Lead, Open Source Program Office

Job not on LinkedIn

🔥 1 minute ago

🏈 Alabama – Remote

🏈 Alabama – Remote

💵 $116.4k - $194k / year

⏰ Full Time

🟠 Senior

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

M&T Bank

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 1856

🛡️ Insurance

💼 Consulting

🏦 Banking

Insurance • Consulting • Banking

M&T Bank is a leading regional financial institution that provides a wide range of banking services to personal, business, and commercial clients. Known for its customer satisfaction in mobile banking, M&T Bank offers products and services such as checking accounts, credit cards, mortgages, personal loans, and insurance. Additionally, it provides financial planning through Wilmington Advisors @ M&T. The bank is committed to community engagement, supporting local businesses, multicultural banking, and volunteerism. With a focus on cybersecurity and digital banking solutions, M&T Bank serves its clientele through comprehensive online and mobile services.

📋 Description

• Lead the development, implementation, and continuous improvement of the enterprise OSPO strategy, governance framework, and operating model • Define standards, guardrails, processes, and guidance for open-source consumption, modification, distribution, and contribution • Establish risk-based governance aligned with technology, legal, regulatory, security, and risk requirements • Define ownership, decision rights, exception processes, and escalation paths • Partner with Cyber Security on open-source and software supply-chain security, SBOMs, SCA, vulnerability management, incident response, and risk processes • Partner with Legal on open-source license standards, obligations, notices, attribution, approvals, exceptions, and compliance evidence • Establish and mature SBOM governance and lifecycle management for open-source components • Improve visibility into dependencies, licenses, ownership, usage, and lifecycle status • Establish component-health criteria and strategies for unsupported, abandoned, deprecated, or end-of-life components • Integrate governance into source-code management, CI/CD, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling • Drive automation of controls, evidence collection, policy checks, approvals, and developer feedback • Promote trusted, curated, reusable, and supported open-source components and paved-road solutions • Establish and mature an enterprise InnerSource program • Define InnerSource standards for ownership, contribution, documentation, code review, maintainership, and community practices • Govern employee contributions to external open-source projects and potential internal open-source releases • Build awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement • Develop metrics covering inventory, SBOMs, license compliance, exceptions, dependency health, lifecycle risk, InnerSource, reuse, and external contributions • Present strategy, metrics, risks, standards, and recommendations to architecture reviews, governance committees, and leadership • Mentor engineers and technology leaders • Identify and escalate open-source, licensing, operational, supply-chain, and technology risks • Maintain compliance with company risk, regulatory, internal control, audit, and brand standards • No supervisory responsibilities; provide technical leadership, mentorship, and cross-functional guidance

🎯 Requirements

• Minimum of 9 years’ combined higher education and/or work experience • Minimum of 4 years’ engineering and/or architecture experience • 3 years’ leadership experience • Minimum of 7 years’ experience in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or related disciplines • Ability to work on multiple complex projects • Proficiency with project management, word processing, and spreadsheet applications • Strong experience with open-source ecosystems, enterprise governance, and modern software development • Experience defining or implementing standards, governance models, engineering practices, or control frameworks across organizational boundaries • Understanding of software supply-chain concepts, dependencies, provenance, artifact management, dependency health, and lifecycle risk • Experience with SCA, open-source inventory, vulnerability data, policy management, and remediation workflows • Knowledge of open-source licensing concepts and license exception processes • Experience establishing or operating SBOM practices • Knowledge of CycloneDX and SPDX • Experience integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows • Ability to partner with Cyber Security while maintaining clear ownership boundaries • Ability to translate technical, legal, risk, and compliance considerations into engineering guidance • Advanced verbal and written communication skills • Experience developing or operating an OSPO or comparable governance capability • Experience developing open-source policies, standards, approved-use models, exception processes, and governance forums • Experience partnering with Legal on license review and compliance evidence • Experience establishing component-health and lifecycle criteria • Ability to assess maintainership, community activity, release cadence, supportability, licensing, provenance, and dependency risk • Experience creating metrics, dashboards, executive reporting, and risk narratives • Experience with GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or comparable technologies • Knowledge of CI/CD, DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code • Understanding of npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages • Experience with cloud-native development, containers, Kubernetes, APIs, microservices, and modern application architectures • Ability to drive automation within engineering workflows • Experience promoting trusted components, curated artifacts, reusable patterns, and developer paved roads • Knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, and community practices • Experience building engineering communities of practice and increasing reuse • Knowledge of external open-source contribution processes, contributor agreements, intellectual-property considerations, and release governance • Ability to coach and influence engineers, maintainers, architects, and technology leaders without direct authority • Preferred: experience leading an OSPO in a large enterprise • Preferred: experience in regulated environments, preferably financial services • Preferred: experience with Linux Foundation, TODO Group, OpenChain, or comparable communities • Preferred: experience with SLSA, OpenSSF guidance, or related practices • Preferred: experience with technology risk management, internal controls, regulatory examinations, or audit support • Preferred: relevant industry certifications or professional education