Remote SAM & SBOM Analyst – Open-Source Licensing

Experis Technology Group; United States; Remoto; USD 85.000 - 121.000; Tempo pieno

Descrizione del lavoro

Experis Technology Group is seeking an Analyst - Software Asset Management (SAM) with a focus on SBOM to join our fully remote US team. The role supports inventory, licensing, compliance, and understanding what’s inside the software we build and buy, especially open-source components.

You’ll work with Application Development, DevSecOps, Enterprise Architecture, Legal, Procurement, Third-Party Risk, Cybersecurity, and vendors to ensure accurate SBOM data, license compliance, and fast risk

Competenze

• 3+ years in Software Asset Management, IT Asset Management, software licensing, software governance, or a closely related field.
• A solid grasp of SBOMs, software components, and how software supply chains work.
• Working knowledge of open-source licensing. You know the difference between permissive and copyleft licenses and what each one asks of the user.
• Comfort with dependencies, including transitive ones, package ecosystems like npm, Maven, PyPI, and NuGet, and container images.
• A good foundation in SAM concepts: lifecycle, discovery, normalization, licensing, entitlements, and compliance.
• Strong analytical skills. You enjoy reconciling inventory, usage, license, and entitlement data from sources that don’t always agree.
• Clear writing and speaking, especially when explaining technical, licensing, or security findings to developers, attorneys, and leadership.
• A collaborative style that works well across Technology, Cybersecurity, Procurement, Legal, Risk, and the business.

Mansioni

• Maintain and analyze SBOM program day to day: shape the process, set standards, and keep improving it.
• Collect and review SBOMs for software we build and buy. Check them against the NTIA Minimum Elements and look for gaps.
• Generate SBOMs automatically in GitLab CI/CD pipelines and maintain a versioned SBOM repository.
• Clean up and normalize component data and tie it back to applications, models, and publishers.
• Pull data from GitLab, JFrog Artifactory, ServiceNow SAM, Flexera - Technopedia/DejaCode to build a full picture of each product.
• Match SBOM components against license and entitlement records for compliance.
• When vulnerabilities arise, help determine exposure using NVD, CISA KEV, OSV, and vendor VEX statements.
• Collaborate with Procurement, Third-Party Risk, and Legal on SBOM language, formats, and update frequency.
• Find and fix data problems like missing fields or duplicates; build metrics and dashboards.

Conoscenze

SBOMs knowledge

Open-source licensing

Dependencies & ecosystems

SAM concepts

Data analysis

Communication

Collaboration

Strumenti

GitLab

JFrog Artifactory

ServiceNow SAM

Flexera

DejaCode

CycloneDX / SPDX

ScanCode Toolkit

Descrizione del lavoro

Experis Technology Group is seeking an Analyst - Software Asset Management (SAM) with a focus on SBOM to join our fully remote US team. The role supports inventory, licensing, compliance, and understanding what’s inside the software we build and buy, especially open-source components.

You’ll work with Application Development, DevSecOps, Enterprise Architecture, Legal, Procurement, Third-Party Risk, Cybersecurity, and vendors to ensure accurate SBOM data, license compliance, and fast risk