Website:
Job details:
Open-Source Software Compliance Coordinator
Company: A leading global MNC
Location: Bangalore, India
Experience: 4–6 Years
Open Positions: 1
Work Mode: Hybrid – Minimum 3 days in office per week
Notice Period: Maximum 15 Days
Team: Application Security (AppSec) Platform & Security Engineering
Job Summary
We are looking for an experienced Open-Source Software Compliance Coordinator to manage open-source licensing, software compliance, and Software Composition Analysis (SCA) activities. The candidate should have hands-on experience with SCA tools, license obligations, SBOM generation, and application security, along with strong communication skills.
Key Responsibilities
- Independently manage open-source software compliance activities across application delivery teams.
- Coordinate source code scans and analyze SCA scan results.
- Identify open-source components, licenses, and associated compliance risks.
- Support development teams in resolving license compliance issues and addressing open-source vulnerabilities.
- Review license terms, determine obligations, and support risk acceptance workflows for non-compliant licenses.
- Generate and review Software Bill of Materials (SBOM).
- Perform package and snippet scanning to identify open-source components and potential code plagiarism.
- Use SCA tools such as Sonatype Lifecycle, Black Duck, Mend.io, FOSSID, or Revenera.
- Develop compliance training materials and educate teams on open-source license categories and obligations.
- Collaborate with application development, security, and leadership teams to improve compliance processes.
- Support DevSecOps transformation and standardization of open-source compliance practices.
- Communicate compliance status, risks, and recommendations to technical teams and management.
Mandatory Skills
- Minimum 4 years of hands-on open-source software compliance experience.
- Independent ownership of open-source licensing and compliance activities.
- Experience with at least one SCA tool: Sonatype Lifecycle, Black Duck, Mend.io, FOSSID, or Revenera.
- Strong understanding of open-source licenses, obligations, and compliance risks.
- Experience with SBOM generation and review.
- Knowledge of SCA package scanning and snippet scanning.
- Ability to identify open-source code/package origins.
- Strong written and verbal communication skills.
Good-to-Have Skills
- Software engineering experience and IT architecture knowledge.
- CI/CD pipeline experience.
- Application security knowledge, including OWASP Top 10 and OWASP ASVS.
- Familiarity with OWASP SAMM, BSIMM, or similar security maturity frameworks.
- Experience with application security testing processes and tools.
- Awareness of the Cyber Resilience Act (CRA) or similar regulations.
Candidate Requirements
- Ability to work independently and collaborate with application development teams.
- Strong analytical, communication, and training skills.
- Willingness to work in a hybrid model from Bangalore, with at least 3 days in the office per week.
- Candidates who can join within 15 days are preferred.
Click on Apply to know more.
