (collection, ingestion, analysis, remediation, continuous monitoring).
- Define SBOM governance, standards, and enforcement mechanisms across vendors and internal applications.
- Establish risk scoring methodologies for software components, libraries, and dependencies.
- Drive integration of SBOM processes into procurement, onboarding, and vendor lifecycle management.
Application Security & SDLC Integration
- Embed SBOM generation and validation into CI/CD pipelines and SDLC processes.
- Partner with AppSec teams to identify vulnerable components, insecure dependencies, and supply chain attack risks.
- Define secure software development patterns and standards for open-source usage.
- Lead threat modeling and attack path analysis focused on software supply chain risks.
Tooling, Ingestion, and Analysis
- Own implementation, and tuning of SBOM tooling platforms.
- Oversee ingestion pipelines for SBOM formats (e.g., SPDX, CycloneDX).
- Correlate SBOM data with vulnerability intelligence (e.g., CVE, VEX) to identify risk exposure.
- Ensure prioritization logic focuses on exploitability, business impact, and exposure.
Vendor Risk & Remediation Oversight
- Establish contractual SBOM requirements and fallback mechanisms (e.g., VEX reporting or binary analysis).
- Lead remediation engagement with vendors on vulnerable software components.
- Define escalation paths for non-compliant or high-risk vendors.
- Partner with Procurement and TPRM to embed SBOM obligations into sourcing processes.
Continuous Monitoring & Threat Intelligence Alignment
- Integrate SBOM outputs into continuous monitoring and detection workflows.
- Align with SOC and Threat Intelligence teams to identify emerging software supply chain threats.
- Develop detection use cases tied to vulnerable software, exposed dependencies, and exploitation campaigns.
- Build TP-SOC playbooks for: Software supply chain incidents (Log4j-type scenarios), provide rapid blast radius analysis across suppliers, coordinate supplier remediation and escalation, and establish thresholds for risk-based decision making.
Process Optimization & Governance
- Move organization beyond questionnaire-based vendor risk into technical software risk assessment.
- Build repeatable workflows for ingestion, analysis, triage, and reporting.
- Define KPIs, metrics, and reporting dashboards for executive visibility.
- Lead cross-functional collaboration and influence adoption of standards.
- Define and implement target SBOM architecture, including-: API-based ingestion pipelines, normalization and enrichment layers, and integration with TPRM and SOC ecosystems.
- Enable automation-first model for scale and rapid ingestion.
- Define a pragmatic approach to Vulnerability Exploitability Exchange (VEX) adoption: used as a target-state enhancement.
Must Have Skills/Prior Experiences: (Vendor should not submit any candidate that does not have these skills/prior experience.)
- 10+ years of cybersecurity experience with focus on application security or software supply chain risk.
- Strong expertise in secure SDLC, CI/CD pipelines, and application architecture.
- Hands-on experience with SBOM standards (SPDX, CycloneDX) and vulnerability management.
- Proven experience leading security programs or teams.
Deep understanding of:
- Open-source risk and dependency management.
- Modern software architectures (microservices, APIs, containers).
- Cloud platforms (AWS, Azure, GCP).
- Experience in threat modeling and application security testing.
- Ability to translate technical risk into business impact and influence senior stakeholders.
Plus/Nice to Have Skills/Prior Experiences:(Hiring Manager DOES NOT require these skills/ prior experience. However candidates with any of these will be looked at first.)
- SCA tools or dependency scanning.
- SBOM formats (CycloneDX, SPDX).
- Threat intelligence or vulnerability databases
- Knowledge of SDLC and CI/CD processes.
- Experience in third-party/vendor risk or supply chain security.
- Certifications such as Security+, GSEC, CISSP, CSSLP or similar.
- Experience in financial services or regulated environments.
- Knowledge of VEX, vulnerability exploitability scoring, and threat intelligence integration.
- Experience working with software composition analysis (SCA) tools.
- Strong communication skills with ability to influence engineering, procurement, and executive teams.
EEO
“Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of – Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans.”
Cyber Security SBOM Manager · Mindlance