Lead, Source Program Office

Responsible at the expert level for establishing and advancing the enterprise Open Source Program Office (OSPO) strategy, governance, and operating model. Serves as a senior individual contributor responsible for enabling the responsible use, management, and contribution of open-source software across the software development lifecycle. Works closely with engineering, Cyber Security, Legal, Risk, Enterprise Architecture, Procurement, platform, and business teams to strengthen open-source governance, software supply-chain transparency, license compliance, component lifecycle management, Inner Source, and developer enablement while coaching and influencing others.

Primary Responsibilities Lead the development, implementation, and continuous improvement of the enterprise Open Source Program Office strategy, governance framework, and operating model.

Define standards, guardrails, processes, and guidance governing the consumption, modification, distribution, and contribution of open-source software.

Establish a risk-based governance model that enables engineering teams to use open source efficiently while meeting enterprise technology, legal, regulatory, security, and risk requirements.

Define clear ownership, decision rights, exception processes, and escalation paths for open-source-related matters across the organization.

Serve as the primary OSPO partner to the Cyber Security team for open-source and software supply-chain security considerations.

Work closely with Cyber Security to align open-source governance, developer workflows, component inventory, Software Bill of Materials (SBOM) capabilities, and lifecycle practices with enterprise cybersecurity policies and controls.

Partner with Cyber Security on the adoption and integration of Software Composition Analysis (SCA) and related software supply-chain security capabilities within developer workflows and CI/CD pipelines.

Provide open-source inventory, dependency, SBOM, component-health, ownership, and lifecycle information to support Cyber Security vulnerability management, incident response, and supply-chain risk processes.

Collaborate with Cyber Security, platform teams, and application teams on approaches for high-risk, compromised, abandoned, deprecated, unsupported, or end-of-life open-source components.

Ensure OSPO activities complement Cyber Security responsibilities and do not create a parallel security function.

Partner with Legal to define enterprise standards for acceptable open-source licenses, license obligations, notices, attribution, approvals, and exceptions.

Develop scalable workflows for license identification, review, approval, exception management, and compliance evidence.

Provide practical guidance to engineering teams regarding permissive, reciprocal, restrictive, and other higher-risk open-source licensing models.

Establish and mature the enterprise SBOM governance strategy in partnership with Cyber Security, Engineering, Architecture, and Technology Risk.

Define requirements and standards for generating, storing, maintaining, exchanging, and consuming SBOMs across internally developed applications and technology platforms.

Create and improve enterprise visibility into open-source components, direct and transitive dependencies, licenses, ownership, usage, and lifecycle status.

Use SBOM and component information to support vulnerability response, dependency analysis, technology lifecycle management, architecture decisions, and software supply-chain transparency.

Establish governance across the full lifecycle of open-source components, including introduction, approval, maintenance, upgrades, vulnerability remediation, replacement, and retirement.

Define component-health criteria addressing security status, licensing, maintainership, community activity, release cadence, supportability, provenance, and end-of-life status.

Develop strategies for critical open-source technologies where community support, commercial support, internally curated artifacts, maintained versions, or alternative components may be appropriate.

Identify dependency concentration, systemic open-source exposure, and sustainability risks requiring cross-functional action or management escalation.

Partner with Developer Experience, Platform Engineering, Cyber Security, and Enterprise Architecture teams to embed open-source governance into engineering workflows.

Integrate open-source governance with source-code management, CI/CD platforms, artifact repositories, SCA platforms, security scanners, SBOM…