Cyber Security SBOM Manager

Job-ID Reference
26-29061

Description:

Business Initiative/

Purpose:

(Goal, Business Impact, Accomplishments from the work)
Lead/Manage the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring. This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.

This role combines technical leadership, application security expertise, and SDLC integration, ensuring SBOM practices are embedded across vendor onboarding, secure development, and continuous monitoring workflows.

The manager will oversee the definition of secure software supply chain practices, risk attribution models, and governance processes while partnering across Application Security, Engineering, Vendor Risk, and Procurement teams.

This is a fully on-site position based in Atlanta, GA. Teammates are expected to be in the office five days a week.

Bachelor Degree: (Required, Preferred or Not Required)
Bachelor’s degree in Computer Science, Cybersecurity, or related field.

Role Responsibilities:

(what they will be doing)
Cyber Security Manager to lead the implementation and ongoing management of a Software Bill of Materials (SBOM) program focused on software supply chain risk monitoring. This includes governing how SBOMs are requested, ingested, analyzed, and operationalized to identify risks introduced by third-party software providers.

Other responsibilities include but not limited to:

SBOM Program Leadership & Strategy Lead end-to-end SBOM program implementation (collection, ingestion, analysis, remediation, continuous monitoring).Define SBOM governance, standards, and enforcement mechanisms across vendors and internal applications.

Establish risk scoring methodologies for software components, libraries, and dependencies.

Drive integration of SBOM processes into procurement, onboarding, and vendor lifecycle management.

Application Security & SDLC Integration Embed SBOM generation and validation into CI/CD pipelines and SDLC processes.

Partner with App Sec teams to identify vulnerable components, insecure dependencies, and supply chain attack risks.

Define secure software development patterns and standards for open-source usage.

Lead threat modeling and attack path analysis focused on software supply chain risks.

Tooling, Ingestion, and Analysis Own implementation, and tuning of SBOM tooling platforms.

Oversee ingestion pipelines for SBOM formats (e.g., SPDX, CycloneDX).Correlate SBOM data with vulnerability intelligence (e.g., CVE, VEX) to identify risk exposure.

Ensure prioritization logic focuses on exploitability, business impact, and exposure.

Vendor Risk & Remediation Oversight Establish contractual SBOM requirements and fallback mechanisms (e.g., VEX reporting or binary analysis).Lead remediation engagement with vendors on vulnerable software components.

Define escalation paths for non-compliant or high-risk vendors.

Partner with Procurement and TPRM to embed SBOM obligations into sourcing processes.

Continuous Monitoring & Threat Intelligence Alignment Integrate SBOM outputs into continuous monitoring and detection workflows.

Align with SOC and Threat Intelligence teams to identify emerging software supply chain threats.

Develop detection use cases tied to vulnerable software, exposed dependencies, and exploitation campaigns.

Build TP-SOC playbooks for:
Software supply chain incidents (Log4j-type scenarios), provide rapid blast radius analysis across suppliers, coordinate supplier remediation and escalation, and establish thresholds for risk-based decision making.

Process Optimization & Governance Move organization beyond questionnaire-based vendor risk into technical software risk assessment.

Build repeatable workflows for ingestion, analysis, triage, and reporting.

Define KPIs, metrics, and reporting dashboards for executive visibility.

Lead cross-functional collaboration and influence adoption of standards.

Define and implement target SBOM architecture, including-: API-based ingestion pipelines, normalization and enrichment layers, and integration with TPRM and SOC ecosystems.

Enable automation-first model for scale and rapid ingestion.

Define a pragmatic approach to Vulnerability Exploitability Exchange (VEX) adoption: used as a target-state enhancement.

Must Have Skills/Prior Experiences: (Vendor should not submit any candidate that does not have these skills/prior experience.)10+ years of cybersecurity experience…