Software Asset Management Analyst SBOM

Key Responsibilities
Manage the day-to-day SBOM program, including process development, standards, and continuous improvement
Collect and review SBOMs for internally developed and purchased software, validating them against NTIA Minimum Elements and identifying gaps such as missing transitive dependencies, component hashes, or SBOM type information
Collaborate with developers and DevSecOps teams to automate SBOM generation within GitLab CI/CD pipelines and maintain a version-controlled SBOM repository for release traceability
Clean, normalize, and reconcile component data, including suppliers, versions, dependencies, and identifiers such as PURL, CPE, and SWID, and associate components with the correct applications, software models, and publishers
Integrate data from GitLab, JFrog Artifactory, ServiceNow SAM, and Flexera Technopedia/DejaCode to establish a comprehensive view of software products and their components
Reconcile SBOM components with license and entitlement records to identify licensing obligations, risks, and compliance gaps
Support Cybersecurity teams in assessing exposure to newly disclosed vulnerabilities using sources such as NVD, CISA KEV, OSV, and vendor VEX statements
Collaborate with Procurement, Third-Party Risk, and Legal to define vendor SBOM requirements, including contract language, formats, and update frequency, aligned with EO 14028, NIST SSDF (SP 800-218), and the EU Cyber Resilience Act
Identify and resolve data quality issues, including missing fields, duplicate components, and inconsistent naming
Develop metrics, dashboards, procedures, audit evidence, and automation opportunities to measure and improve program performance
Maintain the open-source software policy and approval process, including approved, restricted, and prohibited licenses
Identify open-source licenses using SPDX identifiers and assess permissive, weak copyleft, strong copyleft, network copyleft, source-available, and custom license terms
Evaluate license obligations based on component usage, including internal use, SaaS offerings, and distributed software
Identify and escalate complex licensing cases, including missing or conflicting licenses, license changes between versions, and code snippets copied from open-source projects, and document decisions with Legal
Prepare license notice files, attribution materials, and source code offers for distributed software
Monitor open-source project health, including abandoned or end-of-life projects, typosquatting, malicious packages, and questionable provenance, and guide teams toward curated sources in JFrog Artifactory
Use DejaCode and ScanCode Toolkit to maintain accurate license data and help developers interpret open-source policy requirements
Maintain and analyze software inventory, installation, license, contract, and entitlement data
Review software discovery results and normalize publisher, product, version, and edition information
Support license reconciliation, identify compliance gaps and overspending, and maintain software models, entitlements, license metrics, product use rights, and subscriptions
Research licensing models and end-of-life and end-of-support dates, including commercial subscriptions for open-source-based products such as Red Hat and Oracle Java versus OpenJDK
Manage unauthorized software remediation by validating approval status, coordinating with software owners, and tracking remediation through closure
Support audits, license reviews, compliance assessments, software asset information requests, SAM controls, reporting, metrics, audit evidence, and continuous improvement initiatives

Required Qualifications
3+ years of experience
Bachelor's Degree
ServiceNow CIS-SAM
IAITAM CSAM

Skills
ServiceNow SAM
Flexera
GitLab
JFrog Artifactory
DejaCode
CycloneDX and SPDX
Software Composition Analysis (SCA) Tools
Vulnerability Intelligence Formats
Software Supply Chain Security Frameworks
Scripting
Package Ecosystems and Dependencies
Software Asset Management
Software Licensing and Compliance
Open Source Licensing Analysis
SBOM Program Management
Software Supply Chain Governance
Data Quality and Reconciliation
Unauthorized Software Remediation
Audit Support and Compliance Assessments
Stakeholder Communication
Cross-functional Collaboration
Vendor SBOM Requirements Definition
Metrics and Dashboard Development

Schedule
Start date: 2026-11-09