Software Asset Management Analyst(SAM) with SBOM Exp.

Collect, validate, and maintain SBOMs (CycloneDX/SPDX) for software we build and buy, checking against NTIA Minimum Elements

Integrate SBOM generation into GitLab CI/CD pipelines and manage a versioned SBOM repository

Match components against license/entitlement records; flag risks across permissive, copyleft, and custom licenses

Support rapid vulnerability triage using NVD, CISA KEV, OSV, and vendor VEX statements

Pull and normalize data from GitLab, JFrog Artifactory, ServiceNow SAM, and Flexera

Advise Procurement and Legal on SBOM contract language aligned with EO 14028, NIST SSDF, and EU Cyber Resilience Act

Contribute to broader SAM work: inventory, license reconciliation, compliance, and unauthorized software remediation

5+ years in SAM, ITAM, software licensing, or software governance

Solid understanding of SBOMs, open-source licensing (permissive vs. copyleft), and software supply chains

Comfort with package ecosystems (npm, Maven, PyPI, NuGet) and transitive dependencies

Strong analytical and communication skills across technical and legal audiences

Nice to Have

ServiceNow SAM, Flexera, JFrog Artifactory, or DejaCode experience

Hands-on with SCA tools: Black Duck, Snyk, Syft, Trivy, or OWASP Dependency-Track

Familiarity with CVE, PURL, CPE, CVSS, EPSS, VEX formats Python, SQL, or jq scripting; CSAM or CIS-SAM certification