Lead, Open Source Program Office (Cybersecurity)

Location: Remote, USA; listed location: Clanton, Alabama, United States of America

Salary: $116,400–$194,000 annual USD; the applicable range may vary by location.

Company

M&T Bank is a banking organization operating in a regulated financial-services environment.

What you will do

• Lead the enterprise Open Source Program Office strategy, governance framework, operating model, standards, guardrails, decision rights, exception processes, and escalation paths.
• Partner with Cyber Security, Legal, Risk, Engineering, Architecture, Procurement, Platform Engineering, and business teams on open-source governance, license compliance, software supply-chain security, and regulatory controls.
• Establish SBOM governance, component inventory, dependency visibility, lifecycle management, component-health criteria, and risk processes across internally developed applications and technology platforms.
• Integrate governance controls with source-code management, CI/CD platforms, artifact repositories, SCA tools, security scanners, SBOM registries, and developer tooling; automate policy checks, approvals, evidence collection, and feedback.
• Build and mature InnerSource practices, including repository ownership, contribution models, maintainership, documentation, code review, community practices, and external contribution governance.
• Develop metrics, dashboards, risk narratives, education, communities of practice, and technical guidance while mentoring engineers and presenting recommendations to technical and senior leadership.

Requirements

• At least 9 years of combined higher education and/or work experience, including at least 4 years of engineering and/or architecture experience and 3 years of leadership experience.
• At least 7 years of experience in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or related technology disciplines.
• Ability to work on multiple complex projects and proficiency with project management, word processing, and spreadsheet applications.
• Strong experience with open-source ecosystems, enterprise open-source governance, modern software development, governance models, standards, engineering practices, or control frameworks across organizational boundaries.
• Strong understanding of direct and transitive dependencies, package ecosystems, component provenance, artifact management, dependency health, lifecycle risk, and software supply-chain concepts.
• Experience with Software Composition Analysis, open-source inventories, vulnerability data, policy management, remediation workflows, and SBOM generation, storage, governance, quality, and consumption; knowledge of CycloneDX and SPDX.
• Knowledge of open-source licensing, license obligations, attribution, reciprocal and restrictive licensing, license approvals, and exception processes.
• Experience integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows; knowledge of DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code.
• Experience with enterprise development and supply-chain platforms such as GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or comparable technologies; common ecosystems such as npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages.
• Experience with cloud-native development, containers, Kubernetes, APIs, microservices, automation, curated artifacts, reusable patterns, and developer paved roads.
• Demonstrated knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, community practices, external contribution processes, contributor agreements, intellectual-property considerations, and release governance.
• Ability to partner with Cyber Security while maintaining clear boundaries between OSPO governance, security ownership, and engineering remediation; translate complex technical, legal, risk, and compliance matters into actionable guidance.
• Advanced verbal and written communication skills and the ability to coach and influence engineers, maintainers, architects, and senior technical and business stakeholders without direct authority.

Nice to have

• Experience establishing or leading an Open Source Program Office in a large enterprise or supporting regulated financial-services technology organizations.
• Experience partnering with Cyber Security, Legal, Risk, Architecture, Procurement, and engineering organizations.
• Experience with the Linux Foundation, TODO Group, OpenChain, SLSA, OpenSSF guidance, or comparable governance communities and frameworks.
• Experience with technology risk management, internal controls, regulatory examinations, audit support, Agile, DevOps, platform engineering, and product operating models.
• Strong analytical and problem-solving skills related to dependencies, governance, licensing, and technology lifecycle risk.
• Ability to work autonomously and lead complex enterprise-wide initiatives, with strong organizational and time-management skills and experience driving milestones, adoption goals, and delivery commitments across multiple teams.
• Relevant certifications or professional education in open-source governance, software supply-chain security, cloud, application security, or technology risk.

Culture & Benefits

• Remote-eligible position within the United States.
• Work in accordance with enterprise risk, regulatory, internal-control, audit, and technology policies.
• Cross-functional environment spanning engineering, Cyber Security, Legal, Risk, Architecture, Procurement, platform, and business teams.
• Role includes technical leadership, mentorship, education, and communities of practice without direct supervisory responsibility.
• Commitment to a culture of belonging and the M&T Bank brand.