Lead, Open Source Program Office

This is a fully remote position, open to applicants in Alabama.

📋 Description

• Spearhead the formulation, execution, and ongoing enhancement of the enterprise OSPO strategy, governance framework, and operational model.

• Articulate standards, guardrails, processes, and guidelines for open-source utilization, modification, distribution, and contributions.

• Create risk-based governance that aligns with technology, legal, regulatory, security, and risk requirements.

• Establish ownership, decision-making rights, exception procedures, and escalation pathways.

• Collaborate with Cyber Security on open-source and software supply-chain security, SBOMs, SCA, vulnerability management, incident response, and risk processes.

• Work alongside Legal on open-source license standards, obligations, notices, attribution, approvals, exceptions, and compliance documentation.

• Develop and enhance SBOM governance and lifecycle management for open-source components.

• Increase visibility into dependencies, licenses, ownership, usage, and lifecycle status.

• Define criteria and strategies for the health of components that are unsupported, abandoned, deprecated, or at end-of-life.

• Integrate governance into source-code management, CI/CD, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tools.

• Facilitate automation of controls, evidence collection, policy checks, approvals, and developer feedback.

• Advocate for trusted, curated, reusable, and supported open-source components and paved-road solutions.

• Establish and advance an enterprise InnerSource program.

• Specify InnerSource standards for ownership, contribution, documentation, code review, maintainership, and community practices.

• Oversee employee contributions to external open-source projects and potential internal open-source releases.

• Foster awareness and proficiency through education, communications, technical guidance, communities of practice, and engineering engagement.

• Create metrics encompassing inventory, SBOMs, license compliance, exceptions, dependency health, lifecycle risk, InnerSource, reuse, and external contributions.

• Present strategies, metrics, risks, standards, and recommendations to architecture reviews, governance committees, and leadership.

• Mentor engineers and technology leaders.

• Identify and escalate risks related to open-source, licensing, operations, supply chain, and technology.

• Ensure adherence to company risk, regulatory, internal control, audit, and brand standards.

• No supervisory duties; provide technical leadership, mentorship, and guidance across functions.

⛳️ Requirements

• At least 9 years of combined higher education and/or work experience.

• A minimum of 4 years in engineering and/or architecture roles.

• 3 years of leadership experience.

• At least 7 years in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or related fields.

• Capacity to manage multiple complex projects simultaneously.

• Proficient in project management, word processing, and spreadsheet applications.

• Extensive experience with open-source ecosystems, enterprise governance, and contemporary software development.

• Experience in defining or implementing standards, governance models, engineering practices, or control frameworks across organizational boundaries.

• Understanding of software supply-chain concepts, dependencies, provenance, artifact management, dependency health, and lifecycle risk.

• Familiarity with SCA, open-source inventory, vulnerability data, policy management, and remediation workflows.

• Knowledge of open-source licensing concepts and exception processes.

• Experience in establishing or managing SBOM practices.

• Familiarity with CycloneDX and SPDX.

• Experience in integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows.

• Capability to collaborate with Cyber Security while maintaining clear ownership boundaries.

• Ability to translate technical, legal, risk, and compliance considerations into engineering guidance.

• Advanced verbal and written communication skills.

• Experience in developing or managing an OSPO or similar governance capability.

• Experience in crafting open-source policies, standards, approved-use models, exception processes, and governance forums.

• Experience working with Legal on license review and compliance documentation.

• Proficient in establishing component-health and lifecycle criteria.

• Ability to evaluate maintainership, community activity, release cadence, supportability, licensing, provenance, and dependency risk.

• Experience in creating metrics, dashboards, executive reporting, and risk narratives.

• Familiarity with GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or similar technologies.

• Knowledge of CI/CD, DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code.

• Understanding of npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages.

• Experience in cloud-native development, containers, Kubernetes, APIs, microservices, and modern application architectures.

• Ability to drive automation within engineering workflows.

• Experience in promoting trusted components, curated artifacts, reusable patterns, and developer paved roads.

• Knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, and community practices.

• Experience in building engineering communities of practice and enhancing reuse.

• Familiarity with external open-source contribution processes, contributor agreements, intellectual-property considerations, and release governance.

• Ability to coach and influence engineers, maintainers, architects, and technology leaders without direct authority.

• Preferred: experience leading an OSPO in a large enterprise.

• Preferred: experience in regulated environments, preferably in financial services.

• Preferred: experience with the Linux Foundation, TODO Group, OpenChain, or similar communities.

• Preferred: experience with SLSA, OpenSSF guidance, or related practices.

• Preferred: experience in technology risk management, internal controls, regulatory examinations, or audit support.

• Preferred: relevant industry certifications or professional education.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health and wellness benefits.

• Opportunities for professional development and advancement.

• Flexible working arrangements and work-life balance.

• Supportive and inclusive work culture.