Lead, Open Source Program Office

🕒 il y a 3 jours

🏈 Alabama – Distant

🏈 Alabama – Remote

💵 $116 400 - $194 000 / an

⏰ Temps Plein

🟠 Senior

👻 Score fantôme 0%

Ce que ça veut dire : la probabilité que cette offre reste ouverte sans recrutement actif.Comment le lire : 60 % ou plus, on pense que c'est une offre fantôme. Un score plus bas est moins inquiétant.Comment on la calcule : ancienneté, republications, postes ouverts vs taille de l'équipe, rapidité de clôture, et si le salaire est indiqué.À noter : une estimation à partir de données publiques, pas un jugement sur l'entreprise. De vraies offres peuvent avoir un score élevé, alors prenez-le comme un indice, pas comme un fait.

Postuler Maintenant

Trouver des Emplois à Distance Similaires

Configurer une alerte email pour les nouveaux emplois

📊 Vérifiez votre score de CV pour ce poste

Améliorez vos chances d'obtenir un entretien en vérifiant votre score de CV avant de postuler.

Télécharger le CV

M&T Bank

Site WebLinkedInTous les Emplois

10 000+ employés

Fondée en 1856

🛡️ Assurance

💼 Conseil

🏦 Banque

Insurance • Consulting • Banking

M&T Bank est une institution financière régionale de premier plan offrant une large gamme de services bancaires aux clients particuliers, professionnels et commerciaux. Réputée pour la satisfaction de ses clients en matière de banque mobile, M&T Bank propose des produits et services tels que des comptes courants, des cartes de crédit, des hypothèques, des prêts personnels et des assurances. De plus, elle offre des services de planification financière via Wilmington Advisors @ M&T. La banque s'engage dans l'engagement communautaire, soutenant les entreprises locales, la banque multiculturelle et le bénévolat. Avec un accent sur la cybersécurité et les solutions bancaires numériques, M&T Bank dessert sa clientèle grâce à des services en ligne et mobiles complets.

Description

• Lead the development, implementation, and continuous improvement of the enterprise OSPO strategy, governance framework, and operating model • Define standards, guardrails, processes, and guidance for open-source consumption, modification, distribution, and contribution • Establish risk-based governance aligned with technology, legal, regulatory, security, and risk requirements • Define ownership, decision rights, exception processes, and escalation paths • Partner with Cyber Security on open-source and software supply-chain security, SBOMs, SCA, vulnerability management, incident response, and risk processes • Partner with Legal on open-source license standards, obligations, notices, attribution, approvals, exceptions, and compliance evidence • Establish and mature SBOM governance and lifecycle management for open-source components • Improve visibility into dependencies, licenses, ownership, usage, and lifecycle status • Establish component-health criteria and strategies for unsupported, abandoned, deprecated, or end-of-life components • Integrate governance into source-code management, CI/CD, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling • Drive automation of controls, evidence collection, policy checks, approvals, and developer feedback • Promote trusted, curated, reusable, and supported open-source components and paved-road solutions • Establish and mature an enterprise InnerSource program • Define InnerSource standards for ownership, contribution, documentation, code review, maintainership, and community practices • Govern employee contributions to external open-source projects and potential internal open-source releases • Build awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement • Develop metrics covering inventory, SBOMs, license compliance, exceptions, dependency health, lifecycle risk, InnerSource, reuse, and external contributions • Present strategy, metrics, risks, standards, and recommendations to architecture reviews, governance committees, and leadership • Mentor engineers and technology leaders • Identify and escalate open-source, licensing, operational, supply-chain, and technology risks • Maintain compliance with company risk, regulatory, internal control, audit, and brand standards • No supervisory responsibilities; provide technical leadership, mentorship, and cross-functional guidance

🎯 Exigences

• Minimum of 9 years’ combined higher education and/or work experience • Minimum of 4 years’ engineering and/or architecture experience • 3 years’ leadership experience • Minimum of 7 years’ experience in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or related disciplines • Ability to work on multiple complex projects • Proficiency with project management, word processing, and spreadsheet applications • Strong experience with open-source ecosystems, enterprise governance, and modern software development • Experience defining or implementing standards, governance models, engineering practices, or control frameworks across organizational boundaries • Understanding of software supply-chain concepts, dependencies, provenance, artifact management, dependency health, and lifecycle risk • Experience with SCA, open-source inventory, vulnerability data, policy management, and remediation workflows • Knowledge of open-source licensing concepts and license exception processes • Experience establishing or operating SBOM practices • Knowledge of CycloneDX and SPDX • Experience integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows • Ability to partner with Cyber Security while maintaining clear ownership boundaries • Ability to translate technical, legal, risk, and compliance considerations into engineering guidance • Advanced verbal and written communication skills • Experience developing or operating an OSPO or comparable governance capability • Experience developing open-source policies, standards, approved-use models, exception processes, and governance forums • Experience partnering with Legal on license review and compliance evidence • Experience establishing component-health and lifecycle criteria • Ability to assess maintainership, community activity, release cadence, supportability, licensing, provenance, and dependency risk • Experience creating metrics, dashboards, executive reporting, and risk narratives • Experience with GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or comparable technologies • Knowledge of CI/CD, DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code • Understanding of npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages • Experience with cloud-native development, containers, Kubernetes, APIs, microservices, and modern application architectures • Ability to drive automation within engineering workflows • Experience promoting trusted components, curated artifacts, reusable patterns, and developer paved roads • Knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, and community practices • Experience building engineering communities of practice and increasing reuse • Knowledge of external open-source contribution processes, contributor agreements, intellectual-property considerations, and release governance • Ability to coach and influence engineers, maintainers, architects, and technology leaders without direct authority • Preferred: experience leading an OSPO in a large enterprise • Preferred: experience in regulated environments, preferably financial services • Preferred: experience with Linux Foundation, TODO Group, OpenChain, or comparable communities • Preferred: experience with SLSA, OpenSSF guidance, or related practices • Preferred: experience with technology risk management, internal controls, regulatory examinations, or audit support • Preferred: relevant industry certifications or professional education