19.09.2026 aktualisiert
100 % verfügbar
OSS Governance and Compliance Consultant | SBOM & SCA | Automotive and Embedded Software
Hohen Neuendorf, Deutschland
Deutschland
M.Eng. Technical Management, Hochschule Emden/LeerÜber mich
I help automotive and embedded-software teams organise OSS compliance, SBOM and vulnerability workflows. Former CARIAD specialist and product owner, now developing Autovion Ledger. Based near Berlin; German C1 and fluent English.
Skills
ComplianceEmbedded SoftwareGovernance-Risikomanagement und ComplianceSoftware-Compliance
OSS GOVERNANCE AND COMPLIANCE
I support automotive and embedded-software teams with open-source software compliance, Software Composition Analysis (SCA), SBOM workflows and practical OSPO processes. Services include component intake, licence-risk follow-up, approval and exception workflows, supplier evidence and release readiness.
CARIAD DELIVERY EXPERIENCE
Coordinated OSS and product-security governance across 20+ development teams and six platform workstreams. Governed 100+ component records and automated consolidation of 150+ analysis results per cycle using Python. Worked across Engineering, QA, Cybersecurity, Legal / Compliance, OSPO and programme leadership.
SBOM AND VULNERABILITY GOVERNANCE
Component inventory, SPDX and CycloneDX, findings triage, remediation ownership, lifecycle tracking, recurring reviews and evidence reporting. Black Duck SCA onboarding and follow-up of licence, vulnerability and component risks.
PRODUCT OWNERSHIP AND DELIVERY
Led a distributed team of 10+ developers in Germany and India for shared VW.OS libraries. Expanded the portfolio from 6 to 24 components. Roadmap, backlog, acceptance criteria, sprint and release planning, dependencies and stakeholder coordination.
AUTOVION LEDGER
Independent product development covering SBOM ingestion, OSS inventory, licence and vulnerability visibility, supplier evidence, policy workflows and compliance reporting.
TOOLS AND WORKING KNOWLEDGE
Black Duck, Python, Git, Jenkins, Jira, Confluence, Artifactory, REST APIs and SQL. Working knowledge of OpenChain concepts, EU Cyber Resilience Act, NIST SSDF, ISO/SAE 21434 and UNECE R155 / R156. Automotive SPICE and SAFe process background.
ENGAGEMENTS
OSS compliance process improvement; SBOM and vulnerability governance; external OSPO support; supplier evidence; technical product ownership. Remote delivery preferred, with Berlin / Brandenburg presence and other travel by agreement. German C1 and fluent professional English.
Erfahrung
Berufserfahrung5 - 10 Jahre
Freelancer seit2025
Sprachen
DeutschverhandlungssicherEnglischverhandlungssicherTeluguMuttersprache
Projekthistorie
Developing Autovion Ledger for SBOM ingestion, OSS inventory, licence and vulnerability visibility, supplier evidence, policy workflows and compliance reporting. Defining component-intake, risk-triage, approval, exception and release-evidence workflows and translating software-supply-chain requirements into product priorities. Demonstrating OSS and SBOM workflows to engineering and security stakeholders at embedded world and Hannover Messe 2026.
Coordinated 20+ development teams and six platform workstreams across Engineering, QA, Cybersecurity, Legal, Compliance, OSPO and programme leadership. Coordinated Black Duck SCA onboarding and follow-up of licence, vulnerability and component risks including remediation, exceptions and release readiness. Governed 100+ component records and built Python reporting consolidating 150+ analysis results per cycle. Established recurring reviews, evidence ownership and escalation paths to support traceable compliance decisions.
Led a distributed team of 10+ developers in Germany and India; owned roadmap, backlog, priorities and sprint and release planning. Expanded the shared-library portfolio from 6 to 24 components while balancing quality, security, licence considerations, dependencies and engineering capacity. Translated component-version and compliance concerns into backlog items, acceptance criteria and release recommendations.