Lead, Open Source Program Office

Responsible at the expert level for establishing and advancing the enterprise Open Source Program Office (OSPO) strategy, governance, and operating model. Serves as a senior individual contributor responsible for enabling the responsible use, management, and contribution of open-source software across the software development lifecycle. Works closely with engineering, Cyber Security, Legal, Risk, Enterprise Architecture, Procurement, platform, and business teams to strengthen open-source governance, software supply-chain transparency, license compliance, component lifecycle management, InnerSource, and developer enablement while coaching and influencing others.

Primary Responsibilities

Lead the development, implementation, and continuous improvement of the enterprise Open Source Program Office strategy, governance framework, and operating model.

Define standards, guardrails, processes, and guidance governing the consumption, modification, distribution, and contribution of open-source software.

Establish a risk-based governance model that enables engineering teams to use open source efficiently while meeting enterprise technology, legal, regulatory, security, and risk requirements.

Define clear ownership, decision rights, exception processes, and escalation paths for open-source-related matters across the organization.

Serve as the primary OSPO partner to the Cyber Security team for open-source and software supply-chain security considerations.

Work closely with Cyber Security to align open-source governance, developer workflows, component inventory, Software Bill of Materials (SBOM) capabilities, and lifecycle practices with enterprise cybersecurity policies and controls.

Partner with Cyber Security on the adoption and integration of Software Composition Analysis (SCA) and related software supply-chain security capabilities within developer workflows and CI/CD pipelines.

Provide open-source inventory, dependency, SBOM, component-health, ownership, and lifecycle information to support Cyber Security vulnerability management, incident response, and supply-chain risk processes.

Collaborate with Cyber Security, platform teams, and application teams on approaches for high-risk, compromised, abandoned, deprecated, unsupported, or end-of-life open-source components.

Ensure OSPO activities complement Cyber Security responsibilities and do not create a parallel security function.

Partner with Legal to define enterprise standards for acceptable open-source licenses, license obligations, notices, attribution, approvals, and exceptions.

Develop scalable workflows for license identification, review, approval, exception management, and compliance evidence.

Provide practical guidance to engineering teams regarding permissive, reciprocal, restrictive, and other higher-risk open-source licensing models.

Establish and mature the enterprise SBOM governance strategy in partnership with Cyber Security, Engineering, Architecture, and Technology Risk.

Define requirements and standards for generating, storing, maintaining, exchanging, and consuming SBOMs across internally developed applications and technology platforms.

Create and improve enterprise visibility into open-source components, direct and transitive dependencies, licenses, ownership, usage, and lifecycle status.

Use SBOM and component information to support vulnerability response, dependency analysis, technology lifecycle management, architecture decisions, and software supply-chain transparency.

Establish governance across the full lifecycle of open-source components, including introduction, approval, maintenance, upgrades, vulnerability remediation, replacement, and retirement.

Define component-health criteria addressing security status, licensing, maintainership, community activity, release cadence, supportability, provenance, and end-of-life status.

Develop strategies for critical open-source technologies where community support, commercial support, internally curated artifacts, maintained versions, or alternative components may be appropriate.

Identify dependency concentration, systemic open-source exposure, and sustainability risks requiring cross-functional action or management escalation.

Partner with Developer Experience, Platform Engineering, Cyber Security, and Enterprise Architecture teams to embed open-source governance into engineering workflows.

Integrate open-source governance with source-code management, CI/CD platforms, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling.

Drive automation of controls, evidence collection, policy checks, approvals, and developer feedback wherever practical.

Promote trusted, curated, reusable, and well-supported open-source components, packages, patterns, and paved-road solutions.

Establish and mature an enterprise InnerSource program that promotes reuse, collaboration, contribution, maintainership, and shared ownership across engineering teams.

Define InnerSource standards for repository ownership, contribution models, documentation, code review, maintainership, community practices, and project health.

Create governance and approval processes for employees contributing to external open-source projects and for internally developed software considered for open-source release.

Build open-source awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement.

Develop and communicate meaningful measures including open-source inventory coverage, SBOM coverage and quality, license compliance, exceptions, unsupported component exposure, dependency health, lifecycle risk, InnerSource participation, reuse, and external contribution activity.

Partner with Cyber Security to communicate open-source vulnerability exposure, remediation trends, and software supply-chain risk without assuming ownership of Cyber Security controls or risk decisions.

Translate complex open-source, licensing, dependency, and software supply-chain topics into clear business and technology risk narratives for technical and senior leadership stakeholders.

Present OSPO strategy, metrics, risks, standards, and recommendations at architecture reviews, technical forums, governance committees, and leadership meetings.

Serve as a key partner with engineering, Cyber Security, Legal, Risk, Architecture, Procurement, and platform teams to identify and implement continuous improvements spanning organizational boundaries.

Mentor engineers and technology leaders on open-source governance, SBOM practices, component lifecycle management, InnerSource, contribution practices, and responsible software consumption.

Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite.

Identify open-source, licensing, operational, software supply-chain, and technology risks requiring escalation to management.

Promote an environment that supports a culture of belonging and reflects the M&T Bank brand.

Maintain M&T internal control standards, including timely implementation of internal and external audit findings and regulatory requirements as applicable.

Complete other related duties as assigned.

Scope of Responsibilities

Supervisory/Managerial Responsibilities

No supervisory responsibilities. May provide technical leadership, mentorship, and guidance to engineers, product teams, governance forums, and cross-functional project teams.

Education and Experience Required

A combined minimum of 9 years’ higher education and/or work experience, including a minimum of 4 years’ engineering and/or architecture experience and 3 years leadership experience

Capable of working on multiple projects of a complex nature

Proficiency with project management, word processing and spreadsheet applications

A minimum of 7 years of