FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in open-source program management, governance frameworks, and software supply-chain security, with a strong focus on compliance, risk management, and engineering practices. Proven ability to lead cross-functional teams, mentor engineers, and drive automation within development workflows.
Highest-signal resume keywords
Open-Source Program ManagementSoftware Supply-Chain SecurityGovernance Framework DevelopmentRisk ManagementEngineering Mentorship
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Software EngineeringPlatform EngineeringDevSecOpsSCASBOM PracticesOpen-Source LicensingMetrics DevelopmentPolicy ManagementAutomationCloud-Native Development
Soft Skills
Advanced Communication SkillsLeadershipInfluencing Without AuthorityCross-Functional CollaborationCommunity Building
Tools & Technologies
GitLabJFrog ArtifactorySonarQubeCI/CDContainer RegistriesSecurity Scanning ToolsPolicy-as-CodeMendKubernetesMicroservices
Industry Keywords
Enterprise GovernanceOpen-Source EcosystemsRegulatory ComplianceTechnology Risk ManagementFinancial Services
Tech Stack
Tools & technologiesCloudCyber SecurityKubernetesLinuxMavenMicroservicesGo
About the role
Key responsibilities & impact- Lead the development, implementation, and continuous improvement of the enterprise OSPO strategy, governance framework, and operating model
- Define standards, guardrails, processes, and guidance for open-source consumption, modification, distribution, and contribution
- Establish risk-based governance aligned with technology, legal, regulatory, security, and risk requirements
- Define ownership, decision rights, exception processes, and escalation paths
- Partner with Cyber Security on open-source and software supply-chain security, SBOMs, SCA, vulnerability management, incident response, and risk processes
- Partner with Legal on open-source license standards, obligations, notices, attribution, approvals, exceptions, and compliance evidence
- Establish and mature SBOM governance and lifecycle management for open-source components
- Improve visibility into dependencies, licenses, ownership, usage, and lifecycle status
- Establish component-health criteria and strategies for unsupported, abandoned, deprecated, or end-of-life components
- Integrate governance into source-code management, CI/CD, artifact repositories, SCA platforms, security scanners, SBOM registries, and developer tooling
- Drive automation of controls, evidence collection, policy checks, approvals, and developer feedback
- Promote trusted, curated, reusable, and supported open-source components and paved-road solutions
- Establish and mature an enterprise InnerSource program
- Define InnerSource standards for ownership, contribution, documentation, code review, maintainership, and community practices
- Govern employee contributions to external open-source projects and potential internal open-source releases
- Build awareness and competency through education, communications, technical guidance, communities of practice, and engineering engagement
- Develop metrics covering inventory, SBOMs, license compliance, exceptions, dependency health, lifecycle risk, InnerSource, reuse, and external contributions
- Present strategy, metrics, risks, standards, and recommendations to architecture reviews, governance committees, and leadership
- Mentor engineers and technology leaders
- Identify and escalate open-source, licensing, operational, supply-chain, and technology risks
- Maintain compliance with company risk, regulatory, internal control, audit, and brand standards
- No supervisory responsibilities; provide technical leadership, mentorship, and cross-functional guidance
Requirements
What you’ll need- Minimum of 9 years’ combined higher education and/or work experience
- Minimum of 4 years’ engineering and/or architecture experience
- 3 years’ leadership experience
- Minimum of 7 years’ experience in software engineering, platform engineering, DevSecOps, application security, software supply-chain management, technology governance, open-source program management, or related disciplines
- Ability to work on multiple complex projects
- Proficiency with project management, word processing, and spreadsheet applications
- Strong experience with open-source ecosystems, enterprise governance, and modern software development
- Experience defining or implementing standards, governance models, engineering practices, or control frameworks across organizational boundaries
- Understanding of software supply-chain concepts, dependencies, provenance, artifact management, dependency health, and lifecycle risk
- Experience with SCA, open-source inventory, vulnerability data, policy management, and remediation workflows
- Knowledge of open-source licensing concepts and license exception processes
- Experience establishing or operating SBOM practices
- Knowledge of CycloneDX and SPDX
- Experience integrating governance and policy controls into source-code management, CI/CD, artifact management, and developer workflows
- Ability to partner with Cyber Security while maintaining clear ownership boundaries
- Ability to translate technical, legal, risk, and compliance considerations into engineering guidance
- Advanced verbal and written communication skills
- Experience developing or operating an OSPO or comparable governance capability
- Experience developing open-source policies, standards, approved-use models, exception processes, and governance forums
- Experience partnering with Legal on license review and compliance evidence
- Experience establishing component-health and lifecycle criteria
- Ability to assess maintainership, community activity, release cadence, supportability, licensing, provenance, and dependency risk
- Experience creating metrics, dashboards, executive reporting, and risk narratives
- Experience with GitLab, JFrog Artifactory and Xray, Mend, SonarQube, or comparable technologies
- Knowledge of CI/CD, DevSecOps, artifact repositories, package managers, container registries, security scanning, and policy-as-code
- Understanding of npm, Maven, NuGet, PyPI, Go modules, container images, and operating-system packages
- Experience with cloud-native development, containers, Kubernetes, APIs, microservices, and modern application architectures
- Ability to drive automation within engineering workflows
- Experience promoting trusted components, curated artifacts, reusable patterns, and developer paved roads
- Knowledge of InnerSource principles, contribution models, repository ownership, maintainership, documentation, and community practices
- Experience building engineering communities of practice and increasing reuse
- Knowledge of external open-source contribution processes, contributor agreements, intellectual-property considerations, and release governance
- Ability to coach and influence engineers, maintainers, architects, and technology leaders without direct authority
- Preferred: experience leading an OSPO in a large enterprise
- Preferred: experience in regulated environments, preferably financial services
- Preferred: experience with Linux Foundation, TODO Group, OpenChain, or comparable communities
- Preferred: experience with SLSA, OpenSSF guidance, or related practices
- Preferred: experience with technology risk management, internal controls, regulatory examinations, or audit support
- Preferred: relevant industry certifications or professional education