Responsible at the expert level for establishing and advancing the enterprise Open Source Program Office (OSPO) strategy, governance, and operating model. Serves as a senior individual contributor responsible for enabling the responsible use, management, and contribution of open-source software across the software development lifecycle. Works closely with engineering, Cyber Security, Legal, Risk, Enterprise Architecture, Procurement, platform, and business teams to strengthen open-source governance, software supply-chain transparency, license compliance, component lifecycle management, InnerSource, and developer enablement while coaching and influencing others.
Primary Responsibilities
- Lead the development, implementation, and continuous improvement of the enterprise Open Source Program Office strategy, governance framework, and operating model.
- Define standards, guardrails, processes, and guidance governing the consumption, modification, distribution, and contribution of open-source software.
- Establish a risk-based governance model that enables engineering teams to use open source efficiently while meeting enterprise technology, legal, regulatory, security, and risk requirements.
- Define clear ownership, decision rights, exception processes, and escalation paths for open-source-related matters across the organization.
- Serve as the primary OSPO partner to the Cyber Security team for open-source and software supply-chain security considerations.
- Work closely with Cyber Security to align open-source governance, developer workflows, component inventory, Software Bill of Materials (SBOM) capabilities, and lifecycle practices with enterprise cybersecurity policies and controls.
- Partner with Cyber Security on the adoption and integration of Software Composition Analysis (SCA) and related software supply-chain security capabilities within developer workflows and CI/CD pipelines.
- Provide open-source inventory, dependency, SBOM, component-health, ownership, and lifecycle information to support Cyber Security vulnerability management, incident response, and supply-chain risk processes.
- Collaborate with Cyber Security, platform teams, and application teams on approaches for high-risk, compromised, abandoned, deprecated, unsupported, or end-of-life open-source components.
- Ensure OSPO activities complement Cyber Security responsibilities and do not create a parallel security function.
- Partner with Legal to define enterprise standards for acceptable open-source licenses, license obligations, notices, attribution, approvals, and exceptions.
- Develop scalable workflows for license identification, review, approval, exception management, and compliance evidence.
- Provide practical guidance to engineering teams regarding permissive, reciprocal, restrictive, and other higher-risk open-source licensing models.
- Establish and mature the enterprise SBOM governance strategy in partnership with Cyber Security, Engineering, Architecture, and Technology Risk.
- Define requirements and standards for generating, storing, maintaining, exchanging, and consuming SBOMs across internally developed applications and technology platforms.
- Create and improve enterprise visibility into open-source components, direct and transitive dependencies, licenses, ownership, usage, and lifecycle status.
- Use SBOM and component information to support vulnerability response, dependency analysis, technology lifecycle management, architecture decisions, and software supply-chain transparency.
- Establish governance across the full lifecycle of open-source components, including introduction, approval, maintenance, upgrades, vulnerability remediation, replacement, and retirement.
- Define component-health criteria addressing security status, licensing, maintainership, community activity, release cadence, supportability, provenance, and end-of-life status.
- Develop strategies for critical open-source technologies where community support, commercial support, internally curated artifacts, maintained versions, or alternative components may be appropriate.
- Identify dependency concentration, systemic open-source exposure, and sustainability risks requiring cross-functional action or management escalation.
- Partner with Developer Experience, Platform Engineering, Cyber Security, and Enterprise Architecture teams to embed open-source governance into engineering workflows.
- Integrate open-source governance with source-code management, CI/CD platforms, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling.
- Drive automation of controls, evidence collection, policy checks, approvals, and developer feedback wherever practical.
- Promote trusted, curated, reusable, and well-supported open-source components, packages, patterns, and paved-road solutions.
- Establish and mature an enterprise InnerSource program that promotes reuse, collaboration, contribution, maintainership, and shared ownership across engineering teams.
- Define InnerSource standards for repository ownership, contribution models, documentation, code review, maintainership, community practices, and project health.
- Create governance and approval processes for employees contributing to external open-source projects and for internally developed software considered for open-source release.
- Build open-source awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement.
- Develop and communicate meaningful measures including open-source inventory coverage, SBOM coverage and quality, license compliance, exceptions, unsupported component exposure, dependency health, lifecycle risk, InnerSource participation, reuse, and external contribution activity.
- Partner with Cyber Security to communicate open-source vulnerability exposure, remediation trends, and software supply-chain risk without assuming ownership of Cyber Security controls or risk decisions.
- Translate complex open-source, licensing, dependency, and software supply-chain topics into clear business and technology risk narratives for technical and senior leadership stakeholders.
- Present OSPO strategy, metrics, risks, standards, and recommendations at architecture reviews, technical forums, governance committees, and leadership meetings.
- Serve as a key partner with engineering, Cyber Security, Legal, Risk, Architecture, Procurement, and platform teams to identify and implement continuous improvements spanning organizational boundaries.
- Mentor engineers and technology leaders on open-source governance, SBOM practices, component lifecycle management, InnerSource, contribution practices, and responsible software consumption.
- Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite.
- Identify open-source, licensing, operational, software supply-chain, and technology risks requiring escalation to management.
- Promote an environment that supports a culture of belonging and reflects the M&T Bank brand.
- Maintain M&T internal control standards, including timely implementation of internal and external audit findings and regulatory requirements as applicable.
- Complete other related duties as assigned.
Scope of Responsibilities
Supervisory/Managerial Responsibilities
No supervisory responsibilities. May provide technical leadership, mentorship, and guidance to engineers, product teams, governance forums, and cross-functional project teams.
Education and Experience Required
- A combined minimum of 9 years’ higher education and/or work experience, including a minimum of 4 years’ engineering and/or architecture experience and 3 years leadership experience
- Capable of working on multiple projects of a complex nature
- Proficiency with project management, word processing and spreadsheet applications
- A minimum of 7 years of experience in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or related technology disciplines or technology governance role
Core Requirements
- Strong experience with open-source software ecosystems, enterprise open-source governance, and modern software development practices.
- Demonstrated experience defining or implementing standards, governance models, engineering practices, or control frameworks across organizational boundaries.
- Strong understanding of software supply-chain concepts, including direct and transitive dependencies, package ecosystems, component provenance, artifact management, dependency health, and lifecycle risk.
- Experience with Software Composition Analysis (SCA), open-source inventory, vulnerability data, policy management, and remediation workflows.
- Knowledge of open-source licensing concepts, obligations, attribution requirements, reciprocal licensing, restrictive licensing, and license exception processes.
- Experience establishing or operating SBOM generation, storage, governance, quality, and consumption practices.
- Knowledge of SBOM standards and formats, including CycloneDX and SPDX.
- Experience integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows.
- Ability to partner effectively with Cyber Security while maintaining clear boundaries among OSPO governance, security ownership, and engineering remediation responsibilities.
- Ability to translate complex technical, legal, risk, and compliance considerations into practical engineering guidance and actionable decisions.
- Advanced verbal and written communication skills, including the ability to influence senior technical and business stakeholders.
Open Source Governance & Program Expertise
- Demonstrated experience developing or operating an Open Source Program Office or comparable enterprise open-source governance capability.
- Experience developing open-source policies, standards, approved-use models, exception processes, and cross-functional governance forums.
- Experience partnering with Legal on open-source license review, obligations, approvals, notices, attribution, and compliance evidence.
- Experience establishing component-health and lifecycle criteria for unsupported, abandoned, deprecated, or end-of-life software.
- Ability to assess maintainership, community activity, release cadence, supportability, licensing, provenance, and enterprise dependency risk.
- Experience creating metrics, dashboards, executive reporting, and risk narratives for open-source adoption and governance.
Engineering, Tooling & Platform Expertise
- Experience with enterprise development and software supply-chain platforms such as GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or comparable technologies.
- Knowledge of CI/CD, DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code approaches.
- Understanding of common package ecosystems such as npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages.
- Experience with cloud-native development, containers, Kubernetes, APIs, microservices, and modern application architectures.
- Ability to drive automation that provides timely, actionable governance feedback within engineering workflows.
- Experience promoting trusted components, curated artifacts, reusable patterns, and developer paved roads.
InnerSource & Contribution Practices
- Demonstrated knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, and community practices.
- Experience building engineering communities of practice and increasing reuse across teams.
- Knowledge of external open-source contribution processes, contributor agreements, intellectual-property considerations, and release governance.
- Ability to coach and influence engineers, maintainers, architects, and technology leaders without direct authority.
Education and Experience Preferred
- Experience establishing or leading an Open Source Program Office in a large enterprise.
- Experience supporting enterprise technology organizations in regulated environments, preferably financial services.
- Experience partnering with Cyber Security, Legal, Risk, Architecture, Procurement, and engineering organizations.
- Experience with the Linux Foundation, TODO Group, OpenChain, or comparable open-source governance communities and frameworks.
- Experience with software supply-chain standards or frameworks such as SLSA, OpenSSF guidance, or related practices.
- Experience with technology risk management, internal controls, regulatory examinations, or audit support.
- Strong analytical and problem-solving skills related to software dependencies, governance, licensing, and technology lifecycle risk.
- Experience working in Agile, DevOps, platform engineering, and product operating models.
- Ability to work autonomously and lead complex, enterprise-wide initiatives.
- Strong organizational and time management skills.
- Experience driving project milestones, adoption goals, and delivery commitments across multiple teams.
- Relevant industry certifications or professional education in open-source governance, software supply-chain security, cloud, application security, or technology risk preferred.
Location
Clanton, Alabama, United States of AmericaOriginally posted on