Specialist – Architecture (Open Source Software Compliance)

Location: Bengaluru

Experience: 5–7 Years

About The Role We are looking for an Open Source Software Compliance Coordinator with experience in Application Security , Software Composition Analysis (SCA) , and open-source license compliance. The role involves identifying open-source components, assessing license obligations and vulnerabilities, and helping development teams maintain compliance across software applications.

Job Description You will work with application delivery teams and security stakeholders to coordinate open-source compliance activities, review scan results, and address licensing and vulnerability risks. The role also involves supporting compliance audits, improving DevSecOps practices, and developing training materials to strengthen organization-wide security awareness.

This position follows a hybrid working model, with an expectation to work from the Bengaluru office at least three days per week. Travel to the client office in C. V. Raman Nagar, Bagmane, may be required for two to three days or as applicable.

Key Responsibilities

• Coordinate open-source compliance activities across application delivery teams.
• Review Software Composition Analysis (SCA) scan results and help teams address identified risks.
• Use tools such as Black Duck, Sonatype Lifecycle/Sonatype IQ, Mend.io, Revenera Code Insight, or FOSSID to identify open-source components and licenses.
• Interpret open-source and commercial license terms and determine associated obligations.
• Support risk assessment and acceptance workflows for non-compliant licenses.
• Coordinate source-code scans and assess code or package origins, including potential plagiarism.
• Review Software Bill of Materials (SBOM) data and support package and snippet scanning.
• Develop compliance training materials and educate teams on open-source license categories.
• Collaborate with security and engineering teams to improve DevSecOps and application security practices.
• Track and communicate compliance status, vulnerabilities, and improvement opportunities to technical teams and management.

Required Skills

• Open-source software compliance and license management.
• Application Security and Software Composition Analysis (SCA).
• Hands-on experience with SCA tools, including Black Duck or Sonatype IQ.
• Understanding of open-source license obligations, risk acceptance, and compliance workflows.
• Knowledge of package scanning, snippet scanning, and SBOM generation and review.
• Ability to identify open-source code or package origins and assess potential code reuse issues.
• Strong written communication, presentation, and training skills.

Preferred / Good To Have

• Software engineering experience in one or more programming languages.
• IT architecture knowledge and experience with CI/CD pipelines.
• Understanding of OWASP Top 10 vulnerabilities and OWASP ASVS requirements.
• Familiarity with security maturity frameworks such as OWASP SAMM or BSIMM.
• Experience implementing application security testing processes and tools.
• Awareness of the EU Cyber Resilience Act (CRA) or similar regulations.
• Experience analyzing and improving product security at scale.

Mandatory Skills

• Application Security – Black Duck / Sonatype IQ

Candidate Profile

The ideal candidate will have at least four years of experience in open-source software compliance, with a strong technical understanding of application security and software licensing. They should be comfortable working with development teams, advising stakeholders, communicating compliance risks, and driving security awareness through education.

Benefits Package

• Competitive salary and benefits package
• Opportunities for professional growth and development
• A collaborative and inclusive work environment
• The opportunity to work on exciting and challenging projects with leading clients