About the role
Open Source Program Office (OSPO), part of Enterprise Technology, is hiring a Senior Software Engineer to modernize and automate the open-source governance and vulnerability management processes at the bank.
The OSPO sets and enforces policies for open source components, packages, libraries and services used across the bank. Today, developers handle too much of that work manually. You will help build the automation, integrations and decision logic that let application teams get compliant answers quickly, so security and licensing risk falls while delivery speeds up. You will work with application teams, Information Security, Legal, Risk, and Enterprise Architecture.
What you'll do
Automate governance workflows
- Partnering with our Legal, Risk, and DevSecOps stakeholders, design and build integrations among Sonatype, ServiceNow, GitHub, Jenkins and Harness that replace manual review, ticketing and approval steps.
- Build self-service tools, APIs and CI/CD pipeline plug-ins that give developers policy feedback early, in the IDE, pull request or build, rather than at release.
- Automate onboarding and offboarding of applications, repositories and policies in governance tooling.
Streamline waivers and exceptions
- Create an automated waiver process: intake, risk-based routing, approval, expiry and re-evaluation, with an audit trail.
- Define and encode the rules under which a waiver is granted automatically (for example, no reachable vulnerable code path, compensating controls in place, low-risk usage context) in partnership with InfoSec and Risk.
Evaluate components more intelligently
- Build logic that combines vulnerability data, reachability analysis, exploit intelligence (such as EPSS and KEV), license and contract terms, ISBIA evaluations, project health and deployment context into a clear risk decision.
- Reduce false positives and unblock application teams by separating theoretical findings from exploitable ones.
- Automate triage of newly disclosed vulnerabilities, license changes and end-of-life components across the bank's application inventory.
Enable developers and report on the program
- Write clear documentation, templates and golden-path guidance, and support teams adopting them.
- Build dashboards and metrics on policy compliance, waiver volume, time to resolution and risk trends for leadership and audit.
- Support software bill of materials (SBOM) generation, ingestion and analysis (CycloneDX, SPDX), and contribute to regulatory and audit readiness.
- Mentor engineers and set engineering standards for the OSPO's code, testing and operations.
What you bring
- 6+ years of software engineering experience (or equivalent), including 3+ years building automation, platform or developer-experience tooling at senior level.
- Strong programming skill in Python, Java, or Go, with experience designing and consuming REST APIs and webhooks.
- Hands-on experience with software supply chain or application security tooling, such as Sonatype (Nexus IQ, Lifecycle, Repository), or comparable SCA tools (Snyk, Black Duck, Mend, Dependency-Track).
- Working knowledge of open source licensing (permissive versus copyleft) and how license obligations affect enterprise use.
- Experience building CI/CD integrations in Jenkins, Harness, GitHub Actions or similar, including policy gates and quality checks.
- Experience automating workflows in ServiceNow (Flow Designer, REST integrations) and Microsoft Power Automate or comparable low-code platforms.
- Understanding of vulnerability management concepts: CVE/CVSS, exploitability, reachability, SBOMs and remediation prioritization.
- Ability to turn ambiguous policy into precise, testable rules, and to explain risk decisions to developers, security staff and auditors.
- Clear written and verbal communication, and a track record of working across engineering, security, legal and risk teams.
- Bachelor's degree in computer science or a related field, or equivalent experience.
