Lead, Open Source Program Office

mtb; United States; Remote; USD 116,000 - 194,000; Full time

Job summary

mtb is seeking a senior individual contributor to establish and advance an enterprise program for responsible open-source use and contribution. The role spans policy, software supply-chain visibility, license compliance, component lifecycle risk, and developer enablement, influencing teams without direct authority.

You will partner with engineering, cybersecurity, legal, risk, architecture, procurement, and platform teams to build practical governance and scalable processes across the

Qualifications

• Strong knowledge of open-source governance, licensing, software dependencies, and component lifecycle risk.
• Ability to collaborate across engineering, cybersecurity, legal, risk, architecture, procurement, and platform teams.
• Experience with developer workflows and automation that provide governance feedback during engineering processes.
• Knowledge of InnerSource practices, repository ownership, maintainership, documentation, and contribution models.
• Ability to influence and coach engineers, maintainers, architects, and technology leaders without direct authority.

Responsibilities

• Develop and continually improve the open-source program strategy, governance framework, operating model, standards, and exception paths.
• Create risk-based guidance for adopting, modifying, distributing, and contributing to open-source software while supporting efficient engineering work.
• Partner with cybersecurity on software supply-chain controls, SBOM practices, and integration of software composition analysis into developer workflows and CI/CD pipelines.
• Work with legal teams to define license standards and scalable processes for identification, review, approval, exceptions, notices, and compliance evidence.
• Establish SBOM governance and improve visibility into dependencies, licenses, ownership, component health, and lifecycle status.
• Coordinate lifecycle practices for components, including approval, maintenance, upgrades, vulnerability response, replacement, and retirement; coach teams and promote reuse and InnerSource.

Job description

Role overview

This senior individual contributor establishes and advances an enterprise program for responsible open-source use and contribution. The work spans policy, software supply-chain visibility, license compliance, component lifecycle risk, and developer enablement. Success depends on building practical governance with engineering, cybersecurity, legal, risk, architecture, procurement, and platform teams, while influencing teams without direct authority.

Responsibilities

• Develop and continually improve the open-source program strategy, governance framework, operating model, standards, and exception paths.
• Create risk-based guidance for adopting, modifying, distributing, and contributing to open-source software while supporting efficient engineering work.
• Partner with cybersecurity on software supply-chain controls, component inventories, SBOM practices, and integration of software composition analysis into developer workflows and CI/CD pipelines.
• Work with legal teams to define license standards and scalable processes for identification, review, approval, exceptions, notices, and compliance evidence.
• Establish SBOM governance and improve visibility into dependencies, licenses, ownership, component health, and lifecycle status.
• Coordinate lifecycle practices for components, including approval, maintenance, upgrades, vulnerability response, replacement, and retirement; coach teams and promote reuse and InnerSource.

Requirements

• Strong knowledge of open-source governance, software dependencies, licensing, and component lifecycle risk.
• Ability to work across engineering, cybersecurity, legal, risk, architecture, procurement, and platform functions.
• Experience with developer workflows and automation that provides timely governance feedback within engineering processes.
• Knowledge of InnerSource practices, repository ownership, maintainership, documentation, and contribution models.
• Ability to influence and coach engineers, maintainers, architects, and technology leaders without direct authority.
• Strong analytical, organizational, and problem-solving skills; able to lead complex initiatives across multiple teams.

Nice to have

Experience establishing an enterprise open-source program, working in a regulated environment, or supporting audits and technology risk is preferred. Familiarity with software supply-chain standards, governance communities, Agile, DevOps, and platform engineering is also valued.

Benefits and work setup

The listing gives a national annual pay range of $116,400–$194,000; the applicable range may vary by location.