Job Summary
The ServiceNow Analyst - Software Bill of Materials (SBOM) will support the management of software component inventories, third-party dependencies, and associated security risks within the ServiceNow platform. The role focuses on leveraging ServiceNow Security Management, Vulnerability Response, and Governance, Risk, and Compliance (GRC) capabilities to ingest, track, assess, and remediate risks associated with third-party software components. The analyst will collaborate with security, vulnerability management, application, and IT teams to maintain accurate SBOM data, support risk assessment, and improve software supply chain security.
Key Responsibilities
• Support the ingestion, tracking, and management of Software Bill of Materials (SBOM) data within ServiceNow.
• Use ServiceNow Security Management, Vulnerability Response, and GRC capabilities to identify and manage risks associated with third-party software components.
• Analyze software component inventories and dependency information to identify vulnerable or outdated components.
• Track vulnerability findings, remediation activities, risk status, and mitigation progress within ServiceNow.
• Collaborate with application owners, development teams, and security stakeholders to investigate and remediate third-party component risks.
• Maintain accurate SBOM records, software dependency information, and vulnerability-related data.
• Support vulnerability prioritization and remediation tracking based on security findings and organizational risk requirements.
• Assist with ServiceNow workflows, reporting, and dashboards related to SBOM management and software supply chain security.
• Coordinate with relevant teams to resolve data-quality issues, investigate findings, and monitor remediation progress.
• Document SBOM management procedures, vulnerability findings, remediation actions, and operational processes.
Required Qualifications
• Experience working with the ServiceNow platform, particularly Security Management, Vulnerability Response, or GRC modules.
• Understanding of Software Bill of Materials (SBOM), software components, third-party dependencies, and software supply chain security.
• Knowledge of vulnerability management processes, including identification, assessment, tracking, prioritization, and remediation.
• Ability to analyze software component and vulnerability data and maintain accurate records in ServiceNow.
• Strong analytical, problem-solving, documentation, and communication skills.
• Ability to collaborate with security, application, development, and IT teams to support risk remediation activities.
Preferred Qualifications
• Experience with SBOM formats and standards such as SPDX or CycloneDX.
• Familiarity with software composition analysis (SCA) tools and third-party dependency scanning.
• Experience with ServiceNow security workflows, vulnerability reporting, dashboards, and remediation tracking.
• Understanding of vulnerability identifiers and scoring systems, such as CVE and CVSS.
• Familiarity with software supply chain risk management and secure software development practices.
