Third Party SBOM Manager

Our client, a Commercial Banking company, is looking for a Third Party SBOM Manager for their Atlanta, GA location.

Responsibilities:

• This is a fully on-site position based in Atlanta, GA. Teammates are expected to be in the office five days a week.
• Initial/Primary Project Name(s): Third Party Continuous Monitoring- Software Bill of Materials (SBOM) program.
• Business Initiative/Purpose:
• Lead/Manage the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring.
• This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.
• This role combines technical leadership, application security expertise, and SDLC integration, ensuring SBOM practices are embedded across vendor onboarding, secure development, and continuous monitoring workflows.
• The manager will oversee the definition of secure software supply chain practices, risk attribution models, and governance processes while partnering across Application Security, Engineering, Vendor Risk, and Procurement teams.
• Cyber Security Manager to lead the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring.
• This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.
• SBOM Program Leadership & Strategy
• Lead end-to-end SBOM program implementation (collection, ingestion, analysis, remediation, continuous monitoring).
• Define SBOM governance, standards, and enforcement mechanisms across vendors and internal applications.
• Establish risk scoring methodologies for software components, libraries, and dependencies.
• Drive integration of SBOM processes into procurement, onboarding, and vendor lifecycle management.
• Application Security & SDLC Integration:
• Embed SBOM generation and validation into CI/CD pipelines and SDLC processes.
• Partner with AppSec teams to identify vulnerable components, insecure dependencies, and supply chain attack risks.
• Define secure software development patterns and standards for open-source usage.
• Lead threat modeling and attack path analysis focused on software supply chain risks.
• Tooling, Ingestion, and Analysis:
• Own implementation, and tuning of SBOM tooling platforms.
• Oversee ingestion pipelines for SBOM formats (e.g., SPDX, CycloneDX).
• Correlate SBOM data with vulnerability intelligence (e.g., CVE, VEX) to identify risk exposure.
• Ensure prioritization logic focuses on exploitability, business impact, and exposure.
• Vendor Risk & Remediation Oversight:
• Establish contractual SBOM requirements and fallback mechanisms (e.g., VEX reporting or binary analysis).
• Lead remediation engagement with vendors on vulnerable software components.
• Define escalation paths for non-compliant or high-risk vendors.
• Partner with Procurement and TPRM to embed SBOM obligations into sourcing processes.
• Continuous Monitoring & Threat Intelligence Alignment:
• Integrate SBOM outputs into continuous monitoring and detection workflows.
• Align with SOC and Threat Intelligence teams to identify emerging software supply chain threats.
• Develop detection use cases tied to vulnerable software, exposed dependencies, and exploitation campaigns.
• Build TP-SOC playbooks for: Software supply chain incidents (Log4j-type scenarios), provide rapid blast radius analysis across suppliers, coordinate supplier remediation and escalation, and establish thresholds for risk-based decision making.
• Process Optimization & Governance:
• Move organization beyond questionnaire-based vendor risk into technical software risk assessment.
• Build repeatable workflows for ingestion, analysis, triage, and reporting.
• Define KPIs, metrics, and reporting dashboards for executive visibility.
• Lead cross-functional collaboration and influence adoption of standards.
• Define and implement target SBOM architecture, including-: API-based ingestion pipelines, normalization and enrichment layers, and integration with TPRM and SOC ecosystems.
• Enable automation-first model for scale and rapid ingestion.
• Define a pragmatic approach to Vulnerability Exploitability Exchange (VEX) adoption: used as a target-state enhancement

Requirements:

• 10+ years of cybersecurity experience with focus on application security or software supply chain risk
• Strong expertise in secure SDLC, CI/CD pipelines, and application architecture
• Hands-on experience with SBOM standards (SPDX, CycloneDX) and vulnerability management
• Proven experience leading security programs or teams
• Deep understanding of:
• Open-source risk and dependency management
• Modern software architectures (microservices, APIs, containers)
• Cloud platforms (AWS, Azure, GCP)
• Experience in threat modeling and application security testing
• Ability to translate technical risk into business impact and influence senior stakeholders
• Plus/Nice to Have Skills/Prior Experiences:
• SCA tools or dependency scanning
• SBOM formats (CycloneDX, SPDX)
• Threat intelligence or vulnerability databases
• Knowledge of SDLC and CI/CD processes
• Experience in third-party/vendor risk or supply chain security.
• Certifications such as Security+, GSEC, CISSP, CSSLP or similar.
• Experience in financial services or regulated environments
• Knowledge of VEX, vulnerability exploitability scoring, and threat intelligence integration
• Experience working with software composition analysis (SCA) tools
• Strong communication skills with ability to influence engineering, procurement, and executive teams"

Why Should You Apply?

• Health Benefits
• Referral Program
• Excellent growth and advancement opportunities