M

Manifest

Automates SBOM generation and risk assessment

Federal Civilian Account Executive

Full-Time
$140k - $175k
Senior, Expert
Remote in USA
RemotePreference for candidates residing in the DMV area; travel to clients as needed.
Sales & Account ManagementAccount Executive

About the job

Requirements
  • At least 8 years of enterprise software sales experience, including meaningful federal civilian-sector experience, a record of carrying and meeting a federal quota, and experience selling technical security software from first contact through award.
  • Working knowledge of software supply chain risk, Software Bill of Materials (SBOM), vulnerability management, and compliance, with the ability to conduct technical discovery calls independently.
  • Direct experience closing through Government-Wide Acquisition Contracts (GWACs) and schedules, working with resellers and distributors, and building sole-source justifications.
  • A track record of sourcing pipeline and building a territory independently without Business Development Representative support, preferably at an early-stage vendor, with specific accounts opened personally.
  • Demonstrated ability to work concurrently with program offices, Chief Information Security Officer (CISO) and Chief Information Officer (CIO) organizations, and contracting teams, distinguishing influence from purchasing authority.
  • Experience selling through Federal Risk and Authorization Management Program (FedRAMP) status questions and Authority to Operate (ATO) processes, and setting realistic timelines around these processes.
  • Disciplined pipeline management and accurate forecasting.
  • Experience using artificial intelligence in account research, call preparation, and drafting responses, with sound judgment before sending work to customers.
  • Ability to own outcomes end-to-end in an intense, resource-constrained environment.
Responsibilities
  • Carry and deliver an annual sales quota, and source the majority of pipeline through direct outbound, agency events, partner introductions, and an existing network; maintain prospecting as a weekly discipline alongside bookings.
  • Build and maintain a written federal civilian territory account plan covering target agencies, component-level entry points, incumbent tools, and funded programs where supply chain security is a requirement.
  • Own the path to contract across GSA MAS, NASA SEWP, and CIO-SP; work through resellers and distributors, including Carahsoft; determine when sole source is defensible and develop the customer justification; manage RFI and RFP responses end-to-end; and plan around end-of-fiscal-year buying cycles.
  • Map and engage the full buying committee, including program offices, CISO and CIO organizations, and contracting officers; distinguish technical champions from those able to commit funds, build relationships with both, and document missing stakeholders.
  • Account for FedRAMP status, ATO timelines, and agency-specific security reviews in deal planning; set customer and internal expectations; and translate EO 14028, OMB software security memoranda, and CISA SBOM guidance into a defensible program-office business case.
  • Work with sales engineering to scope pilots and evaluations, marketing on agency campaigns and events, and the Chief Revenue Officer on deal strategy and pricing; involve partners early.
  • Share unmet requirements, competitive gaps, procurement friction, and deal-stalling factors with product and federal sales leadership in an actionable form.
  • Maintain accurate and current customer relationship management records, including next steps, close dates, and defensible stage rationales; forecast within a tight band and proactively flag likely delays.
Desired Qualifications
  • Existing relationships in civilian agencies where software supply chain security is a funded priority.
  • Experience as the first or earliest federal seller at a startup before an acquisition vehicle or past performance existed.
  • Familiarity with SBOM, AIBOM, EO 14028, OMB software security memoranda, and FDA premarket cybersecurity requirements.
  • Prior work with Carahsoft or comparable federal distribution partners.
  • Capture-style experience shaping requirements before a solicitation is released.

About the company

Manifest Cyber provides a platform for SBOM management that strengthens software supply chain security for large enterprises. It automatically generates SBOMs, including third-party and open-source components, with zero-click generation and secure storage. The platform detects vulnerabilities, assesses third-party risk, and supports regulatory compliance, offering enriched data to prioritize fixes. Its goal is to help customers quickly respond to threats and improve overall cybersecurity posture by simplifying SBOM generation, storage, and action.

Company Size

11-50

Company Stage

Series A

Total Funding

$21M

Headquarters

Westport, Connecticut

Founded

2022

Get referred to Manifest

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • 2026 launches added AI exposure analysis, Foreign Risk, and product hierarchy before Black Hat.
  • Carahsoft distribution opens NASA, SEWP V, and ITES-SW2 public-sector procurement channels.
  • Greg Armor's CRO hire signals aggressive expansion across federal, automotive, healthcare, and manufacturing buyers.

What critics are saying

  • $15 million Series A limits runway against better-funded rivals like Snyk and Wiz.
  • Foreign Risk depends on noisy OSINT; false positives can stall enterprise procurement cycles.
  • If FedRAMP or defense demand slows, Manifest becomes a niche compliance tool with weak retention.

What makes Manifest unique

  • FedRAMP High authorization through Palantir FedStart blocks many federal buyers.
  • Manifest Foreign Risk turns contributor provenance into auditable SBOM evidence for defense customers.
  • C/C++ SBOM generation covers embedded systems competitors ignore, especially vehicles and medical devices.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Health Insurance
  • Dental Insurance
  • Vision Insurance
  • Unlimited Paid Time Off
  • Remote Work Options
  • 401(k) Retirement Plan
  • Stock Options

Growth & Insights and Company News

Headcount

6 month growth

-2%

1 year growth

0%

2 year growth

0%
Manifest Cyber
Sep 28th, 2026
The hardest open-source risk to fix is the codeyou cannot rebuild.

The hardest open-source risk to fix is the codeyou cannot rebuild. September 28, 2026 Manifest Cyber has joined Athena, the Chainguard-led coalition for the orchestrated defense of open-source software. Manifest Cyber, Inc. is excited to join a powerhouse program with companies like JPMorganChase, Morgan Stanley, Cisco, Cloudflare, and Akamai. After two years at Chainguard building hardened containers, I know that product well. I also know the story customers tell Manifest Cyber, Inc. every day. A vulnerability lands in third-party software they cannot update themselves, and they have to find where it sits in what they ship. That is where Manifest helps, and it is what Manifest Cyber, Inc. bring to Athena. Why Manifest Cyber, Inc. care. I worked on the whole image catalog, Custom Assembly, the Guardener, and improving software bills of materials (SBOMs). A rebuilt, minimal, current artifact is the best answer to a vulnerability anyone has shipped. When a customer could take the rebuild, the problem went away, usually before anyone opened a ticket. What about a hospital security team? What about their infusion pumps, imaging workstations, and the building management controllers in the basement? No upstream release to pull, usually no source to read, and a vendor who might answer next quarter. This team isn't out of options. Isolate the device. Put a control in front of it. Push the vendor for a straight answer. But, each one starts with knowing which box the component is in, and finding that box is the work Manifest does. What happens when the fix is unreachable. A fix does not reach every system running the code. Athena accounts for that, which is why the coalition has partners like Manifest Cyber, Inc. in it. Naming the box sounds easy. It is not. Most teams I have worked with need weeks, because the answer is split across scanners that each see one slice and none of them read the vendor binaries. Three things Manifest Cyber, Inc. do with an Athena record, in order. * Start with the software members bought. When a vendor will not or cannot say what is inside a product, Manifest Cyber, Inc. work from the shipped binary. No source required. Manifest Cyber, Inc. name the appliance, device, or application that carries the component, and Manifest Cyber, Inc. keep that analysis, so the next record starts from what Manifest Cyber, Inc. already know. * Narrow the list where the code is available. For applications written in Python, JavaScript, and Go, reachability tells you whether the application calls the vulnerable code. A finding in a dependency nothing ever calls is not where an embargo week should go. * Support the decision during the embargo. Which product to isolate, which compensating control applies, which deployment to hold. With evidence behind each call, because there is no public advisory to point at when someone asks why you pulled a device out of service. Most third-party risk programs run on questionnaires that tell you what a supplier said last year. Manifest Cyber, Inc. recheck supplier software as new findings arrive, and Manifest Cyber, Inc. flag foreign ownership, control, and influence exposure across contributors and suppliers. Why a coalition. Do not build what you can buy unless it is core business value. Nobody's core business value is privately forking the same library that 11 other companies are also forking, badly, with no shared record of what got fixed. Athena is the alternative, and Manifest Cyber, Inc. tell members where the risk sits inside the third-party software they run. Athena is finding vulnerabilities in packages more than five years old, mature code that survived years of expert review. Those packages are not only in containers. Some sit inside a box in a hospital basement. Somebody has to open that box, and that is why Manifest Cyber, Inc. joined. Interested in learning more? Send an email to Manifest Cyber, Inc. at [email protected]. "Manifest knows the AIBOM and cybersecurity space, sees the problems arising, and always has a solution to showcase." Manager of Global Technology Legal Compliance, Multinational Software Company Secure your software supply chain today.

Associated Press
Jul 28th, 2026
Manifest Cyber launches AI-powered risk analysis and foreign influence detection for software supply chains

Manifest Cyber has launched three new capabilities for its software and AI supply chain security platform ahead of Black Hat USA 2026. The Manifest Insights Agent (MIA) uses AI to analyse blast radius against an organisation's software inventory in seconds. Foreign Risk identifies open source contributors linked to sanctioned nations or state-controlled institutions, using a database of 20 billion foreign risk records across 18 categories. Product Hierarchy provides drill-down visibility from mission system to component level, with automated risk rollup at each layer. The releases address regulatory shifts towards product-level accountability, including FOCI requirements for unclassified defence contracts over $5 million and Bureau of Industry and Security rules on connected vehicles. CEO Daniel Bardenstein said the updates close gaps in turning risk detection into actionable answers during incidents, product shipping, and regulatory queries.

Manifest Cyber
Jun 4th, 2026
Introducing manifestforeign risk.

Introducing manifestforeign risk. Kayleen Standridge June 4, 2026 Know who wrote the code in your software. Today, Manifest is launching Manifest Foreign Risk, a new generally available capability that gives security teams contributor-level visibility into the open source components inside their software. For the first time, organizations can systematically identify whether open source contributors are affiliated with sanctioned nations, foreign military organizations, intelligence agencies, or state-controlled institutions, and act on that information before software ships. Why Manifest built this. Government, defense, and enterprise customers have been asking Manifest the same question for years: how do Manifest know there is no foreign influence in the software Manifest build and buy? Until now, there was no good answer. Security teams could tell you what was in their software. They could tell you which components had known vulnerabilities, which licenses applied, and which vendors had passed a questionnaire. What they could not tell you was who wrote the code? Where those contributors were based. Who employed them? What institutions appeared in their professional history? That is the gap Manifest Foreign Risk closes. Why this matters. This launch is not happening in a vacuum. The regulatory environment has shifted in ways that make contributor provenance a business-critical concern, not just a security nicety. In May 2024, DoW issued Instruction 5205.87, extending Foreign Ownership, Control, or Influence (FOCI) requirements to any company holding unclassified DoW contracts over $5M. What was once limited to cleared contractors and classified programs now applies across a much broader slice of the defense industrial base, including commercial software vendors who have never considered FOCI their problem. DoW now has explicit authority to cancel contracts or require mitigation if FOCI is found. As Manifest explored in past blogs, this is part of a broader shift in how governments are thinking about software risk. It is no longer purely about vulnerabilities. It is about control, authorship, and provenance. Defense is not the only sector feeling this pressure. The BIS Connected Vehicles rule,, prohibits vehicles containing software tied to Chinese or Russian ownership or control starting in Model Year 2027. The pattern is clear. Regulators across sectors are deciding that knowing what is in your software is no longer enough. You need to know who shaped it. What Manifest Foreign Risk does. Manifest Foreign Risk analyzes the contributors behind open source components in any software bill of materials (SBOM). It draws on a database of 20 billion foreign risk records across 18 risk categories, including government affiliation, military ties, security and intelligence associations, defense university connections, restricted entity links, and more. All sourced from public records, corporate filings, sanctions lists, and open source intelligence (OSINT). Every contributor surfaces with one of three risk signals. Banned Country. Commit metadata, residency, or organizational affiliation places this contributor in a country on your prohibited list. Institution Association. The contributor or their employer is institutionally linked to a foreign military, intelligence agency, or state-controlled lab. Unknown. The identity cannot be verified. Anonymized email, throwaway handle, or insufficient public footprint, flagged for human review before release. The capability is policy-driven. Every risk category can be enabled or disabled based on your organization's requirements. Findings are configurable to your thresholds, exportable as evidence, and traceable to a specific author or library. Who this is for. Manifest Foreign Risk is built for the teams that own software supply chain risk in practice. AppSec and product security teams can treat contributor flags the way they treat CVEs: severity, owner, review date, and a gate on future introductions. TPRM teams can surface findings in vendor assessments and require written responses that create accountability and an audit trail. GRC teams can map findings to NIST 800-53 SR-3 and SR-4 controls, support Cybersecurity Maturity Model Certification (CMMC) documentation requirements, and build a board-reportable metric from quarterly re-runs. For all three, the immediate value is the same: evidence you can bring to a program office, contracting officer, or auditor. Not a score. Not a report. A documented finding with a name, a source, and a severity behind it. What comes next. Manifest Foreign Risk is available now as part of The Manifest Platform. CVEs get triaged. Licenses get reviewed. Vendors get questionnaires. The contributor behind the code has been the missing piece. That changes today. "Manifest knows the AIBOM and cybersecurity space, sees the problems arising, and always has a solution to showcase." Manager of Global Technology Legal Compliance, Multinational Software Company Secure your software supply chain today.

PR Newswire
Mar 12th, 2026
Manifest launches C/C++ SBOM generator to close critical supply chain security gaps

Manifest, a software and AI supply chain security platform, has launched an SBOM generator for C and C++ programming languages, addressing long-standing visibility gaps in critical systems. The tool enables teams to generate, inventory and scan accurate software bills of materials for C/C++ code, which underpins vehicles, medical devices, defence platforms and industrial equipment. The generator provides visibility into low-level components, accelerates vulnerability response, and helps organisations meet regulatory requirements in sectors like medical devices. Manifest is also introducing enhancements including automated vulnerability mapping for Nix packages, binary analysis for third-party risk mitigation, and continuous AI model scanning. Founded in Washington, Manifest serves organisations across defence, healthcare, automotive and other regulated industries requiring software supply chain transparency and compliance.

PR Newswire
Feb 18th, 2026
Manifest appoints Greg Armor as CRO to scale global go-to-market strategy

Manifest, a platform for software and AI supply chain security, has appointed Greg Armor as chief revenue officer. Armor will lead global sales, revenue operations, partnerships and customer expansion as the company scales across commercial and public sectors. Armor brings 25 years of go-to-market leadership in cybersecurity. He previously served as CRO at Sycurio, where he transformed the company's go-to-market strategy, and held leadership positions at Appdome, Gryphon.ai and BitSight. At Manifest, Armor will focus on driving operational adoption, scaling revenue through integrated risk management, and strengthening ecosystem adoption across regulated sectors including federal, automotive, defence, healthcare, manufacturing and financial services. The appointment reflects Manifest's growth as software and AI supply chain risk becomes a board-level priority for organisations.