Head of Open Source Program Office - Enterprise Governance

M&T Bank Corporation; United States; Remote; USD 116,000 - 194,000; Full time

Job summary

M&T Bank Corporation seeks an expert leader to establish and advance the enterprise Open Source Program Office (OSPO) strategy, governance, and operating model. The role enables responsible use of open-source software across the development lifecycle, partnering with Cyber Security, Legal, Risk, Architecture, and engineering teams to strengthen SBOM, licensing, and software supply-chain governance.

You will mentor engineers, drive developer enablement, and translate risk and compliance

Qualifications

• Strong experience with open-source software ecosystems, enterprise open-source governance, and modern software development practices.
• Knowledge of SBOM standards and formats, including CycloneDX and SPDX.
• Experience with Software Composition Analysis (SCA), vulnerability data, policy management, and remediation workflows.
• Experience partnering with Cyber Security, Legal, Risk, Architecture, Procurement, and engineering organizations.
• Ability to translate complex technical, legal, risk, and compliance considerations into practical engineering guidance and actionable decisions.

Responsibilities

• Lead the development, implementation, and continuous improvement of the enterprise Open Source Program Office strategy, governance framework, and operating model.
• Define standards, guardrails, processes, and guidance governing the consumption, modification, distribution, and contribution of open-source software.
• Establish a risk-based governance model that enables engineering teams to use open source efficiently while meeting enterprise technology, legal, regulatory, security, and risk requirements.
• Define clear ownership, decision rights, exception processes, and escalation paths for open-source-related matters across the organization.
• Serve as the primary OSPO partner to the Cyber Security team for open-source and software supply-chain security considerations.
• Work closely with Cyber Security to align open-source governance, developer workflows, component inventory, SBOM capabilities, and lifecycle practices with enterprise cybersecurity policies and controls.
• Partner with Cyber Security on the adoption and integration of SCA and related software supply-chain security capabilities within developer workflows and CI/CD pipelines.
• Provide open-source inventory, dependency, SBOM, component-health, ownership, and lifecycle information to support Cyber Security vulnerability management, incident response, and supply-chain risk processes.
• Collaborate with Cyber Security, platform teams, and application teams on approaches for high-risk, compromised, abandoned, deprecated, unsupported, or end-of-life open-source components.
• Ensure OSPO activities complement Cyber Security responsibilities and do not create a parallel security function.
• Partner with Legal to define enterprise standards for acceptable open-source licenses, license obligations, notices, attribution, approvals, and exceptions.
• Develop scalable workflows for license identification, review, approval, exception management, and compliance evidence.
• Provide practical guidance to engineering teams regarding permissive, reciprocal, restrictive, and other higher-risk open-source licensing models.
• Establish and mature the enterprise SBOM governance strategy in partnership with Cyber Security, Engineering, Architecture, and Technology Risk.
• Define requirements and standards for generating, storing, maintaining, exchanging, and consuming SBOMs across internally developed applications and technology platforms.
• Create and improve enterprise visibility into open-source components, direct and transitive dependencies, licenses, ownership, usage, and lifecycle status.
• Use SBOM and component information to support vulnerability response, dependency analysis, technology lifecycle management, architecture decisions, and software supply-chain transparency.
• Establish governance across the full lifecycle of open-source components, including introduction, approval, maintenance, upgrades, vulnerability remediation, replacement, and retirement.
• Define component-health criteria addressing security status, licensing, maintainership, community activity, release cadence, supportability, provenance, and end-of-life status.
• Develop strategies for critical open-source technologies where community support, commercial support, internally curated artifacts, maintained versions, or alternative components may be appropriate.
• Identify dependency concentration, systemic open-source exposure, and sustainability risks requiring cross-functional action or management escalation.
• Partner with Developer Experience, Platform Engineering, Cyber Security, and Enterprise Architecture teams to embed open-source governance into engineering workflows.
• Integrate open-source governance with source-code management, CI/CD platforms, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling.
• Drive automation of controls, evidence collection, policy checks, approvals, and developer feedback wherever practical.
• Promote trusted, curated, reusable, and well-supported open-source components, packages, patterns, and paved-road solutions.
• Establish and mature an enterprise InnerSource program that promotes reuse, collaboration, contribution, maintainership, and shared ownership across engineering teams.
• Define InnerSource standards for repository ownership, contribution models, documentation, code review, maintainership, community practices, and project health.
• Create governance and approval processes for employees contributing to external open-source projects and for internally developed software considered for open-source release.
• Build open-source awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement.
• Develop and communicate meaningful measures including open-source inventory coverage, SBOM coverage and quality, license compliance, exceptions, unsupported component exposure, dependency health, lifecycle risk, InnerSource participation, reuse, and external contribution activity.
• Partner with Cyber Security to communicate open-source vulnerability exposure, remediation trends, and software supply-chain risk without assuming ownership of Cyber Security controls or risk decisions.
• Translate complex open-source, licensing, dependency, and software supply-chain topics into clear business and technology risk narratives for technical and senior leadership stakeholders.
• Present OSPO strategy, metrics, risks, standards, and recommendations at architecture reviews, technical forums, governance committees, and leadership meetings.
• Serve as a key partner with engineering, Cyber Security, Legal, Risk, Architecture, Procurement, and platform teams to identify and implement continuous improvements spanning organizational boundaries.
• Mentor engineers and technology leaders on open-source governance, SBOM practices, component lifecycle management, InnerSource, contribution practices, and responsible software consumption.
• Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite.
• Identify open-source, licensing, operational, software supply-chain, and technology risks requiring escalation to management.
• Promote an environment that supports a culture of belonging and reflects the M&T Bank brand.
• Maintain M&T internal control standards, including timely implementation of internal and external audit findings and regulatory requirements as applicable.
• Complete other related duties as assigned.

Skills

OSPO governance

Software supply-chain security

SBOM

Developer enablement

Stakeholder communication

Tools

GitLab Artifactory Xray

SCA tools

Job description

M&T Bank Corporation seeks an expert leader to establish and advance the enterprise Open Source Program Office (OSPO) strategy, governance, and operating model. The role enables responsible use of open-source software across the development lifecycle, partnering with Cyber Security, Legal, Risk, Architecture, and engineering teams to strengthen SBOM, licensing, and software supply-chain governance.

You will mentor engineers, drive developer enablement, and translate risk and compliance