Lead, Open Source Program Office
M&T Bank · Remote · $116,400–$194,000 (stated in the posting)
Responsible at the expert level for establishing and advancing the enterprise Open Source Program Office (OSPO) strategy, governance, and operating model. Serves as a senior individual contributor responsible for enabling the responsible use, management, and contribution of open-source software across the software development lifecycle. Works closely with engineering, Cyber Security, Legal, Risk, Enterprise Architecture, Procurement, platform, and business teams to strengthen open-source governance, software supply-chain transparency, license compliance, component lifecycle management, InnerSource, and developer enablement while coaching and influencing others.
Primary Responsibilities
- Lead the development, implementation, and continuous improvement of the enterprise Open Source Program Office strategy, governance framework, and operating model.
- Define standards, guardrails, processes, and guidance governing the consumption, modification, distribution, and contribution of open-source software.
- Establish a risk-based governance model that enables engineering teams to use open source efficiently while meeting enterprise technology, legal, regulatory, security, and risk requirements.
- Define clear ownership, decision rights, exception processes, and escalation paths for open-source-related matters across the organization.
- Serve as the primary OSPO partner to the Cyber Security team for open-source and software supply-chain security considerations.
- Work closely with Cyber Security to align open-source governance, developer workflows, component inventory, Software Bill of Materials (SBOM) capabilities, and lifecycle practices with enterprise cybersecurity policies and controls.
- Partner with Cyber Security on the adoption and integration of Software Composition Analysis (SCA) and related software supply-chain security capabilities within developer workflows and CI/CD pipelines.
- Provide open-source inventory, dependency, SBOM, component-health, ownership, and lifecycle information to support Cyber Security vulnerability management, incident response, and supply-chain risk processes.
- Collaborate with Cyber Security, platform teams, and application teams on approaches for high-risk, compromised, abandoned, deprecated, unsupported, or end-of-life open-source components.
- Ensure OSPO activities complement Cyber Security responsibilities and do not create a parallel security function.
- Partner with Legal to define enterprise standards for acceptable open-source licenses, license obligations, notices, attribution, approvals, and exceptions.
- Develop scalable workflows for license identification, review, approval, exception management, and compliance evidence.
- Provide practical guidance to engineering teams regarding permissive, reciprocal, restrictive, and other higher-risk open-source licensing models.
- Establish and mature the enterprise SBOM governance strategy in partnership with Cyber Security, Engineering, Architecture, and Technology Risk.
- Define requirements and standards for generating, storing, maintaining, exchanging, and consuming SBOMs across internally developed applications and technology platforms.
- Create and improve enterprise visibility into open-source components, direct and transitive dependencies, licenses, ownership, usage, and lifecycle status.
- Use SBOM and component information to support vulnerability response, dependency analysis, technology lifecycle management, architecture decisions, and software supply-chain transparency.
- Establish governance across the full lifecycle of open-source components, including introduction, approval, maintenance, upgrades, vulnerability remediation, replacement, and retirement.
- Define component-health criteria addressing security status, licensing, maintainership, community activity, release cadence, supportability, provenance, and end-of-life status.
- Develop strategies for critical open-source technologies where community support, commercial support, internally curated artifacts, maintained versions, or alternative components may be appropriate.
- Identify dependency concentration, systemic open-source exposure, and sustainability risks requiring cross-functional action or management escalation.
- Partner with Developer Experience, Platform Engineering, Cyber Security, and Enterprise Architecture teams to embed open-source governance into engineering workflows.
- Integrate open-source governance with source-code management, CI/CD platforms, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling.
- Drive automation of controls, evidence collection, policy checks, approvals, and developer feedback wherever practical.
- Promote trusted, curated, reusable, and well-supported open-source components, packages, patterns, and paved-road solutions.
- Establish and mature an enterprise InnerSource program that promotes reuse, collaboration, contribution, maintainership, and shared ownership across engineering teams.
- Define InnerSource standards for repository ownership, contribution models, documentation, code review, maintainership, community practices, and project health.
- Create governance and approval processes for employees contributing to external open-source projects and for internally developed software considered for open-source release.
- Build open-source awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement.
- Develop and communicate meaningful measures including open-source inventory coverage, SBOM coverage and quality, license compliance, exceptions, unsupported component exposure, dependency health, lifecycle risk, InnerSource participation, reuse, and external contribution activity.
- Partner with Cyber Security to communicate open-source vulnerability exposure, remediation trends, and software supply-chain risk without assuming ownership of Cyber Security controls or risk decisions.
- Translate complex open-source, licensing, dependency, and software supply-chain topics into clear business and technology risk narratives for technical and senior leadership stakeholders.
- Present OSPO strategy, metrics, risks, standards, and recommendations at architecture reviews, technical forums, governance committees, and leadership meetings.
- Serve as a key partner with engineering, Cyber Security, Legal, Risk, Architecture, Procurement, and platform teams to identify and implement continuous improvements spanning organizational boundaries.
- Mentor engineers and technology leaders on open-source governance, SBOM practices, component lifecycle management, InnerSource, contribution practices, and responsible software consumption.
- Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite.
- Identify open-source, licensing, operational, software supply-chain, and technology risks requiring escalation to management.
- Promote an environment that supports a culture of belonging and reflects the M&T Bank brand.
- Maintain M&T internal control standards, including timely implementation of internal and external audit findings and regulatory requirements as applicable.
- Complete other related duties as assigned.
Scope of Responsibilities
Supervisory/Managerial Responsibilities
No supervisory responsibilities. May provide technical leadership, mentorship, and guidance to engineers, product teams, governance forums, and cross-functional project teams.
Education and Experience Required
- A combined minimum of 9 years’ higher education and/or work experience, including a minimum of 4 years’ engineering and/or architecture experience and 3 years leadership experience
- Capable of working on multiple projects of a complex nature
- Proficiency with project management, word processing and spreadsheet applications
- A minimum of 7 years of experience in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or related technology disciplines or technology governance role
Core Requirements
- Strong experience with open-source software ecosystems, enterprise open-source governance, and modern software development practices.
- Demonstrated experience defining or implementing standards, governance models, engineering practices, or control frameworks across organizational boundaries.
- Strong understanding of software supply-chain concepts, including direct and transitive dependencies, package ecosystems, component provenance, artifact management, dependency health, and lifecycle risk.
- Experience with Software Composition Analysis (SCA), open-source inventory, vulnerability data, policy management, and remediation workflows.
- Knowledge of open-source licensing concepts, obligations, attribution requirements, reciprocal licensing, restrictive licensing, and license exception processes.
- Experience establishing or operating SBOM generation, storage, governance, quality, and consumption practices.
- Knowledge of SBOM standards and formats, including CycloneDX and SPDX.
- Experience integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows.
- Ability to partner effectively with Cyber Security while maintaining clear boundaries among OSPO governance, security ownership, and engineering remediation responsibilities.
- Ability to translate complex technical, legal, risk, and compliance considerations into practical engineering guidance and actionable decisions.
- Advanced verbal and written communication skills, including the ability to influence senior technical and business stakeholders.
Open Source Governance & Program Expertise
- Demonstrated experience developing or operating an Open Source Program Office or comparable enterprise open-source governance capability.
- Experience developing open-source policies, standards, approved-use models, exception processes, and cross-functional governance forums.
- Experience partnering with Legal on open-source license review, obligations, approvals, notices, attribution, and compliance evidence.
- Experience establishing component-health and lifecycle criteria for unsupported, abandoned, deprecated, or end-of-life software.
- Ability to assess maintainership, community activity, release cadence, supportability, licensing, provenance, and enterprise dependency risk.
- Experience creating metrics, dashboards, executive reporting, and risk narratives for open-source adoption and governance.
Engineering, Tooling & Platform Expertise
- Experience with enterprise development and software supply-chain platforms such as GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or comparable technologies.
- Knowledge of CI/CD, DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code approaches.
- Understanding of common package ecosystems such as npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages.
- Experience with cloud-native development, containers, Kubernetes, APIs, microservices, and modern application architectures.
- Ability to drive automation that provides timely, actionable governance feedback within engineering workflows.
- Experience promoting trusted components, curated artifacts, reusable patterns, and developer paved roads.
InnerSource & Contribution Practices
- Demonstrated knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, and community practices.
- Experience building engineering communities of practice and increasing reuse across teams.
- Knowledge of external open-source contribution processes, contributor agreements, intellectual-property considerations, and release governance.
- Ability to coach and influence engineers, maintainers, architects, and technology leaders without direct authority.
Education and Experience Preferred
- Experience establishing or leading an Open Source Program Office in a large enterprise.
- Experience supporting enterprise technology organizations in regulated environments, preferably financial services.
- Experience partnering with Cyber Security, Legal, Risk, Architecture, Procurement, and engineering organizations.
- Experience with the Linux Foundation, TODO Group, OpenChain, or comparable open-source governance communities and frameworks.
- Experience with software supply-chain standards or frameworks such as SLSA, OpenSSF guidance, or related practices.
- Experience with technology risk management, internal controls, regulatory examinations, or audit support.
- Strong analytical and problem-solving skills related to software dependencies, governance, licensing, and technology lifecycle risk.
- Experience working in Agile, DevOps, platform engineering, and product operating models.
- Ability to work autonomously and lead complex, enterprise-wide initiatives.
- Strong organizational and time management skills.
- Experience driving project milestones, adoption goals, and delivery commitments across multiple teams.
- Relevant industry certifications or professional education in open-source governance, software supply-chain security, cloud, application security, or technology risk preferred.
#LI-JB3
M&T Bank is committed to fair, competitive, and market-informed pay for our employees. The pay range for this position is $116,400.00 - $194,000.00 Annual (USD). The successful candidate’s particular combination of knowledge, skills, and experience will inform their specific compensation. The range listed above corresponds to our national pay range for this role. The specific pay range applicable to you may vary based on your location.