Lead, Open Source Program Office

M&T Bank

1d•$116,400 - $194,000

About The Position

The Lead, Open Source Program Office is a senior individual contributor responsible for establishing and advancing the enterprise OSPO strategy, governance, and operating model. The role enables responsible open-source use, management, and contribution across the software development lifecycle, working with Engineering, Cyber Security, Legal, Risk, Enterprise Architecture, Procurement, platform, and business teams. It strengthens open-source governance, software supply-chain transparency, license compliance, component lifecycle management, InnerSource, and developer enablement through technical leadership, coaching, and influence. The role partners with Cyber Security on open-source and software supply-chain security, including aligning governance and developer workflows with enterprise policies, integrating SCA capabilities, and providing inventory, dependency, SBOM, component-health, ownership, and lifecycle information. It collaborates on responses to high-risk or unsupported components while complementing—not duplicating—Cyber Security responsibilities. In partnership with Legal, it defines license standards and scalable processes for license identification, review, approvals, exceptions, notices, attribution, and compliance evidence. The position establishes enterprise SBOM governance and component lifecycle practices, including standards for generating, storing, maintaining, exchanging, and consuming SBOMs. It improves visibility into components, dependencies, licenses, ownership, usage, and lifecycle status; defines component-health criteria; and addresses dependency concentration and sustainability risks. It embeds governance into engineering workflows and tools, drives practical automation, and promotes trusted, curated components and paved-road solutions. The role also matures an enterprise InnerSource program, establishes internal and external contribution governance, and builds awareness through education, communications, communities of practice, and engineering engagement. It develops measures and leadership reporting, presents strategy and risk narratives to technical and senior stakeholders, mentors engineers and technology leaders, and supports company risk, regulatory, internal-control, audit, and belonging commitments. There are no supervisory responsibilities, though the role may provide technical leadership, mentorship, and guidance.

Requirements

A combined minimum of 9 years of higher education and/or work experience, including at least 4 years of engineering and/or architecture experience and 3 years of leadership experience.
At least 7 years of experience in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or a related technology discipline or governance role.
Strong experience with open-source ecosystems, enterprise open-source governance, and modern software development practices.
Demonstrated experience defining or implementing standards, governance models, engineering practices, or control frameworks across organizational boundaries.
Strong understanding of software supply-chain concepts, including direct and transitive dependencies, package ecosystems, component provenance, artifact management, dependency health, and lifecycle risk.
Experience with SCA, open-source inventory, vulnerability data, policy management, and remediation workflows.
Knowledge of open-source licensing concepts, obligations, attribution, reciprocal and restrictive licensing, and license exception processes.
Experience establishing or operating SBOM generation, storage, governance, quality, and consumption practices; knowledge of CycloneDX and SPDX.
Experience integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows.
Ability to partner with Cyber Security while maintaining clear boundaries among OSPO governance, security ownership, and engineering remediation responsibilities.
Ability to turn technical, legal, risk, and compliance considerations into practical engineering guidance and actionable decisions.
Advanced verbal and written communication skills, including ability to influence senior technical and business stakeholders.
Demonstrated experience developing or operating an OSPO or comparable enterprise open-source governance capability; experience developing policies, standards, approved-use models, exception processes, and cross-functional governance forums.
Experience partnering with Legal on license review, obligations, approvals, notices, attribution, and compliance evidence.
Experience establishing component-health and lifecycle criteria for unsupported, abandoned, deprecated, or end-of-life software, and assessing maintainership, community activity, release cadence, supportability, licensing, provenance, and enterprise dependency risk.
Experience creating metrics, dashboards, executive reporting, and risk narratives for open-source adoption and governance.
Experience with enterprise development and supply-chain platforms such as GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or comparable technologies.
Knowledge of CI/CD, DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code approaches.
Understanding of package ecosystems such as npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages.
Experience with cloud-native development, containers, Kubernetes, APIs, microservices, and modern application architectures.
Ability to drive automation that provides timely, actionable governance feedback in engineering workflows and promote trusted components, curated artifacts, reusable patterns, and developer paved roads.
Demonstrated knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, and community practices; experience building engineering communities of practice and increasing reuse.
Knowledge of external open-source contribution processes, contributor agreements, intellectual-property considerations, and release governance.
Ability to coach and influence engineers, maintainers, architects, and technology leaders without direct authority.
Capable of working on multiple complex projects.
Proficiency with project management, word processing, and spreadsheet applications.

Nice To Haves

Experience establishing or leading an OSPO in a large enterprise.
Experience supporting enterprise technology organizations in regulated environments, preferably financial services.
Experience partnering with Cyber Security, Legal, Risk, Architecture, Procurement, and engineering organizations.
Experience with the Linux Foundation, TODO Group, OpenChain, or comparable open-source governance communities and frameworks.
Experience with software supply-chain standards or frameworks such as SLSA, OpenSSF guidance, or related practices.
Experience with technology risk management, internal controls, regulatory examinations, or audit support.
Strong analytical and problem-solving skills related to software dependencies, governance, licensing, and technology lifecycle risk.
Experience working in Agile, DevOps, platform engineering, and product operating models.
Ability to work autonomously and lead complex enterprise-wide initiatives.
Strong organizational and time-management skills.
Experience driving project milestones, adoption goals, and delivery commitments across multiple teams.
Relevant industry certifications or professional education in open-source governance, software supply-chain security, cloud, application security, or technology risk.

Responsibilities

Lead development, implementation, and continuous improvement of the enterprise OSPO strategy, governance framework, and operating model.
Define standards, guardrails, processes, guidance, ownership, decision rights, exception processes, and escalation paths for open-source consumption, modification, distribution, and contribution.
Establish risk-based governance that enables engineering teams to use open source while meeting enterprise technology, legal, regulatory, security, and risk requirements.
Serve as the primary OSPO partner to Cyber Security for open-source and software supply-chain security considerations, ensuring OSPO activities complement rather than duplicate Cyber Security responsibilities.
Align open-source governance, developer workflows, component inventory, SBOM capabilities, and lifecycle practices with cybersecurity policies and controls.
Partner on adoption and integration of SCA and related software supply-chain security capabilities in developer workflows and CI/CD pipelines.
Provide inventory, dependency, SBOM, component-health, ownership, and lifecycle information for vulnerability management, incident response, and supply-chain risk processes.
Collaborate on approaches for high-risk, compromised, abandoned, deprecated, unsupported, or end-of-life components.
Partner with Legal to define acceptable-license standards and obligations, notices, attribution, approvals, and exceptions; develop scalable review and compliance-evidence workflows.
Provide engineering teams practical guidance on permissive, reciprocal, restrictive, and other higher-risk licensing models.
Establish and mature enterprise SBOM governance with Cyber Security, Engineering, Architecture, and Technology Risk; define SBOM generation, storage, maintenance, exchange, and consumption requirements.
Improve enterprise visibility into open-source components, dependencies, licenses, ownership, usage, and lifecycle status; use SBOM and component information to support vulnerability response, dependency analysis, lifecycle management, architecture decisions, and transparency.
Govern the full component lifecycle, from introduction and approval through maintenance, upgrades, remediation, replacement, and retirement; define component-health criteria and strategies for critical technologies.
Identify dependency concentration, systemic open-source exposure, and sustainability risks requiring cross-functional action or management escalation.
Embed governance into engineering workflows with Developer Experience, Platform Engineering, Cyber Security, and Enterprise Architecture; integrate with source-code management, CI/CD, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling.
Automate controls, evidence collection, policy checks, approvals, and developer feedback where practical; promote trusted, curated, reusable, and well-supported components, packages, patterns, and paved-road solutions.
Establish and mature an enterprise InnerSource program and define standards for repository ownership, contributions, documentation, code review, maintainership, community practices, and project health.
Create governance and approval processes for employee contributions to external projects and internally developed software considered for open-source release.
Build open-source awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement.
Develop and communicate measures for inventory and SBOM coverage and quality, license compliance, exceptions, unsupported-component exposure, dependency health, lifecycle risk, InnerSource participation, reuse, and external contribution activity.
Partner with Cyber Security to communicate vulnerability exposure, remediation trends, and supply-chain risk without assuming ownership of Cyber Security controls or risk decisions.
Translate technical, legal, risk, and supply-chain topics into clear business and technology risk narratives; present strategy, metrics, risks, standards, and recommendations at reviews, forums, committees, and leadership meetings.
Partner across Engineering, Cyber Security, Legal, Risk, Architecture, Procurement, and platform teams to implement continuous improvements; mentor engineers and technology leaders.
Adhere to company risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite; identify risks requiring management escalation.
Promote a culture of belonging that reflects the M&T Bank brand and maintain internal control standards, including timely implementation of audit findings and applicable regulatory requirements.
Complete other related duties as assigned.