Job Summary
The Software Asset Management Analyst - SBOM will lead the day-to-day execution and continuous improvement of the Software Bill of Materials (SBOM) program while supporting broader Software Asset Management (SAM) activities, including software inventory, licensing, compliance, and unauthorized software remediation. This role focuses on understanding software components, open-source dependencies, licensing obligations, and security risks across internally developed and purchased applications. The analyst will collaborate with Application Development, DevSecOps, Enterprise Architecture, Legal, Procurement, Third-Party Risk, Cybersecurity, and software vendors to maintain accurate software component data, improve supply chain transparency, support vulnerability assessments, and ensure compliance with applicable policies and standards.
Key Responsibilities
• Manage the day-to-day SBOM program, including process development, standards, and continuous improvement.
• Collect and review SBOMs for internally developed and purchased software, validating them against NTIA Minimum Elements and identifying gaps such as missing transitive dependencies, component hashes, or SBOM type information.
• Collaborate with developers and DevSecOps teams to automate SBOM generation within GitLab CI/CD pipelines and maintain a version-controlled SBOM repository for release traceability.
• Clean, normalize, and reconcile component data, including suppliers, versions, dependencies, and identifiers such as PURL, CPE, and SWID, and associate components with the correct applications, software models, and publishers.
• Integrate data from GitLab, JFrog Artifactory, ServiceNow SAM, and Flexera Technopedia/DejaCode to establish a comprehensive view of software products and their components.
• Reconcile SBOM components with license and entitlement records to identify licensing obligations, risks, and compliance gaps.
• Support Cybersecurity teams in assessing exposure to newly disclosed vulnerabilities using sources such as NVD, CISA KEV, OSV, and vendor VEX statements.
• Collaborate with Procurement, Third-Party Risk, and Legal to define vendor SBOM requirements, including contract language, formats, and update frequency, aligned with EO 14028, NIST SSDF (SP 800-218), and the EU Cyber Resilience Act.
• Identify and resolve data quality issues, including missing fields, duplicate components, and inconsistent naming.
• Develop metrics, dashboards, procedures, audit evidence, and automation opportunities to measure and improve program performance.
• Maintain the open-source software policy and approval process, including approved, restricted, and prohibited licenses.
• Identify open-source licenses using SPDX identifiers and assess permissive, weak copyleft, strong copyleft, network copyleft, source-available, and custom license terms.
• Evaluate license obligations based on component usage, including internal use, SaaS offerings, and distributed software.
• Identify and escalate complex licensing cases, including missing or conflicting licenses, license changes between versions, and code snippets copied from open-source projects, and document decisions with Legal.
• Prepare license notice files, attribution materials, and source code offers for distributed software.
• Monitor open-source project health, including abandoned or end-of-life projects, typosquatting, malicious packages, and questionable provenance, and guide teams toward curated sources in JFrog Artifactory.
• Use DejaCode and ScanCode Toolkit to maintain accurate license data and help developers interpret open-source policy requirements.
• Maintain and analyze software inventory, installation, license, contract, and entitlement data.
• Review software discovery results and normalize publisher, product, version, and edition information.
• Support license reconciliation, identify compliance gaps and overspending, and maintain software models, entitlements, license metrics, product use rights, and subscriptions.
• Research licensing models and end-of-life and end-of-support dates, including commercial subscriptions for open-source-based products such as Red Hat and Oracle Java versus OpenJDK.
• Manage unauthorized software remediation by validating approval status, coordinating with software owners, and tracking remediation through closure.
• Support audits, license reviews, compliance assessments, software asset information requests, SAM controls, reporting, metrics, audit evidence, and continuous improvement initiatives.
Required Qualifications
• 3+ years of experience in Software Asset Management, IT Asset Management, software licensing, software governance, or a closely related field.
• Solid understanding of SBOMs, software components, and software supply chain concepts.
• Working knowledge of open-source licensing, including the differences between permissive and copyleft licenses and their associated obligations.
• Familiarity with software dependencies, including transitive dependencies, package ecosystems such as npm, Maven, PyPI, and NuGet, and container images.
• Strong foundation in SAM concepts, including software lifecycle management, discovery, normalization, licensing, entitlements, and compliance.
• Strong analytical skills and experience reconciling inventory, usage, licensing, and entitlement data across multiple sources.
• Clear written and verbal communication skills, with the ability to explain technical, licensing, and security findings to developers, attorneys, and leadership.
• Ability to collaborate effectively with Technology, Cybersecurity, Procurement, Legal, Risk, and business teams.
Preferred Qualifications
• Experience with ServiceNow SAM, including normalization, reconciliation, software models, and entitlements, as well as Flexera.
• Experience using GitLab and JFrog Artifactory to trace software packages, components, and dependencies.
• Familiarity with Technopedia's DejaCode Open-Source Content Pack.
• Hands-on experience with CycloneDX and SPDX, including reading, validating, comparing, and converting SBOMs.
• Familiarity with CVE, CPE, PURL, SWID, CVSS, EPSS, and VEX formats, including CSAF, CycloneDX VEX, and OpenVEX.
• Experience with Software Composition Analysis (SCA) and SBOM tools such as Black Duck, Snyk, JFrog Xray, OWASP Dependency-Track, ScanCode Toolkit, Syft, or Trivy.
• Knowledge of EO 14028, NIST SSDF, SLSA, OpenSSF Scorecard, OpenChain, and the EU Cyber Resilience Act.
• Scripting experience with Python, SQL, jq, or REST APIs.
• Certifications such as ServiceNow CIS-SAM or IAITAM CSAM are a plus.
