Lead, Source Program Office

Responsible at the expert level for establishing and advancing the enterprise Open Source Program Office (OSPO) strategy, governance, and operating model. Serves as a senior individual contributor responsible for enabling the responsible use, management, and contribution of open-source software across the software development lifecycle. Works closely with engineering, Cyber Security, Legal, Risk, Enterprise Architecture, Procurement, platform, and business teams to strengthen open-source governance, software supply-chain transparency, license compliance, component lifecycle management, Inner Source, and developer enablement while coaching and influencing others.

• Lead the development, implementation, and continuous improvement of the enterprise Open Source Program Office strategy, governance framework, and operating model.
• Define standards, guardrails, processes, and guidance governing the consumption, modification, distribution, and contribution of open-source software.
• Establish a risk-based governance model that enables engineering teams to use open source efficiently while meeting enterprise technology, legal, regulatory, security, and risk requirements.
• Define clear ownership, decision rights, exception processes, and escalation paths for open-source-related matters across the organization.
• Serve as the primary OSPO partner to the Cyber Security team for open-source and software supply-chain security considerations.
• Work closely with Cyber Security to align open-source governance, developer workflows, component inventory, Software Bill of Materials (SBOM) capabilities, and lifecycle practices with enterprise cybersecurity policies and controls.
• Partner with Cyber Security on the adoption and integration of Software Composition Analysis (SCA) and related software supply-chain security capabilities within developer workflows and CI/CD pipelines.
• Provide open-source inventory, dependency, SBOM, component-health, ownership, and lifecycle information to support Cyber Security vulnerability management, incident response, and supply-chain risk processes.
• Collaborate with Cyber Security, platform teams, and application teams on approaches for high-risk, compromised, abandoned, deprecated, unsupported, or end-of-life open-source components.
• Ensure OSPO activities complement Cyber Security responsibilities and do not create a parallel security function.
• Partner with Legal to define enterprise standards for acceptable open-source licenses, license obligations, notices, attribution, approvals, and exceptions.
• Develop scalable workflows for license identification, review, approval, exception management, and compliance evidence.
• Provide practical guidance to engineering teams regarding permissive, reciprocal, restrictive, and other higher-risk open-source licensing models.
• Establish and mature the enterprise SBOM governance strategy in partnership with Cyber Security, Engineering, Architecture, and Technology Risk.
• Define requirements and standards for generating, storing, maintaining, exchanging, and consuming SBOMs across internally developed applications and technology platforms.
• Create and improve enterprise visibility into open-source components, direct and transitive dependencies, licenses, ownership, usage, and lifecycle status.
• Use SBOM and component information to support vulnerability response, dependency analysis, technology lifecycle management, architecture decisions, and software supply-chain transparency.
• Establish governance across the full lifecycle of open-source components, including introduction, approval, maintenance, upgrades, vulnerability remediation, replacement, and retirement.
• Define component-health criteria addressing security status, licensing, maintainership, community activity, release cadence, supportability, provenance, and end-of-life status.
• Develop strategies for critical open-source technologies where community support, commercial support, internally curated artifacts, maintained versions, or alternative components may be appropriate.
• Identify dependency concentration, systemic open-source exposure, and sustainability risks requiring cross-functional action or management escalation.
• Partner with Developer Experience, Platform Engineering, Cyber Security, and Enterprise Architecture teams to embed open-source governance into engineering workflows.
• Integrate open-source governance with source-code management, CI/CD platforms, artifact repositories, SCA platforms, security scanners, SBOM…