IL
Third Party SBOM Manager
ICONMA, LLC
- 🇺🇸 United States
- On-site
- Manager or above
- 19 hours ago
- $97.04 – $102.04 / hour
- CI/CD
- AppSec
- Threat Modeling
- Threat Intelligence
- triage
- Vulnerability Management
- Microservices
- AWS
- Azure
- GCP
- GSEC
- CISSP
- CSSLP
19 hours ago
Responsibilities:
- This is a fully on-site position based in Atlanta, GA. Teammates are expected to be in the office five days a week.
- Initial/Primary Project Name(s): Third Party Continuous Monitoring- Software Bill of Materials (SBOM) program.
- Business Initiative/Purpose:
- Lead/Manage the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring.
- This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.
- This role combines technical leadership, application security expertise, and SDLC integration, ensuring SBOM practices are embedded across vendor onboarding, secure development, and continuous monitoring workflows.
- The manager will oversee the definition of secure software supply chain practices, risk attribution models, and governance processes while partnering across Application Security, Engineering, Vendor Risk, and Procurement teams.
- Cyber Security Manager to lead the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring.
- This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.
- SBOM Program Leadership & Strategy
- Lead end-to-end SBOM program implementation (collection, ingestion, analysis, remediation, continuous monitoring).
- Define SBOM governance, standards, and enforcement mechanisms across vendors and internal applications.
- Establish risk scoring methodologies for software components, libraries, and dependencies.
- Drive integration of SBOM processes into procurement, onboarding, and vendor lifecycle management.
- Application Security & SDLC Integration:
- Embed SBOM generation and validation into CI/CD pipelines and SDLC processes.
- Partner with AppSec teams to identify vulnerable components, insecure dependencies, and supply chain attack risks.
- Define secure software development patterns and standards for open-source usage.
- Lead threat modeling and attack path analysis focused on software supply chain risks.
- Tooling, Ingestion, and Analysis:
- Own implementation, and tuning of SBOM tooling platforms.
- Oversee ingestion pipelines for SBOM formats (e.g., SPDX, CycloneDX).
- Correlate SBOM data with vulnerability intelligence (e.g., CVE, VEX) to identify risk exposure.
- Ensure prioritization logic focuses on exploitability, business impact, and exposure.
- Vendor Risk & Remediation Oversight:
- Establish contractual SBOM requirements and fallback mechanisms (e.g., VEX reporting or binary analysis).
- Lead remediation engagement with vendors on vulnerable software components.
- Define escalation paths for non-compliant or high-risk vendors.
- Partner with Procurement and TPRM to embed SBOM obligations into sourcing processes.
- Continuous Monitoring & Threat Intelligence Alignment:
- Integrate SBOM outputs into continuous monitoring and detection workflows.
- Align with SOC and Threat Intelligence teams to identify emerging software supply chain threats.
- Develop detection use cases tied to vulnerable software, exposed dependencies, and exploitation campaigns.
- Build TP-SOC playbooks for: Software supply chain incidents (Log4j-type scenarios), provide rapid blast radius analysis across suppliers, coordinate supplier remediation and escalation, and establish thresholds for risk-based decision making.
- Process Optimization & Governance:
- Move organization beyond questionnaire-based vendor risk into technical software risk assessment.
- Build repeatable workflows for ingestion, analysis, triage, and reporting.
- Define KPIs, metrics, and reporting dashboards for executive visibility.
- Lead cross-functional collaboration and influence adoption of standards.
- Define and implement target SBOM architecture, including-: API-based ingestion pipelines, normalization and enrichment layers, and integration with TPRM and SOC ecosystems.
- Enable automation-first model for scale and rapid ingestion.
- Define a pragmatic approach to Vulnerability Exploitability Exchange (VEX) adoption: used as a target-state enhancement
Requirements:
- 10+ years of cybersecurity experience with focus on application security or software supply chain risk
- Strong expertise in secure SDLC, CI/CD pipelines, and application architecture
- Hands-on experience with SBOM standards (SPDX, CycloneDX) and vulnerability management
- Proven experience leading security programs or teams
- Deep understanding of:
- Open-source risk and dependency management
- Modern software architectures (microservices, APIs, containers)
- Cloud platforms (AWS, Azure, GCP)
- Experience in threat modeling and application security testing
- Ability to translate technical risk into business impact and influence senior stakeholders
- Plus/Nice to Have Skills/Prior Experiences:
- SCA tools or dependency scanning
- SBOM formats (CycloneDX, SPDX)
- Threat intelligence or vulnerability databases
- Knowledge of SDLC and CI/CD processes
- Experience in third-party/vendor risk or supply chain security.
- Certifications such as Security+, GSEC, CISSP, CSSLP or similar.
- Experience in financial services or regulated environments
- Knowledge of VEX, vulnerability exploitability scoring, and threat intelligence integration
- Experience working with software composition analysis (SCA) tools
- Strong communication skills with ability to influence engineering, procurement, and executive teams"
Why Should You Apply?
- Health Benefits
- Referral Program
- Excellent growth and advancement opportunities
Third Party SBOM Manager · ICONMA, LLC