Job description

Overview Responsible for establishing and managing the enterprise governance framework for Free and Open Source Software (FOSS) and Software Bills of Materials (SBOMs). This role will develop standards, policies, procedures, and control requirements governing the use, identification, inventory, and risk management of open-source and third-party software components across the software development lifecycle. The role will partner with Technology, Cybersecurity, Legal, Compliance, Architecture, and Software Engineering teams to define clear ownership, risk-based requirements, exception processes, and ongoing monitoring practices. Remote eligible. Responsibilities & Qualifications Duties & Responsibilities: • Develop and maintain enterprise FOSS and SBOM policies, standards, procedures, and control requirements . • Establish governance for SBOM generation, collection, validation, storage, maintenance, and consumption . • Define requirements for identifying and managing open-source licensing, security, vulnerability, operational, and supply-chain risks . • Establish roles, responsibilities, approval authorities, and exception/risk-acceptance processes . • Integrate FOSS/SBOM requirements into the SDLC, DevSecOps, technology procurement, and third-party risk processes . • Define governance metrics, KRIs/KPIs, compliance monitoring, and management reporting. • Partner with stakeholders to drive adoption and remediate gaps against established standards. • Monitor evolving industry practices and regulatory expectations and incorporate them into the governance framework. Minimum Required Education and Experience: Bachelor's Degree and 6 years' experience OR High School Diploma or GED/Equivalent and 10 years' experience in Systems Support, or Analytics, or Operational Support Preferred Qualifications: • 7+ years of experience in technology risk, cybersecurity governance, software governance, application security, or related disciplines . • Strong understanding of open-source software risk, software supply-chain risk, SBOMs, vulnerability management, and secure SDLC practices . • Demonstrated experience developing enterprise policies, standards, procedures, controls, and governance frameworks . • Working knowledge of SBOM concepts and standards such as SPDX and CycloneDX , and software composition analysis (SCA) capabilities. • Ability to translate technical and risk concepts into clear, auditable requirements and control expectations . • Strong stakeholder management skills with the ability to work across Engineering, Cybersecurity, Risk, Legal, Compliance, and senior management. • Experience establishing a FOSS/SBOM governance program in a large, regulated enterprise or financial-services environment. Additional Information This job posting is expected to remain active for 45 days from the initial posting date listed above. If it is necessary to extend this deadline, the posting will remain active as appropriate. Job postings may come down early due to business need or a high volume of applicants. If hired in North Carolina, the base pay for this position is generally between $111,000 and $170,000. Actual starting base pay will be determined based on skills, experience, location, and other non-discriminatory factors permitted by law. For some roles, total compensation may also include variable incentives, bonuses, benefits, and/or other awards as outlined in the offer of employment. Benefits are an integral part of total rewards and First Citizens Bank is committed to providing a competitive, thoughtfully designed and quality benefits program to meet the needs of our associates. More information can be found at jobs.firstcitizens.com .

Requirements

Must-haves

Responsibilities & Qualifications
Develop and maintain enterprise FOSS and SBOM policies, standards, procedures, and control requirements .
Establish governance for SBOM generation, collection, validation, storage, maintenance, and consumption .
Define requirements for identifying and managing open-source licensing, security, vulnerability, operational, and supply-chain risks .
Establish roles, responsibilities, approval authorities, and exception/risk-acceptance processes .
Integrate FOSS/SBOM requirements into the SDLC, DevSecOps, technology procurement, and third-party risk processes .
Define governance metrics, KRIs/KPIs, compliance monitoring, and management reporting.
Partner with stakeholders to drive adoption and remediate gaps against established standards.
Monitor evolving industry practices and regulatory expectations and incorporate them into the governance framework.
Minimum Required Education and Experience: Bachelor's Degree and 6 years' experience OR High School Diploma or GED/Equivalent and 10 years' experience in Systems Support, or Analytics, or Operational Support
7+ years of experience in technology risk, cybersecurity governance, software governance, application security, or related disciplines .

Nice-to-haves

Strong understanding of open-source software risk, software supply-chain risk, SBOMs, vulnerability management, and secure SDLC practices .
Demonstrated experience developing enterprise policies, standards, procedures, controls, and governance frameworks .
Working knowledge of SBOM concepts and standards such as SPDX and CycloneDX , and software composition analysis (SCA) capabilities.
Ability to translate technical and risk concepts into clear, auditable requirements and control expectations .
Strong stakeholder management skills with the ability to work across Engineering, Cybersecurity, Risk, Legal, Compliance, and senior management.
Experience establishing a FOSS/SBOM governance program in a large, regulated enterprise or financial-services environment.
Additional Information

Application prep

Use the role’s language and application details while tailoring your materials.

Platform: jibe
Effort: medium