{"id":2884483,"url":"https://alion.io/job/mt-bank-lead-open-source-program-office","title":"Lead, Open Source Program Office","company":{"id":4312,"name":"M&T Bank","domain":"mtb.com","url":"https://alion.io/company/mtb","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":85,"open_postings":72,"ghost_share":0,"stale_share":0.583,"repost_share":0,"time_to_fill_p50_days":36,"computed_at":"2026-10-21T05:46:15Z"}},"role":"Legal","role_family":"Legal","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":116400,"max":194000,"currency":"USD","period":"year","gross":null,"usd_annual":194000},"salary_estimate":null,"experience_years_min":9,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"CI/CD","optional":false},{"name":"GitLab","optional":false},{"name":"Go","optional":false},{"name":"JFrog Artifactory","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"Mend","optional":false},{"name":"npm","optional":false},{"name":"Platform Engineering","optional":false},{"name":"SBOM","optional":false},{"name":"SLSA","optional":false},{"name":"SonarQube","optional":false},{"name":"JavaScript","optional":true}],"status":"live","first_seen_at":"2026-10-19T23:43:31Z","employer_posted_date":"2026-10-19","last_verified_at":"2026-10-21T11:02:47Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Responsible at the expert level for establishing and advancing the enterprise Open Source Program Office (OSPO) strategy, governance, and operating model. Serves as a senior individual contributor responsible for enabling the responsible use, management, and contribution of open-source software across the software development lifecycle. Works closely with engineering, Cyber Security, Legal, Risk, Enterprise Architecture, Procurement, platform, and business teams to strengthen open-source governance, software supply-chain transparency, license compliance, component lifecycle management, InnerSource, and developer enablement while coaching and influencing others.\nPrimary Responsibilities\nLead the development, implementation, and continuous improvement of the enterprise Open Source Program Office strategy, governance framework, and operating model. \nDefine standards, guardrails, processes, and guidance governing the consumption, modification, distribution, and contribution of open-source software. \nEstablish a risk-based governance model that enables engineering teams to use open source efficiently while meeting enterprise technology, legal, regulatory, security, and risk requirements. \nDefine clear ownership, decision rights, exception processes, and escalation paths for open-source-related matters across the organization. \nServe as the primary OSPO partner to the Cyber Security team for open-source and software supply-chain security considerations. \nWork closely with Cyber Security to align open-source governance, developer workflows, component inventory, Software Bill of Materials (SBOM) capabilities, and lifecycle practices with enterprise cybersecurity policies and controls. \nPartner with Cyber Security on the adoption and integration of Software Composition Analysis (SCA) and related software supply-chain security capabilities within developer workflows and CI/CD pipelines. \nProvide open-source inventory, dependency, SBOM, component-health, ownership, and lifecycle information to support Cyber Security vulnerability management, incident response, and supply-chain risk processes. \nCollaborate with Cyber Security, platform teams, and application teams on approaches for high-risk, compromised, abandoned, deprecated, unsupported, or end-of-life open-source components. \nEnsure OSPO activities complement Cyber Security responsibilities and do not create a parallel security function. \nPartner with Legal to define enterprise standards for acceptable open-source licenses, license obligations, notices, attribution, approvals, and exceptions. \nDevelop scalable workflows for license identification, review, approval, exception management, and compliance evidence. \nProvide practical guidance to engineering teams regarding permissive, reciprocal, restrictive, and other higher-risk open-source licensing models. \nEstablish and mature the enterprise SBOM governance strategy in partnership with Cyber Security, Engineering, Architecture, and Technology Risk. \nDefine requirements and standards for generating, storing, maintaining, exchanging, and consuming SBOMs across internally developed applications and technology platforms. \nCreate and improve enterprise visibility into open-source components, direct and transitive dependencies, licenses, ownership, usage, and lifecycle status. \nUse SBOM and component information to support vulnerability response, dependency analysis, technology lifecycle management, architecture decisions, and software supply-chain transparency. \nEstablish governance across the full lifecycle of open-source components, including introduction, approval, maintenance, upgrades, vulnerability remediation, replacement, and retirement. \nDefine component-health criteria addressing security status, licensing, maintainership, community activity, release cadence, supportability, provenance, and end-of-life status. \nDevelop strategies for critical open-source technologies where community support, commercial support, internally curated artifacts, maintained versions, or alternative components may be appropriate. \nIdentify dependency concentration, systemic open-source exposure, and sustainability risks requiring cross-functional action or management escalation. \nPartner with Developer Experience, Platform Engineering, Cyber Security, and Enterprise Architecture teams to embed open-source governance into engineering workflows. \nIntegrate open-source governance with source-code management, CI/CD platforms, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling. \nDrive automation of controls, evidence collection, policy checks, approvals, and developer feedback wherever practical. \nPromote trusted, curated, reusable, and well-supported open-source components, packages, patterns, and paved-road solutions. \nEstablish and mature an enterprise InnerSource program that promotes reuse, collaboration, contribution, maintainership, and shared ownership across engineering teams. \nDefine InnerSource standards for repository ownership, contribution models, documentation, code review, maintainership, community practices, and project health. \nCreate governance and approval processes for employees contributing to external open-source projects and for internally developed software considered for open-source release. \nBuild open-source awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement. \nDevelop and communicate meaningful measures including open-source inventory coverage, SBOM coverage and quality, license compliance, exceptions, unsupported component exposure, dependency health, lifecycle risk, InnerSource participation, reuse, and external contribution activity. \nPartner with Cyber Security to communicate open-source vulnerability exposure, remediation trends, and software supply-chain risk without assuming ownership of Cyber Security controls or risk decisions. \nTranslate complex open-source, licensing, dependency, and software supply-chain topics into clear business and technology risk narratives for technical and senior leadership stakeholders. \nPresent OSPO strategy, metrics, risks, standards, and recommendations at architecture reviews, technical forums, governance committees, and leadership meetings. \nServe as a key partner with engineering, Cyber Security, Legal, Risk, Architecture, Procurement, and platform teams to identify and implement continuous improvements spanning organizational boundaries. \nMentor engineers and technology leaders on open-source governance, SBOM practices, component lifecycle management, InnerSource, contribution practices, and responsible software consumption. \nUnderstand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite. \nIdentify open-source, licensing, operational, software supply-chain, and technology risks requiring escalation to management. \nPromote an environment that supports a culture of belonging and reflects the M&T Bank brand. \nMaintain M&T internal control standards, including timely implementation of internal and external audit findings and regulatory requirements as applicable. \nComplete other related duties as assigned. \nScope of Responsibilities\nSupervisory/Managerial Responsibilities\nNo supervisory responsibilities. May provide technical leadership, mentorship, and guidance to engineers, product teams, governance forums, and cross-functional project teams.\nEducation and Experience Required\nA combined minimum of 9 years’ higher education and/or work experience, including a minimum of 4 years’ engineering and/or architecture experience and 3 years leadership experience \nCapable of working on multiple projects of a complex nature \nProficiency with project management, word processing and spreadsheet applications \nA minimum of 7 years of experience in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or related technology disciplines or technology governance role \nCore Requirements\nStrong experience with open-source software ecosystems, enterprise open-source governance, and modern software development practices. \nDemonstrated experience defining or implementing standards, governance models, engineering practices, or control frameworks across organizational boundaries. \nStrong understanding of software supply-chain concepts, including direct and transitive dependencies, package ecosystems, component provenance, artifact management, dependency health, and lifecycle risk. \nExperience with Software Composition Analysis (SCA), open-source inventory, vulnerability data, policy management, and remediation workflows. \nKnowledge of open-source licensing concepts, obligations, attribution requirements, reciprocal licensing, restrictive licensing, and license exception processes. \nExperience establishing or operating SBOM generation, storage, governance, quality, and consumption practices. \nKnowledge of SBOM standards and formats, including CycloneDX and SPDX. \nExperience integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows. \nAbility to partner effectively with Cyber Security while maintaining clear boundaries among OSPO governance, security ownership, and engineering remediation responsibilities. \nAbility to translate complex technical, legal, risk, and compliance considerations into practical engineering guidance and actionable decisions. \nAdvanced verbal and written communication skills, including the ability to influence senior technical and business stakeholders. \nOpen Source Governance & Program Expertise\nDemonstrated experience developing or operating an Open Source Program Office or comparable enterprise open-source governance capability. \nExperience developing open-source policies, standards, approved-use models, exception processes, and cross-functional governance forums. \nExperience partnering with Legal on open-source license review, obligations, approvals, notices, attribution, and compliance evidence. \nExperience establishing component-health and lifecycle criteria for unsupported, abandoned, deprecated, or end-of-life software. \nAbility to assess maintainership, community activity, release cadence, supportability, licensing, provenance, and enterprise dependency risk. \nExperience creating metrics, dashboards, executive reporting, and risk narratives for open-source adoption and governance. \nEngineering, Tooling & Platform Expertise\nExperience with enterprise development and software supply-chain platforms such as GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or comparable technologies. \nKnowledge of CI/CD, DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code approaches. \nUnderstanding of common package ecosystems such as npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages. \nExperience with cloud-native development, containers, Kubernetes, APIs, microservices, and modern application architectures. \nAbility to drive automation that provides timely, actionable governance feedback within engineering workflows. \nExperience promoting trusted components, curated artifacts, reusable patterns, and developer paved roads. \nInnerSource & Contribution Practices\nDemonstrated knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, and community practices. \nExperience building engineering communities of practice and increasing reuse across teams. \nKnowledge of external open-source contribution processes, contributor agreements, intellectual-property considerations, and release governance. \nAbility to coach and influence engineers, maintainers, architects, and technology leaders without direct authority. \nEducation and Experience...","description_format":"text","description_chars":13807,"description_truncated":true,"requirements":{"experience_years_min":9,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Commercial & Retail Banks","Wealth Management & Financial Advisors","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-19T23:43:31Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 67 · green card filings: 29","filings_12m":67,"filings_prev_12m":118,"green_card_filings_12m":29,"median_offered_wage_usd":132031,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":1,"expected_fill_days":36,"reasons":["conf:1","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-21T05:46:15Z"},"pay":{"stated_usd_annual":194000,"is_top_pay":true},"html_url":"https://alion.io/job/mt-bank-lead-open-source-program-office","json_url":"https://alion.io/job/mt-bank-lead-open-source-program-office.json","meta":{"generated_at":"2026-10-21T23:02:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":32764,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4312},"rest":"https://alion.io/mcp/rest/get_company?id=4312"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmt-bank-lead-open-source-program-office"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmt-bank-lead-open-source-program-office"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmt-bank-lead-open-source-program-office"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/mt-bank-lead-open-source-program-office\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmt-bank-lead-open-source-program-office"}]}