Blue Spire Inc
Website:
thebluespire.com
Job details:
Open Source Program Office
About the role
Citizens Bank: Open Source Program Office (OSPO), part of Enterprise Technology, is hiring a
Senior Software Engineer to modernize and automate the open-source governance and
vulnerability management processes at the bank.
The OSPO sets and enforces policies for open source components, packages, libraries and
services used across the bank. Today, developers handle too much of that work manually. You
will help build the automation, integrations and decision logic that let application teams get
compliant answers quickly, so security and licensing risk falls while delivery speeds up. You will
work with application teams, Information Security, Legal, Risk, and Enterprise Architecture.
Automate governance workflows
Partnering with our Legal, Risk, and DevSecOps stakeholders, design and build
integrations among Sonatype, ServiceNow, GitHub, Jenkins and Harness that replace
manual review, ticketing and approval steps.
Build self-service tools, APIs and CI/CD pipeline plug-ins that give developers policy
feedback early, in the IDE, pull request or build, rather than at release.
Automate onboarding and offboarding of applications, repositories and policies in
governance tooling.
Streamline waivers and exceptions
Create an automated waiver process: intake, risk-based routing, approval, expiry and re-
evaluation, with an audit trail.
Define and encode the rules under which a waiver is granted automatically (for example,
no reachable vulnerable code path, compensating controls in place, low-risk usage
context) in partnership with InfoSec and Risk.
Evaluate components more intelligently
Build logic that combines vulnerability data, reachability analysis, exploit intelligence
(such as EPSS and KEV), license and contract terms, ISBIA evaluations, project health
and deployment context into a clear risk decision.
Reduce false positives and unblock application teams by separating theoretical findings
from exploitable ones.
Automate triage of newly disclosed vulnerabilities, license changes and end-of-life
components across the bank's application inventory.
Enable developers and report on the program
Write clear documentation, templates and golden-path guidance, and support teams
adopting them.
Build dashboards and metrics on policy compliance, waiver volume, time to resolution
and risk trends for leadership and audit.
Support software bill of materials (SBOM) generation, ingestion and analysis
(CycloneDX, SPDX), and contribute to regulatory and audit readiness.
Mentor engineers and set engineering standards for the OSPO's code, testing and
operations.
What you bring
6+ years of software engineering experience (or equivalent), including 3+ years building
automation, platform or developer-experience tooling at senior level.
Strong programming skill in Python, Java, or Go, with experience designing and
consuming REST APIs and webhooks.
Hands-on experience with software supply chain or application security tooling, such as
Sonatype (Nexus IQ, Lifecycle, Repository), or comparable SCA tools (Snyk, Black
Duck, Mend, Dependency-Track).
Working knowledge of open source licensing (permissive versus copyleft) and how
license obligations affect enterprise use.
Experience building CI/CD integrations in Jenkins, Harness, GitHub Actions or similar,
including policy gates and quality checks.
Experience automating workflows in ServiceNow (Flow Designer, REST integrations)
and Microsoft Power Automate or comparable low-code platforms.
Understanding of vulnerability management concepts: CVE/CVSS, exploitability,
reachability, SBOMs and remediation prioritization.
Ability to turn ambiguous policy into precise, testable rules, and to explain risk decisions
to developers, security staff and auditors.
Clear written and verbal communication, and a track record of working across
engineering, security, legal and risk teams.
Bachelordegree in computer science or a related field, or equivalent experience.
Click on Apply to know more.
