Lead, Open Source Program Office
- Company: M&T Bank Corp.
- Location: Remote, USA
- Work mode: Remote
- Job type: Full-Time
- Posted: 2026-10-19
Responsible at the expert level for establishing and advancing the enterprise Open Source Program Office (OSPO) strategy, governance, and operating model. Serves as a senior individual contributor responsible for enabling the responsible use, management, and contribution of open-source software across the software development lifecycle. Works closely with engineering, Cyber Security, Legal, Risk, Enterprise Architecture, Procurement, platform, and business teams to strengthen open-source governance, software supply-chain transparency, license compliance, component lifecycle management, InnerSource, and developer enablement while coaching and influencing others.
Primary Responsibilities
* Lead the development, implementation, and continuous improvement of the enterprise Open Source Program Office strategy, governance framework, and operating model.
* Define standards, guardrails, processes, and guidance governing the consumption, modification, distribution, and contribution of open-source software.
* Establish a risk-based governance model that enables engineering teams to use open source efficiently while meeting enterprise technology, legal, regulatory, security, and risk requirements.
* Define clear ownership, decision rights, exception processes, and escalation paths for open-source-related matters across the organization.
* Serve as the primary OSPO partner to the Cyber Security team for open-source and software supply-chain security considerations.
* Work closely with Cyber Security to align open-source governance, developer workflows, component inventory, Software Bill of Materials (SBOM) capabilities, and lifecycle practices with enterprise cybersecurity policies and controls.
* Partner with Cyber Security on the adoption and integration of Software Composition Analysis (SCA) and related software supply-chain security capabilities within developer workflows and CI/CD pipelines.
* Provide open-source inventory, dependency, SBOM, component-health, ownership, and lifecycle information to support Cyber Security vulnerability management, incident response, and supply-chain risk processes.
* Collaborate with Cyber Security, platform teams, and application teams on approaches for high-risk, compromised, abandoned, deprecated, unsupported, or end-of-life open-source components.
* Ensure OSPO activities complement Cyber Security responsibilities and do not create a parallel security function.
* Partner with Legal to define enterprise standards for acceptable open-source licenses, license obligations, notices, attribution, approvals, and exceptions.
* Develop scalable workflows for license identification, review, approval, exception management, and compliance evidence.
* Provide practical guidance to engineering teams regarding permissive, reciprocal, restrictive, and other higher-risk open-source licensing models.
* Establish and mature the enterprise SBOM governance strategy in partnership with Cyber Security, Engineering, Architecture, and Technology Risk.
* Define requirements and standards for generating, storing, maintaining, exchanging, and consuming SBOMs across internally developed applications and technology platforms.
* Create and improve enterprise visibility into open-source components, direct and transitive dependencies, licenses, ownership, usage, and lifecycle status.
* Use SBOM and component information to support vulnerability response, dependency analysis, technology lifecycle management, architecture decisions, and software supply-chain transparency.
* Establish governance across the full lifecycle of open-source components, including introduction, approval, maintenance, upgrades, vulnerability remediation, replacement, and retirement.
* Define component-health criteria addressing security status, licensing, maintainership, community activity, release cadence, supportability, provenance, and end-of-life status.
* Develop strategies for critical open-source technologies where community support, commercial support, internally curated artifacts, maintained versions, or alternative components may be appropriate.
* Identify dependency concentration, systemic open-source exposure, and sustainability risks requiring cross-functional action or management escalation.
* Partner with Developer Experience, Platform Engineering, Cyber Security, and Enterprise Architecture teams to embed open-source governance into engineering workflows.
* Integrate open-source governance with source-code management, CI/CD platforms, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling.
* Drive automation of controls, evidence collection, policy checks, approvals, and developer feedback wherever practical.
* Promote trusted, curated, reusable, and well-supported open-source components, packages, patterns, and paved-road solutions.
* Establish and mature an enterprise InnerSource program that promotes reuse, collaboration, contribution, maintainership, and shared ownership across engineering teams.
* Define InnerSource standards for repository ownership, contribution models, documentation, code review, maintainership, community practices, and project health.
* Create governance and approval processes for employees contributing to external open-source projects and for internally developed software considered for open-source release.
* Build open-source awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement.
* Develop and communicate meaningful measures including open-source inventory coverage, SBOM coverage and quality, license compliance, exceptions, unsupported component exposure, dependency health, lifecycle risk, InnerSource participation, reuse, and external contribution activity.
* Partner with Cyber Security to communicate open-source vulnerability exposure, remediation trends, and software supply-chain risk without assuming ownership of Cyber Security controls or risk decisions.
* Translate complex open-source, licensing, dependency, and software supply-chain topics into clear business and technology risk narratives for technical and senior leadership stakeholders.
* Present OSPO strategy, metrics, risks, standards, and recommendations at architecture reviews, technical forums, governance committees, and leadership meetings.
* Serve as a key partner with engineering, Cyber Security, Legal, Risk, Architecture, Procurement, and platform teams to identify and implement continuous improvements spanning organizational boundaries.
* Mentor engineers and technology leaders on open-source governance, SBOM practices, component lifecycle management, InnerSource, contribution practices, and responsible software consumption.
* Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite.
* Identify open-source, licensing, operational, software supply-chain, and technology risks requiring escalation to management.
* Promote an environment that supports a culture of belonging and reflects the M&T Bank brand.
* Maintain M&T internal control standards, including timely implementation of internal and external audit findings and regulatory requirements as applicable.
* Complete other related duties as assigned.
Scope of Responsibilities
Supervisory/Managerial Responsibilities
No supervisory responsibilities. May provide technical leadership, mentorship, and guidance to engineers, product teams, governance forums, and cross-functional project teams.
Education and Experience Required
* A combined minimum of 9 years’ higher education and/or work experience, including a minimum of 4 years’ engineering and/or architecture experience and 3 years leadership experience
* Capable of working on multiple projects of a complex nature
* Proficiency with project management, word processing and spreadsheet applications
* A minimum of 7 years of