Lead, Open Source Program Office

🕒 vor 3 Tagen

🏈 Alabama – Remote

🏈 Alabama – Remote

💵 $116.400 - $194.000 / Jahr

⏰ Vollzeit

🟠 Senior

👻 Geisterscore 0%

Was es bedeutet: wie wahrscheinlich diese Stelle offen bleibt, ohne dass aktiv eingestellt wird.So liest du es: 60 % oder höher heißt, wir halten das für einen Geisterjob. Niedrigere Werte sind weniger bedenklich.Wie wir werten: Dauer offen, Neuveröffentlichungen, offene Stellen vs Teamgröße, wie schnell Stellen geschlossen werden, und ob ein Gehalt angegeben ist.Hinweis: eine Schätzung aus öffentlichen Daten, kein Urteil über das Unternehmen. Echte Stellen können hoch punkten, nutze es also als Hinweis, nicht als Fakt.

Jetzt Bewerben

Ähnliche Remote-Jobs finden

E-Mail-Benachrichtigung für neue Jobs einrichten

📊 Überprüfen Sie Ihre Lebenslauf-Bewertung für diese Stelle

Verbessern Sie Ihre Chancen auf ein Vorstellungsgespräch, indem Sie Ihre Lebenslauf-Bewertung vor der Bewerbung überprüfen.

Lebenslauf hochladen

M&T Bank

WebsiteLinkedInAlle Stellen

10.000+ Mitarbeiter

Gegründet 1856

🛡️ Versicherung

💼 Beratung

🏦 Bankwesen

Insurance • Consulting • Banking

Die M&T Bank ist eine führende regionale Finanzinstitution, die eine breite Palette von Bankdienstleistungen für private, geschäftliche und kommerzielle Kunden anbietet. Bekannt für ihre Kundenzufriedenheit im Mobile Banking, bietet die M&T Bank Produkte und Dienstleistungen wie Girokonten, Kreditkarten, Hypotheken, Privatkredite und Versicherungen an. Darüber hinaus bietet sie Finanzplanung durch Wilmington Advisors @ M&T. Die Bank engagiert sich stark in der Gemeinschaft, unterstützt lokale Unternehmen, multikulturelles Banking und Freiwilligenarbeit. Mit einem Fokus auf Cybersicherheit und digitalen Banklösungen bedient die M&T Bank ihre Kunden durch umfassende Online- und Mobile-Services.

Beschreibung

• Lead the development, implementation, and continuous improvement of the enterprise OSPO strategy, governance framework, and operating model • Define standards, guardrails, processes, and guidance for open-source consumption, modification, distribution, and contribution • Establish risk-based governance aligned with technology, legal, regulatory, security, and risk requirements • Define ownership, decision rights, exception processes, and escalation paths • Partner with Cyber Security on open-source and software supply-chain security, SBOMs, SCA, vulnerability management, incident response, and risk processes • Partner with Legal on open-source license standards, obligations, notices, attribution, approvals, exceptions, and compliance evidence • Establish and mature SBOM governance and lifecycle management for open-source components • Improve visibility into dependencies, licenses, ownership, usage, and lifecycle status • Establish component-health criteria and strategies for unsupported, abandoned, deprecated, or end-of-life components • Integrate governance into source-code management, CI/CD, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling • Drive automation of controls, evidence collection, policy checks, approvals, and developer feedback • Promote trusted, curated, reusable, and supported open-source components and paved-road solutions • Establish and mature an enterprise InnerSource program • Define InnerSource standards for ownership, contribution, documentation, code review, maintainership, and community practices • Govern employee contributions to external open-source projects and potential internal open-source releases • Build awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement • Develop metrics covering inventory, SBOMs, license compliance, exceptions, dependency health, lifecycle risk, InnerSource, reuse, and external contributions • Present strategy, metrics, risks, standards, and recommendations to architecture reviews, governance committees, and leadership • Mentor engineers and technology leaders • Identify and escalate open-source, licensing, operational, supply-chain, and technology risks • Maintain compliance with company risk, regulatory, internal control, audit, and brand standards • No supervisory responsibilities; provide technical leadership, mentorship, and cross-functional guidance

🎯 Anforderungen

• Minimum of 9 years’ combined higher education and/or work experience • Minimum of 4 years’ engineering and/or architecture experience • 3 years’ leadership experience • Minimum of 7 years’ experience in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or related disciplines • Ability to work on multiple complex projects • Proficiency with project management, word processing, and spreadsheet applications • Strong experience with open-source ecosystems, enterprise governance, and modern software development • Experience defining or implementing standards, governance models, engineering practices, or control frameworks across organizational boundaries • Understanding of software supply-chain concepts, dependencies, provenance, artifact management, dependency health, and lifecycle risk • Experience with SCA, open-source inventory, vulnerability data, policy management, and remediation workflows • Knowledge of open-source licensing concepts and license exception processes • Experience establishing or operating SBOM practices • Knowledge of CycloneDX and SPDX • Experience integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows • Ability to partner with Cyber Security while maintaining clear ownership boundaries • Ability to translate technical, legal, risk, and compliance considerations into engineering guidance • Advanced verbal and written communication skills • Experience developing or operating an OSPO or comparable governance capability • Experience developing open-source policies, standards, approved-use models, exception processes, and governance forums • Experience partnering with Legal on license review and compliance evidence • Experience establishing component-health and lifecycle criteria • Ability to assess maintainership, community activity, release cadence, supportability, licensing, provenance, and dependency risk • Experience creating metrics, dashboards, executive reporting, and risk narratives • Experience with GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or comparable technologies • Knowledge of CI/CD, DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code • Understanding of npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages • Experience with cloud-native development, containers, Kubernetes, APIs, microservices, and modern application architectures • Ability to drive automation within engineering workflows • Experience promoting trusted components, curated artifacts, reusable patterns, and developer paved roads • Knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, and community practices • Experience building engineering communities of practice and increasing reuse • Knowledge of external open-source contribution processes, contributor agreements, intellectual-property considerations, and release governance • Ability to coach and influence engineers, maintainers, architects, and technology leaders without direct authority • Preferred: experience leading an OSPO in a large enterprise • Preferred: experience in regulated environments, preferably financial services • Preferred: experience with Linux Foundation, TODO Group, OpenChain, or comparable communities • Preferred: experience with SLSA, OpenSSF guidance, or related practices • Preferred: experience with technology risk management, internal controls, regulatory examinations, or audit support • Preferred: relevant industry certifications or professional education