Lead, Open Source Program Office

Responsible at the expert level for establishing and advancing the enterprise Open Source Program Office (OSPO) strategy, governance, and operating model. Serves as a senior individual contributor responsible for enabling the responsible use, management, and contribution of open-source software across the software development lifecycle. Works closely with engineering, Cyber Security, Legal, Risk, Enterprise Architecture, Procurement, platform, and business teams to strengthen open-source governance, software supply-chain transparency, license compliance, component lifecycle management, InnerSource, and developer enablement while coaching and influencing others.

Primary Responsibilities

• Lead the development, implementation, and continuous improvement of the enterprise Open Source Program Office strategy, governance framework, and operating model.

• Define standards, guardrails, processes, and guidance governing the consumption, modification, distribution, and contribution of open-source software.

• Establish a risk-based governance model that enables engineering teams to use open source efficiently while meeting enterprise technology, legal, regulatory, security, and risk requirements.

• Define clear ownership, decision rights, exception processes, and escalation paths for open-source-related matters across the organization.

• Serve as the primary OSPO partner to the Cyber Security team for open-source and software supply-chain security considerations.

• Work closely with Cyber Security to align open-source governance, developer workflows, component inventory, Software Bill of Materials (SBOM) capabilities, and lifecycle practices with enterprise cybersecurity policies and controls.

• Partner with Cyber Security on the adoption and integration of Software Composition Analysis (SCA) and related software supply-chain security capabilities within developer workflows and CI/CD pipelines.

• Provide open-source inventory, dependency, SBOM, component-health, ownership, and lifecycle information to support Cyber Security vulnerability management, incident response, and supply-chain risk processes.

• Collaborate with Cyber Security, platform teams, and application teams on approaches for high-risk, compromised, abandoned, deprecated, unsupported, or end-of-life open-source components.

• Ensure OSPO activities complement Cyber Security responsibilities and do not create a parallel security function.

• Partner with Legal to define enterprise standards for acceptable open-source licenses, license obligations, notices, attribution, approvals, and exceptions.

• Develop scalable workflows for license identification, review, approval, exception management, and compliance evidence.

• Provide practical guidance to engineering teams regarding permissive, reciprocal, restrictive, and other higher-risk open-source licensing models.

• Establish and mature the enterprise SBOM governance strategy in partnership with Cyber Security, Engineering, Architecture, and Technology Risk.

• Define requirements and standards for generating, storing, maintaining, exchanging, and consuming SBOMs across internally developed applications and technology platforms.

• Create and improve enterprise visibility into open-source components, direct and transitive dependencies, licenses, ownership, usage, and lifecycle status.

• Use SBOM and component information to support vulnerability response, dependency analysis, technology lifecycle management, architecture decisions, and software supply-chain transparency.

• Establish governance across the full lifecycle of open-source components, including introduction, approval, maintenance, upgrades, vulnerability remediation, replacement, and retirement.

• Define component-health criteria addressing security status, licensing, maintainership, community activity, release cadence, supportability, provenance, and end-of-life status.

• Develop strategies for critical open-source technologies where community support, commercial support, internally curated artifacts, maintained versions, or alternative components may be appropriate.

• Identify dependency concentration, systemic open-source exposure, and sustainability risks requiring cross-functional action or management escalation.

• Partner with Developer Experience, Platform Engineering, Cyber Security, and Enterprise Architecture teams to embed open-source governance into engineering workflows.

• Integrate open-source governance with source-code management, CI/CD platforms, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling.

• Drive automation of controls, evidence collection, policy checks, approvals, and developer feedback wherever practical.

• Promote trusted, curated, reusable, and well-supported open-source components, packages, patterns, and paved-road solutions.

• Establish and mature an enterprise InnerSource program that promotes reuse, collaboration, contribution, maintainership, and shared ownership across engineering teams.

• Define InnerSource standards for repository ownership, contribution models, documentation, code review, maintainership, community practices, and project health.

• Create governance and approval processes for employees contributing to external open-source projects and for internally developed software considered for open-source release.

• Build open-source awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement.

• Develop and communicate meaningful measures including open-source inventory coverage, SBOM coverage and quality, license compliance, exceptions, unsupported component exposure, dependency health, lifecycle risk, InnerSource participation, reuse, and external contribution activity.

• Partner with Cyber Security to communicate open-source vulnerability exposure, remediation trends, and software supply-chain risk without assuming ownership of Cyber Security controls or risk decisions.

• Translate complex open-source, licensing, dependency, and software supply-chain topics into clear business and technology risk narratives for technical and senior leadership stakeholders.

• Present OSPO strategy, metrics, risks, standards, and recommendations at architecture reviews, technical forums, governance committees, and leadership meetings.

• Serve as a key partner with engineering, Cyber Security, Legal, Risk, Architecture, Procurement, and platform teams to identify and implement continuous improvements spanning organizational boundaries.

• Mentor engineers and technology leaders on open-source governance, SBOM practices, component lifecycle management, InnerSource, contribution practices, and responsible software consumption.

• Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite.

• Identify open-source, licensing, operational, software supply-chain, and technology risks requiring escalation to management.

• Promote an environment that supports a culture of belonging and reflects the M&T Bank brand.

• Maintain M&T internal control standards, including timely implementation of internal and external audit findings and regulatory requirements as applicable.

• Complete other related duties as assigned.

Scope of Responsibilities

Supervisory/Managerial Responsibilities

No supervisory responsibilities. May provide technical leadership, mentorship, and guidance to engineers, product teams, governance forums, and cross-functional project teams.

Education and Experience Required

• A combined minimum of 9 years’ higher education and/or work experience, including a minimum of 4 years’ engineering and/or architecture experience and 3 years leadership experience

• Capable of working on multiple projects of a complex nature

• Proficiency with project management, word processing and spreadsheet applications

• A minimum of 7 years of experience in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or related technology disciplines or technology governance role

Core Requirements

• Strong experience with open-source software ecosystems, enterprise open-source governance, and modern software development practices.

• Demonstrated experience defining or implementing standards, governance models, engineering practices, or control frameworks across organizational boundaries.

• Strong understanding of software supply-chain concepts, including direct and transitive dependencies, package ecosystems, component provenance, artifact management, dependency health, and lifecycle risk.

• Experience with Software Composition Analysis (SCA), open-source inventory, vulnerability data, policy management, and remediation workflows.

• Knowledge of open-source licensing concepts, obligations, attribution requirements, reciprocal licensing, restrictive licensing, and license exception processes.

• Experience establishing or operating SBOM generation, storage, governance, quality, and consumption practices.

• Knowledge of SBOM standards and formats, including CycloneDX and SPDX.

• Experience integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows.

• Ability to partner effectively with Cyber Security while maintaining clear boundaries among OSPO governance, security ownership, and engineering remediation responsibilities.

• Ability to translate complex technical, legal, risk, and compliance considerations into practical engineering guidance and actionable decisions.

• Advanced verbal and written communication skills, including the ability to influence senior technical and business stakeholders.

Open Source Governance & Program Expertise

• Demonstrated experience developing or operating an Open Source Program Office or comparable enterprise open-source governance capability.

• Experience developing open-source policies, standards, approved-use models, exception processes, and cross-functional governance forums.

• Experience partnering with Legal on open-source license review, obligations, approvals, notices, attribution, and compliance evidence.

• Experience establishing component-health and lifecycle criteria for unsupported, abandoned, deprecated, or end-of-life software.

• Ability to assess maintainership, community activity, release cadence, supportability, licensing, provenance, and enterprise dependency risk.

• Experience creating metrics, dashboards, executive reporting, and risk narratives for open-source adoption and governance.

Engineering, Tooling & Platform Expertise

• Experience with enterprise development and software supply-chain platforms such as GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or comparable technologies.

• Knowledge of CI/CD, DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code approaches.

• Understanding of common package ecosystems such as npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages.

• Experience with cloud-native development, containers, Kubernetes, APIs, microservices, and modern application architectures.

• Ability to drive automation that provides timely, actionable governance feedback within engineering workflows.

• Experience promoting trusted components, curated artifacts, reusable patterns, and developer paved roads.

InnerSource & Contribution Practices

• Demonstrated knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, and community practices.

• Experience building engineering communities of practice and increasing reuse across teams.

• Knowledge of external open-source contribution processes, contributor agreements, intellectual-property considerations, and release governance.

• Ability to coach and influence engineers, maintainers, architects, and technology leaders without direct authority.

Education and Experience Preferred

• Experience establishing or leading an Open Source Program Office in a large enterprise.

• Experience supporting enterprise technology organizations in regulated environments, preferably financial services.

• Experience partnering with Cyber Security, Legal, Risk, Architecture, Procurement, and engineering organizations.

• Experience with the Linux Foundation, TODO Group, OpenChain, or comparable open-source governance communities and frameworks.

• Experience with software supply-chain standards or frameworks such as SLSA, OpenSSF guidance, or related practices.

• Experience with technology risk management, internal controls, regulatory examinations, or audit support.

• Strong analytical and problem-solving skills related to software dependencies, governance, licensing, and technology lifecycle risk.

• Experience working in Agile, DevOps, platform engineering, and product operating models.

• Ability to work autonomously and lead complex, enterprise-wide initiatives.

• Strong organizational and time management skills.

• Experience driving project milestones, adoption goals, and delivery commitments across multiple teams.

• Relevant industry certifications or professional education in open-source governance, software supply-chain security, cloud, application security, or technology risk preferred.

Location