Software Asset Management Analyst(SAM) with SBOM Exp.

Join our SAM team to lead day-to-day operations of our Software Bill of Materials (SBOM) program. Youll be the go-to person when a Log4j-style vulnerability hits or Legal needs a fast answer on open-source licensing backed by data.

What Youll Do

Collect validate and maintain SBOMs (CycloneDX/SPDX) for software we build and buy checking against NTIA Minimum Elements

Integrate SBOM generation into GitLab CI/CD pipelines and manage a versioned SBOM repository

Match components against license/entitlement records; flag risks across permissive copyleft and custom licenses

Support rapid vulnerability triage using NVD CISA KEV OSV and vendor VEX statements

Pull and normalize data from GitLab JFrog Artifactory ServiceNow SAM and Flexera

Advise Procurement and Legal on SBOM contract language aligned with EO 14028 NIST SSDF and EU Cyber Resilience Act

Contribute to broader SAM work: inventory license reconciliation compliance and unauthorized software remediation

What You Bring

5 years in SAM ITAM software licensing or software governance

Solid understanding of SBOMs open-source licensing (permissive vs. copyleft) and software supply chains

Comfort with package ecosystems (npm Maven PyPI NuGet) and transitive dependencies

Strong analytical and communication skills across technical and legal audiences

Nice to Have

ServiceNow SAM Flexera JFrog Artifactory or DejaCode experience

Hands-on with SCA tools: Black Duck Snyk Syft Trivy or OWASP Dependency-Track

Familiarity with CVE PURL CPE CVSS EPSS VEX formats

Required Skills:

SBOMNVD CISA KEV OSV and vendor VEX statements