V

Veracode

Cloud-based platform for application security scanning

Procurement Manager

Full-Time
No salary listed
Senior, Expert
Bachelor's
Burlington, MA, USA
In Person
Operations & LogisticsProcurement & Sourcing

About the job

Requirements
  • A Bachelor's degree in Business, Supply Chain Management, Finance, or a related field.
  • At least 7 years of procurement, strategic sourcing, or purchasing experience.
  • At least 3 years of experience leading, managing, or owning a procurement function, including direct people leadership or serving as the primary procurement leader for an organization.
  • Demonstrated experience negotiating complex supplier agreements and managing vendor relationships.
  • Experience supporting technology organizations, preferably within SaaS, cybersecurity, or software companies.
  • Strong understanding of procurement best practices, contract management, supplier performance management, and spend management.
  • Hands-on experience with Concur for procurement, purchasing workflows, and expense management.
  • Strong working knowledge of NetSuite, including purchasing, vendor management, and procurement-related financial processes.
  • Advanced proficiency with Microsoft Excel and reporting tools.
  • Excellent negotiation, analytical, communication, stakeholder management, and project management skills.
  • Ability to influence cross-functional teams, drive consensus, and successfully manage competing priorities.
Responsibilities
  • Lead the organization's procurement function, ensuring efficient, cost-effective, and compliant purchasing practices.
  • Develop and execute sourcing strategies for software, SaaS, technology, professional services, and indirect spend categories.
  • Partner with Legal, Finance, IT, Security, and business stakeholders to negotiate favorable commercial terms while mitigating risk.
  • Manage the complete procurement lifecycle from vendor selection through contract execution and renewal.
  • Evaluate supplier performance and develop strategic vendor relationships.
  • Identify opportunities for cost savings, process improvements, and procurement automation.
  • Develop procurement policies, procedures, and best practices to improve operational effectiveness.
  • Analyze spend data and provide reporting, metrics, and recommendations to leadership.
  • Ensure procurement activities comply with internal controls, financial policies, and regulatory requirements.
  • Lead cross-functional procurement initiatives and provide guidance to team members and stakeholders.
  • Support budgeting, forecasting, and vendor management activities.
Desired Qualifications
  • Experience supporting technology organizations, preferably within SaaS, cybersecurity, or software companies.

About the company

V

Veracode

View
cbWebsite

Placeholder

Company Size

501-1,000

Company Stage

Acquired

Total Funding

$114.3M

Headquarters

New York City, New York

Founded

2006

Get referred to Veracode

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • July 2026 Package Firewall and Risk Manager updates deepen AI-era supply-chain defense.
  • Veracode reported 60% more malicious-package blocking and 92% faster remediation in 2026.
  • Regulatory pressure from DORA, NIS2, and PCI DSS v4.0 expands budget priority for AppSec.

What critics are saying

  • 82% security debt and 60% critical debt mean customers face chronic remediation failure.
  • AI-generated code and third-party components drive 66% of critical debt, hurting Veracode's core promise.
  • Private-equity ownership since 2022 pressures margin expansion; a weak growth reset risks commoditization.

What makes Veracode unique

  • July 30, 2026 Marketplace pairs Veracode scanning with DryRun AI-native intent analysis.
  • Veracode Fix for SCA automates safe pull-request remediation from proprietary vulnerability intelligence.
  • 2026 SoSS data spans 1.6 million applications, powering unusually deep benchmarking.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Health Insurance
  • Dental Insurance
  • Vision Insurance
  • Wellness Program
  • Unlimited Paid Time Off
  • 401(k) Company Match
  • 401(k) Retirement Plan
  • Professional Development Budget

Growth & Insights and Company News

Headcount

6 month growth

-1%

1 year growth

0%

2 year growth

-6%
Softprom
Oct 13th, 2026
Veracode named Difference Maker in 2026 AST Buyer's Guide.

Veracode named Difference Maker in 2026 AST Buyer's Guide. News | 13.10.2026 Modern development teams are shipping more AI-generated code than ever before, and that code still contains flaws. For CIOs and CISOs, the challenge is no longer whether to run application security testing (AST), but how to build a complete program that keeps pace with continuous code changes. A new independent analyst report confirms that comprehensive AST remains essential, and names Veracode at the top of the 2026 vendor pyramid. What was announced. On October 7, 2026, Veracode announced it has been named a Difference Maker and positioned at the top of the vendor pyramid in the Buyer's Guide 2026 for Application Security Testing, published by FOURCASTERS and Lionfish Tech Advisors. Veracode is one of the few vendors in the report that delivers all seven components of a complete application security program. THE PYRAMID for Application Security Testing is an independent analyst report that evaluates AST vendors on their ability to deliver a complete program, not just a scanner. Lionfish Tech Advisors is a mid-market advisory firm staffed by former Gartner research directors and analysts, delivering validated market positioning and vendor shortlists for CIOs and CISOs. This distinction between providing individual testing capabilities and providing enough of the components needed to support an application security program is important throughout this research FOURCASTERS and Lionfish Tech Advisors, Buyer's Guide 2026 Why this matters. The report takes a clear position that AI makes application security testing more essential, not less. AI helps developers produce more code at higher velocity, but it still cannot reliably produce flaw-free code. The volume of generated code and continuous AI-driven remediation turns AST from a periodic activity into an always-on validation layer. For enterprise buyers, the shortlist signal is clear: vendors offering only one or two testing types, or lacking the completeness and scale to support a full AST program, are excluded. The Difference Maker designation recognizes distinctive and unique market impact. This recognition is a powerful validation of what Veracode has built - a complete application security program that helps organizations prove their software can be trusted. As AI accelerates code generation and the attack surface grows, the need for independent, comprehensive testing has never been greater Karen Buffo, Chief Marketing Officer at Veracode Technical details. The report defines seven components every AST program needs: * SAST: Static Application Security Testing * DAST: Dynamic Application Security Testing * SCA: Software Composition Analysis * Reporting and trending: program-level visibility and metrics * Secure code training: developer enablement * Remediation assistance: guided and AI-assisted fixing * Pentesting services: expert-led validation The report also notes that Veracode provides Application Security Posture Management (ASPM) capabilities through acquisition, internal development, or both, moving beyond the traditional combination of SAST, DAST, and SCA toward a broader and more continuous function. Softprom and Veracode. Softprom is the official distributor of Veracode. Organizations building a complete application security program can request evaluations, licensing, and implementation support through its team. This content was prepared as part of the Softprom DistriFlow project - an automated system for monitoring and adapting vendor news. Original source: original article.

SaasRise
Oct 10th, 2026
Anthropic unveils free ai-driven OSS vulnerability scanner for open-source projects.

Anthropic unveils free ai-driven OSS vulnerability scanner for open-source projects. SaasRise - Oct 10, 2026 Anthropic announced OSS Scanner, a free AI-powered service that periodically scans open-source codebases for vulnerabilities using its Claude Mythos model. The tool delivers fully automated reports, trading human triage for speed and scale, and signals the AI firm's push into developer security tooling. Why it matters. The launch of a free, AI-only vulnerability scanner lowers the cost of security for open-source maintainers, a segment that traditionally relies on community volunteers. By automating scans at scale, Anthropic could accelerate the detection of flaws that propagate into SaaS products, reducing breach risk for downstream customers. For SaaS operators, early alerts from OSS projects translate into fewer emergency patches and lower incident response costs. From a market perspective, Anthropic's entry intensifies competition in the developer-focused security space, where incumbents like Snyk, Veracode, and GitHub Advanced Security have built paid models around human-reviewed findings. If OSS Scanner gains traction, it may force rivals to reconsider pricing or to incorporate more AI-driven components, reshaping the economics of SaaS security tooling. Key points. * Anthropic launched OSS Scanner, a free AI-driven vulnerability scanner for open-source projects. * Scans are performed by Claude Mythos and other top-tier models, with reports generated without human review. * The service mirrors Google's OSS-Fuzz but relies entirely on large language models for detection. * Anthropic's paid Claude Security product offers broader code-scanning and patching capabilities. * The launch aligns with Anthropic's broader branding push, including new .anthropic and .claude domain applications. Analysis. Anthropic's OSS Scanner reflects a broader shift toward AI-first security tooling in the SaaS ecosystem. Historically, vulnerability management has been a labor-intensive process, with human analysts triaging findings from static analysis tools. By removing the human layer, Anthropic bets on model accuracy and volume to create a defensible moat: the more code the scanner ingests, the better its detection heuristics become. This data moat could eventually feed into Claude's commercial offerings, giving Anthropic a competitive edge over traditional SAST vendors that lack comparable training data. However, the trade-off between speed and precision is stark. Early adopters may encounter noisy reports, which could erode trust if false positives overwhelm maintainers. In the SaaS world, where time-to-patch directly impacts service reliability, any erosion of confidence could limit the scanner's utility for mission-critical applications. Competitors may respond by bundling AI models with human-in-the-loop verification, positioning themselves as the safer choice for enterprises. Looking ahead, the scanner's success will hinge on network effects. If a critical mass of high-profile projects opt in, the resulting data could dramatically improve model performance, creating a virtuous cycle that entrenches Anthropic's role in the software supply chain. Conversely, if adoption stalls, the service may remain a niche offering, serving more as a brand-building exercise than a revenue driver. The next quarter will reveal whether OSS Scanner can transition from a free goodwill gesture to a cornerstone of Anthropic's SaaS security strategy.

EIN Presswire
Oct 6th, 2026
The Top SCA software vendors according to the FeaturedCustomers Fall 2026 Customer Success Report.

The Top SCA software vendors according to the FeaturedCustomers Fall 2026 Customer Success Report. October 06, 2026, 15:00 GMT FeaturedCustomers releases the Fall 2026 Software Composition Analysis Software Customer Success Report. COOPER CITY, FL, UNITED STATES, October 6, 2026 / EINPresswire.com / - Today FeaturedCustomers published the Fall 2026 Software Composition Analysis Software Customer Success Report to give prospects better insight on which Software Composition Analysis Software would work best for their business according to real customer references. The highest rated vendors according to the Fall 2026 Software Composition Analysis Software Customer Success Report are: Market Leaders - Contrast Security, Datadog, GitLab, JFrog, Mend, Snyk, Sonatype, and Veracode were given the highest "Market Leader" award. Market Leaders are vendors with a substantial customer base & market share. Market Leaders have the highest ratio of customer reference content, content quality score, and social media presence relative to company size. Top Performers - Aikido, Anchore, Apiiro, Black Duck, CAST, Checkmarx, and Semgrep were awarded "Top Performer" honors. Top Performers are vendors with significant market presence and enough customer reference content to validate their vision. Top Performers' products are highly rated by its customers but have not achieved the customer base and scale of a Market Leader relative to company size. Rising Stars - Cycode, FOSSA, Jit, Qwiet AI, and Revenera were awarded the "Rising Star" honor. Rising Stars are vendors that do not have the market presence of Market Leaders or Top Performers but understand where the market is going and has disruptive technology. Rising Stars have been around long enough to establish momentum and a minimum amount of customer reference content along with a growing social presence. About the Fall 2026 Software Composition Analysis Software Customer Success Report: The customer success report is based on over 2,000 pieces of verified customer reference content. A vendor's overall customer success score is reached via a weighted average of their Content, Market Presence, and Company Scores. Of the vendors listed in the FeaturedCustomers' Software Composition Analysis Software category, 20 vendors met the minimum requirements needed to be considered for the customer success report. About FeaturedCustomers: FeaturedCustomers, the world's only customer reference platform for B2B business software and services, helps potential B2B buyers research and discover business software and services through vendor validated customer reference content such as customer testimonials, success stories, case studies, and customer videos. Every day the platform helps influence the purchasing decisions of thousands of B2B buyers in the final stages of their buying cycle from Fortune 500 companies to SMB's. For more information, visit https://www.featuredcustomers.com. Legal Disclaimer: EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above. You just read: October 06, 2026, 15:00 GMT EIN Presswire's priority is author transparency. We do our best to weed out false and misleading content. The content above is the sole responsibility of the author who makes it available. If you have any complaints, kindly contact the author above. Maggie Mei FeaturedCustomers +1 888-763-8927

Softprom
Aug 18th, 2026
Veracode named Overall Leader in 2026 KuppingerCole Software Supply Chain Security Leadership Compass.

Veracode named Overall Leader in 2026 KuppingerCole Software Supply Chain Security Leadership Compass. News | 18.08.2026 Software supply chain attacks are accelerating, and CISOs need proof that their vendor can not only detect risk but actively block and remediate it. Compromised build systems, malicious open-source packages, and evolving regulations such as the EU Cyber Resilience Act and US Executive Order 14028 have made software supply chain security a board-level priority. Independent analyst validation is now a critical factor when IT leaders select an application risk management platform. What was announced. Veracode announced on August 6, 2026 that it has been named the Overall Leader in the 2026 KuppingerCole Analysts Leadership Compass: Software Supply Chain Security for the second consecutive time since the report was first published. Veracode is positioned at the top of the Overall Leader, Product Leader, and Innovation Leader categories, and is also recognized as a Market Leader. The KuppingerCole Analysts Leadership Compass assesses vendors on product strength, market presence, and innovation. The report was authored by Jonathan Care, an expert in cybersecurity and fraud detection and a Fellow of the British Computer Society. Veracode earns its Overall Leadership position by evolving from application scanning into a unified application risk management platform, pairing mature application security testing with a dedicated software supply chain layer. Its Package Firewall blocks malicious open-source packages before they enter the codebase, while its first-to-market, AI-powered Fix capability gives developers remediation choices rather than just flagging problems. KuppingerCole Analysts, 2026 Leadership Compass Why this matters. For CIOs, CISOs, and procurement leaders, this recognition provides third-party validation that Veracode combines mature Application Security Testing with proactive supply chain controls. As regulatory pressure grows under the UK Cyber Security Bill, EU CRA, and NIST SSDF, organizations need consolidated ASPM visibility, automated remediation, and evidence of enterprise-grade compliance such as SOC 2 Type II. This recognition reflects what Softprom hear from customers every day: they don't just want visibility into supply chain risk, they want it stopped and fixed automatically. As supply chain attacks grow more sophisticated, security teams need a partner that closes the gap between finding a risk and fixing it. Ajay Nigam, Chief Product Officer at Veracode Technical details. * Static Analysis: Support for 130+ languages with a market-leading low false-positive rate. * Package Firewall: Blocks malicious open-source packages at the point of ingestion. * Malicious Package Detection: Analyzes new packages within seconds. * Veracode Fix: AI-powered engine that proposes and applies remediation. * Proprietary suite: Static Analysis, SCA, Dynamic Analysis, Container Security, and Veracode Risk Manager, with no OEM dependencies. * ASPM: Consolidated findings across code to cloud via Veracode Risk Manager. * Integrations: Broad CI/CD, IDE, and registry integration ecosystem. * Compliance: SOC 2 Type II certified, aligned with NIST SSDF, EU CRA, and Executive Order 14028. Softprom and Veracode. Softprom is the official distributor of Veracode. Its team helps enterprises deploy application risk management, software composition analysis, and supply chain security controls tailored to regulatory and business requirements. This content was prepared as part of the Softprom DistriFlow project - an automated system for monitoring and adapting vendor news. Original source: original article.

Softprom
Aug 4th, 2026
Veracode Marketplace 2026: curated AppSec integrations for the AI era.

Veracode Marketplace 2026: curated AppSec integrations for the AI era. News | 04.08.2026 Application security teams face a growing challenge: AI-generated code, agentic development environments, and expanding attack surfaces demand deeper contextual analysis than traditional static scanners can provide. Enterprises need a trusted way to extend their existing AppSec platform with specialized capabilities without adding procurement friction or fragmented workflows. A single, curated destination to discover, evaluate, and deploy elite security integrations on top of Veracode. What was announced. On July 30, 2026, Veracode announced the launch of the Veracode Marketplace, a curated ecosystem that provides customers with a single, trusted destination to discover, evaluate, and deploy third-party security integrations as an extension of the Veracode platform. The marketplace debuts with DryRun Security as its inaugural partner, delivering AI-native contextual analysis and verification to Veracode customers on day one. Every partner is vetted for technical depth, product quality, and workflow fit. Integrations are anchored to Veracode findings for a unified audit trail, and every purchase runs through a single procurement path on a single contract with a personalized support experience. Additional partners are scheduled to join throughout 2026. Application security has entered a new era, and no single vendor will solve it alone. Customers tell Softprom they want the depth and rigor of the Veracode platform, combined with the freedom to choose specialized capabilities that fit their tech stack Ajay Nigam, Chief Product Officer at Veracode Why this matters. For CIOs, CISOs, IT directors, and procurement leaders, the Veracode Marketplace addresses three critical pressures: the need to secure AI-generated code, the demand for verified risk prioritization over noisy findings, and the operational cost of managing multiple security vendors. By consolidating validated integrations under a single contract anchored to Veracode findings, enterprises reduce procurement overhead and gain a unified audit trail across their AppSec program. The inaugural partnership with DryRun Security is significant: DryRun already powers more than 500,000 code reviews per month and provides native integrations with modern AI coding tools including Claude Code, Cursor, Codex, GitHub, and GitLab. Combining Veracode's deterministic scanning with DryRun's AI-reasoning delivers unified, end-to-end coverage from detection to validated remediation. Technical details. * Curated ecosystem: vetted third-party integrations extending the Veracode platform. * Inaugural partner: DryRun Security, with AI-native Contextual Security Analysis engine. * Coverage expansion: intent-based and logic vulnerabilities missed by traditional static scanners. * Native integrations: Claude Code, Cursor, Codex, GitHub, GitLab, plus repository-wide DeepScans. * Scale: DryRun powers over 500,000 code reviews per month. * Procurement: single contract, unified audit trail, personalized support. * Availability: live today for Veracode customers, with additional partners in 2026. Application security teams are not asking for more findings - they are asking for better verification of which risks actually matter James Wickett, CEO and Co-Founder of DryRun Security Softprom and Veracode. Softprom is the official distributor of Veracode. Enterprise teams looking to adopt the Veracode Marketplace, integrate DryRun Security, or expand their AppSec program can request a consultation and demo through Softprom's certified specialists. This content was prepared as part of the Softprom DistriFlow project - an automated system for monitoring and adapting vendor news. Original source: original article.