Senior Product Owner

Title:- Senior Product Owner

Position Overview

We are seeking a Senior Product Owner to lead the design and implementation planning of an enterprise-wide Open Source Management Program and software supply chain security strategy within a large banking environment.

This is not a traditional backlog-management Product Owner position.

The successful candidate will operate as a strategist, program designer, facilitator, change leader, and cybersecurity governance professional responsible for defining how the organization discovers, evaluates, governs, approves, monitors, and manages open source software and related software supply chain risk.

The role will work across Cyber Security, Software Engineering, DevOps, Architecture, Asset Management, Risk, Legal, Compliance, and Technology leadership to establish the future-state operating model, governance structure, policies, processes, technology requirements, roadmap, staffing model, budget, and implementation strategy for an Enterprise Open Source Management Program.

Success requires the ability to move from ambiguity to a clearly defined enterprise operating model and to influence organizations without direct authority.

Primary Mission

Design a sustainable enterprise capability for managing open source software and software supply chain risk across the organization.

The Senior Product Owner will assess current capabilities, identify gaps, establish the future-state governance model, define implementation priorities, recommend technologies and processes, develop the business case, and build organizational alignment necessary to move the program into execution.

Critical Success Factors

A strong candidate should demonstrate meaningful experience in several of the following areas:

• Enterprise program design and implementation

• Enterprise change management

• Software supply chain security

• Application security

• Open source software governance

• Software Bill of Materials (SBOM)

• Software Composition Analysis (SCA)

• Enterprise technology governance

• Secure software development

• DevSecOps

• SDLC governance

• Cross-functional technology programs

• Policy and standards development

• Vulnerability and dependency management

• Technology risk management

Candidates must also demonstrate the ability to influence senior stakeholders and coordinate work across highly matrixed organizations.

Key Responsibilities Enterprise Program Design

Lead the definition and development of the Enterprise Open Source Management Program, including:

• Program scope and objectives

• Governance structure

• Operating model

• Organizational responsibilities

• Decision rights

• Policies and standards

• Intake and approval processes

• Exception-management processes

• Risk-management processes

• Technology requirements

• Implementation roadmap

• Staffing requirements

• Budget estimates

• Program metrics and reporting

Assess the organization's current state and identify gaps in people, processes, governance, technology, data, controls, and accountability.

Translate findings into a practical future-state operating model and phased implementation strategy.

Open Source & Software Supply Chain Governance

Develop an enterprise approach for managing open source software, libraries, packages, containers, dependencies, and other software artifacts.

Help establish processes for:

• Open source discovery and inventory

• Software component visibility

• Dependency management

• Open source approval

• License and policy compliance

• Vulnerability management

• Exception handling

• Risk acceptance

• Software component lifecycle management

• Third-party software risk

Partner with Security and Engineering teams to integrate governance into existing development workflows rather than creating unnecessary friction for developers.

SBOM Strategy

Support development of an enterprise Software Bill of Materials strategy.

Define requirements and processes for:

• SBOM generation

• SBOM collection

• SBOM storage

• SBOM ownership

• SBOM consumption

• Dependency visibility

• Vulnerability correlation

• Reporting

• Governance

Evaluate how SBOM capabilities should integrate into CI/CD, application security, vulnerability management, asset management, and technology-risk processes.

SDLC & DevSecOps Integration

Work directly with Software Engineering, Application Security, and DevOps teams to understand existing development and deployment workflows.

Evaluate integration points involving technologies such as:

• GitHub

• Jenkins

• Artifactory

• Software Composition Analysis platforms

• Container registries

• Cloud environments

• CI/CD pipelines

• Application security tooling

Ensure governance recommendations can operate effectively inside modern software engineering environments.

Policy & Governance

Develop recommendations for enterprise policies, standards, procedures, controls, and governance mechanisms related to open source and software supply chain security.

Establish appropriate processes for:

• Software intake

• Approval

• Exceptions

• Risk acceptance

• Vulnerability remediation

• Policy enforcement

• Governance reviews

• Escalation

Partner with Risk, Legal, Compliance, Security, and Engineering stakeholders to develop a model that balances cybersecurity risk with engineering productivity.

Technology Evaluation

Evaluate current and potential technologies supporting the program.

Facilitate:

• Technology assessments

• Vendor evaluations

• Proofs of concept

• Capability comparisons

• Requirements definition

• Solution recommendations

Potential technology areas include SCA, SBOM generation, artifact management, container security, vulnerability management, software inventory, and policy-enforcement platforms.

Executive Planning & Communication

Prepare executive-level materials including:

• Strategic recommendations

• Business cases

• Program roadmaps

• Investment proposals

• Staffing plans

• Budget estimates

• Risk assessments

• Implementation plans

• Program-status reporting

Clearly communicate complex cybersecurity and software-engineering concepts to both technical and nontechnical stakeholders.

Cross-Functional Leadership

Coordinate stakeholders across:

• Cyber Security

• Application Security

• Software Engineering

• DevOps

• Architecture

• Asset Management

• Technology Risk

• Enterprise Risk

• Legal

• Compliance

• Vendor Management

• Technology leadership

Lead workshops, working groups, governance forums, and executive discussions.

Drive decisions and maintain momentum even when stakeholders have competing priorities.

Must-Have Qualifications Program Leadership

Demonstrated experience designing or leading complex enterprise programs involving multiple technology organizations.

Experience converting high-level strategic objectives into executable roadmaps, governance models, processes, and implementation plans.

Strong enterprise change-management capabilities.

Software Supply Chain & Application Security

Working knowledge of:

• Software supply chain security

• Application security

• Open source software risk

• SBOM concepts

• Software dependencies

• Vulnerability management

• Modern software development environments

Enterprise Governance

Experience developing or working within enterprise:

• Governance frameworks

• Policies

• Standards

• Operating models

• Exception-management processes

• Technology-risk processes

Software Engineering Environment

Strong understanding of modern SDLC and software-delivery practices.

Familiarity with technologies and environments such as:

• GitHub

• Jenkins

• Artifactory

• Cloud platforms

• CI/CD

• Software repositories

• Software packages

• Containers

The candidate does not need to be a software developer but must be technically credible when working with engineering and security organizations.

Stakeholder Leadership

Demonstrated ability to influence outcomes across organizational boundaries without direct management authority.

Strong requirements-gathering and facilitation skills.

Experience leading workshops and obtaining agreement among stakeholders with conflicting priorities.

Executive Communication

Ability to create and present:

• Business cases

• Executive presentations

• Strategic roadmaps

• Investment recommendations

• Staffing plans

• Budget proposals

Strong written and verbal communication is essential.

Nice-to-Have Experience

Particularly valuable experience includes:

• Open Source Program Office (OSPO)

• Open source policy development

• Software Composition Analysis tools

• SBOM platforms

• ServiceNow

• Container registries

• DevSecOps

• Secure Software Development Frameworks

• Vulnerability management

• Exception-management programs

• Technology evaluations

• Vendor assessments

• Proof-of-concept leadership

• Third-party risk management

• Regulatory environments

• Financial services or banking

• Cybersecurity governance

Ideal Candidate Profile

The ideal candidate has previously helped an enterprise establish or significantly mature a technology governance, application-security, product-security, DevSecOps, open-source, or software-supply-chain program.

Strong candidates should be able to describe situations where they:

1. Assessed an organization's current state.

2. Identified capability and governance gaps.

3. Designed a future-state operating model.

4. Defined policies and processes.

5. Built a roadmap.

6. Developed investment, staffing, and budget recommendations.

7. Evaluated technology.

8. Obtained executive and stakeholder alignment.

9. Led implementation across multiple organizations.

10. Established measurable governance and operating processes.

What This Role Is NOT

This is not primarily a Scrum backlog-management position.

Candidates whose experience centers almost entirely on:

• Writing user stories

• Running grooming sessions

• Sprint planning

• Managing Agile backlogs

• Coordinating development-team delivery

without meaningful enterprise program, governance, cybersecurity, or software-supply-chain experience are unlikely to be successful.

Education & Experience

Bachelor's degree in Computer Science, Cybersecurity, Information Systems, Engineering, Business, or a related discipline preferred, or equivalent professional experience.

Minimum of 5 years of relevant experience involving cybersecurity, application security, software engineering, DevSecOps, technology governance, software supply chain security, product/program leadership, or related enterprise technology disciplines.