> Markdown version of [/jobs/ext/4326045-software-asset-management-analyst-sam-with-sbom-exp](https://www.wearedevelopers.com/jobs/ext/4326045-software-asset-management-analyst-sam-with-sbom-exp). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Software Asset Management Analyst(SAM) with SBOM Exp.

- **Company:** EApps Tech LLC
- **Location:** Raleigh, NC, United States
- **Experience:** Expert
- **Salary:** $104,000.0 - $124,800.0
- **Contract:** Permanent contract
- **Skills:** Python (Programming Language), Apache Maven, NuGet, Open Source Technology, Open Web Application Security, Software Asset Management, SQL Databases, Tripwire, Software Licensing, Flexera, Gitlab, Gitlab-ci, Npm(Software), Servicenow, Artifactory
- **Published:** October 28, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=f8cea92c9e9b9f6d

## About the Role

5+ years in SAM, ITAM, software licensing, or software governance

Solid understanding of SBOMs, open-source licensing (permissive vs. copyleft), and software supply chains

Comfort with package ecosystems (npm, Maven, PyPI, NuGet) and transitive dependencies

Strong analytical and communication skills across technical and legal audiences

Nice to Have

ServiceNow SAM, Flexera, JFrog Artifactory, or DejaCode experience

Hands-on with SCA tools: Black Duck, Snyk, Syft, Trivy, or OWASP Dependency-Track

Familiarity with CVE, PURL, CPE, CVSS, EPSS, VEX formats
Python, SQL, or jq scripting; CSAM or CIS-SAM certification

## Description

Collect, validate, and maintain SBOMs (CycloneDX/SPDX) for software we build and buy, checking against NTIA Minimum Elements

Integrate SBOM generation into GitLab CI/CD pipelines and manage a versioned SBOM repository

Match components against license/entitlement records; flag risks across permissive, copyleft, and custom licenses

Support rapid vulnerability triage using NVD, CISA KEV, OSV, and vendor VEX statements

Pull and normalize data from GitLab, JFrog Artifactory, ServiceNow SAM, and Flexera

Advise Procurement and Legal on SBOM contract language aligned with EO 14028, NIST SSDF, and EU Cyber Resilience Act

Contribute to broader SAM work: inventory, license reconciliation, compliance, and unauthorized software remediation