Software Asset Management Analyst – SBOM
ConfidentialJoin our SAM team to lead day-to-day operations of our Software Bill of Materials (SBOM) program. You’ll be the go-to person when a Log4j-style vulnerability hits or Legal needs a fast answer on open-source licensing — backed by data. What You’ll Do Collect, validate, and maintain SBOMs (CycloneDX/SPDX) for software we build and buy, checking against NTIA Minimum Elements Integrate SBOM generation into GitLab CI/CD pipelines and manage a versioned SBOM repository Match components against license/entitlement records; flag risks across permissive, copyleft, and custom licenses Support rapid vulnerability triage using NVD, CISA KEV, OSV, and vendor VEX statements Pull and normalize data from GitLab, JFrog Artifactory, ServiceNow SAM, and Flexera Advise Procurement and Legal on SBOM contract language aligned with EO 14028, NIST SSDF, and EU Cyber Resilience Act Contribute to broader SAM work: inventory, license reconciliation, compliance, and unauthorized software remediation What You Bring 5+ years in SAM, ITAM, software licensing, or software governance Solid understanding of SBOMs, open-source licensing (permissive vs. copyleft), and software supply chains Comfort with package ecosystems (npm, Maven, PyPI, NuGet) and transitive dependencies Strong analytical and communication skills across technical and legal audiences Nice to Have ServiceNow SAM, Flexera, JFrog Artifactory, or DejaCode experience Hands-on with SCA tools: Black Duck, Snyk, Syft, Trivy, or OWASP Dependency-Track Familiarity with CVE, PURL, CPE, CVSS, EPSS, VEX formats Python, SQL, or jq scripting; CSAM or CIS-SAM certification Pay: $55.00 - $65.00 per hour Expected hours: 40.0 per week Work Location: Hybrid remote in Morrisville, NC 27560