Bruce Jenkins

As of December 2024, Bruce Jenkins was the chief information security officer of Black Duck Software. He was promoted internally to the role, which the company announced on December 19, 2024.

SecurityWeek's industry moves column for the week of December 16, 2024 also reported the appointment and noted that he had been promoted from within.

Career path

Jenkins is an Air Force veteran.

Black Duck's announcement traces his work as a cybersecurity evangelist to a 2005 systems breach in which identifying information on 33,000 military officers was stolen.

Black Duck credits him with nearly 25 years of expertise across physical, IT and software security.

At Micro Focus, he led product security strategy, policy and best practices.

He then moved to the Synopsys Software Integrity Group. There he oversaw internal product security, incident response, and risk and compliance strategy, and he kept that remit as the group transitioned into the newly established Black Duck.

Black Duck became an independent company after Clearlake Capital Group and Francisco Partners acquired the Synopsys Software Integrity Group.

In December 2024, he was promoted internally to CISO.

Remit and outside roles

As CISO, Jenkins was given responsibility for every aspect of Black Duck's cybersecurity program and strategy. That scope covers on-premise products, cloud solutions, IT infrastructure and the supply chain.

At the time of the announcement, he was co-chair of the National Defense Industrial Association Cyber Supply Chain Committee.

In his appointment statement, Jenkins said the common thread in his work is trust. He tied it to his team, the company, the industry and commitments to customers.

He described his main priority this way: "My primary focus is on taking a pragmatic path to the development and delivery of resilient, secure-by-design solutions that maintain the safety, reliability, and security of our business operations, and earning the trust of our customers."

Public commentary

Jenkins appeared in Dark Reading's Heard it From a CISO video series. In that interview with associate editor Kristina Beek, he discussed his move from military service into cybersecurity.

SecureWorld has quoted him on security budgets. He argued that the effectiveness of a cybersecurity program does not fundamentally depend on budget size. In his view, a larger budget can pay for sophisticated tools and dedicated staff, but the core measures of effectiveness stay the same.

He added that an effective program should produce visible business benefits, such as greater customer trust and higher renewal rates. He also said that showing clear business value is how security leaders justify investment to executives and the board.

SecureWorld also carried his reaction to a national cyber strategy issued by the Trump administration. He welcomed its practitioner-oriented emphasis on operational effect over compliance for its own sake. He called its focus on modernizing federal systems with zero trust, post-quantum cryptography and AI-enabled defense directionally appropriate.

He identified execution as the real test. In his view, the strategy's pillars need to become clear requirements, faster procurement and measurable risk reduction across government and the defense industrial base.