Now Hiring: Senior Open Source Maintainer  🔗 **Source:** [Now Hiring: Senior Open Source Maintainer](https://nesbitt.io/2026/08/28/now-hiring-senior-open-source-maintainer.html) > [!note]+ Document Notes > > [!info] Analysis generated 2026-08-28 by Claude (Opus 5) via readwise-deep-read. > > **Source:** Article — https://nesbitt.io/2026/08/28/now-hiring-senior-open-source-maintainer.html · ~979 words · published 2026-08-28. > > **Author:** Andrew Nesbitt (nesbitt.io; founder of Ecosyste.ms and Open Source Collective / prior Libraries.io — a leading voice on open-source sustainability and dependency infrastructure). Reader's author field says "nesbitt.io." > > **Form:** satire — a mock job posting. Read the register accordingly: the "requirements" are the argument. > > Register key: [STATED] · [EVIDENCE] · [INFERENCE] · [RECOMMEND]. Full text read. > # 🏷️ Title: Now Hiring: Senior Open Source Maintainer (satire) > ## 🧭 Table of Contents > - [📝 Summary](#-summary) > - [📖 Main Content](#-main-content) > - [🗒️ Notes](#️-notes) > - [📚 References](#-references) > - [🗣️ Paraphrase](#️-paraphrase) > - [📰 Newsletter](#-newsletter) > - [✅ Action Items](#-action-items) > - [🧪 Hypotheses](#-hypotheses) > - [📊 Methodology](#-methodology) > - [❓ Questions](#-questions) > - [🔮 Future Research](#-future-research) > - [💡 Implications](#-implications) > - [🧠 Learning Styles Assessment](#-learning-styles-assessment) > - [📊 Accessibility Assessment](#-accessibility-assessment) > - [🌍 DEIB Assessment](#-deib-assessment) > - [✅ Logical Validity](#-logical-validity) > - [🛡️ DARVO Analysis](#-darvo-analysis) > - [🎯 Conclusion](#-conclusion) > ## 📝 Summary > **The joke, and the argument inside it.** [STATED] A mock job posting for "Senior Open Source Maintainer." **Employment type: Volunteer. Term: Permanent. Compensation: $0. Reports to: The community. Start date: Immediate.** The comedy is that every listed responsibility is real, and the sum is impossible for one unpaid person. > **The role, as advertised.** [STATED] *"Primary technical owner and public face,"* driving roadmap, shipping releases across all major version lines, supporting *"a global user base"* on *"GitHub, Discord, Slack, Stack Overflow, Mastodon, Bluesky, and email,"* and *"full autonomy to decide how you spend your time"* — the autonomy of having no one to delegate to. > **The security/compliance pile** (the sharpest section). [STATED] On-call for *downstream* production incidents; enterprise support where *"project issues block business-critical systems"*; ship *"embargoed CVE patches across all supported version lines within the disclosure window"*; produce *"SBOMs, VEX statements, and signed provenance attestations for every release"*; *"reproducible builds"*; *"complete supplier security assessments and questionnaires for enterprise consumers"*; *"remediate findings from OpenSSF Scorecard, dependency scanners, and compliance platforms."* > **The AI-era additions.** [STATED] *"Review high volumes of contributions from AI coding agents and automated refactoring tools"* and *"triage vulnerability reports generated by commercial AI security scanners."* > **The success metrics — the second punchline.** [STATED] Measured on *"GitHub stars,"* time-to-first-response, release cadence, mean-time-to-patch, backlog, *"OpenSSF Scorecard result,"* *"community sentiment,"* *"downstream adoption,"* and **"Bus factor"** — the last one a dark joke, since the role *is* the bus factor. Under "nice to have": *"A second job."* Under offers: *"GitHub Sponsors enabled on the repository."* > ## 📖 Main Content > ### The form is the thesis > [INFERENCE] Nesbitt's move is to take everything the modern software supply chain silently expects of a volunteer maintainer and render it in the one format that makes expectations legible: a job description with compensation stated. The $0 next to a list that would occupy an entire engineering-plus-security-plus-legal-plus-DevRel team is the whole argument. Nothing is exaggerated — that's what makes it land. Every bullet is a real thing someone has demanded of a maintainer. > ### The regulatory/enterprise escalation is the new material > [STATED] The security section reads as a near-verbatim inventory of what CRA/SBOM/supply-chain-security regimes now push onto upstream maintainers: embargoed multi-version CVE patching within disclosure windows, VEX statements, signed provenance, reproducible builds, supplier questionnaires, Scorecard remediation. [INFERENCE] This is the exact obligation set the OpenSSF CRA panel described in this week's batch — *"manufacturers must fix their dependencies for 5 years"* — viewed from below. Nesbitt's satire is the maintainer's-eye view of the same regulation: the compliance burden lands on an unpaid individual who never signed up to be a "manufacturer's" supplier. Nesbitt (Ecosyste.ms) has the data to know this is literal, not hyperbolic. > ### "Bus factor" as a success metric > [STATED] Listing *"Bus factor"* among the KPIs the maintainer is measured on is the essay's cruelest, truest line: the one-person project is asked to improve its own resilience to losing that person, with no resources to recruit a second. *"Own the succession plan: identify, recruit, and onboard your replacement."* [INFERENCE] The Pods story from this same batch is this bullet made real — Scott Kingsley Clark, sole maintainer, articulating exactly the burnout the "bus factor" metric measures but can't fund away. > ### The AI-agent bullets date the piece precisely > [STATED] *"Review high volumes of contributions from AI coding agents"* and *"triage vulnerability reports generated by commercial AI security scanners"* are 2026 additions to the maintainer's unpaid load. [INFERENCE] The batch's throughline again: AI agents generate *more* work for the response side (PRs to review, scanner reports to triage) while the discovery side gets the funding. The satire captures the asymmetry in two bullets. > ### The closing knife-twists > [STATED] *"If you don't meet every requirement listed above, we'd still encourage you to apply"*; *"This position will remain open until filled"*; *"Due to the volume of applications received, we are unable to respond to every candidate individually"* (for a $0 volunteer role no one applies to); *"not eligible for relocation assistance or visa sponsorship."* The corporate-boilerplate register applied to unpaid labor is the sustained comic engine. > ## 🗒️ Notes > - [INFERENCE] This is the rhetorical companion to this week's substantive sustainability reads — Dries' cost-allocation piece (why commons get underfunded), the OpenSSF CRA panel (regulatory obligations pushed upstream), and the Pods incident (the human cost, named). Nesbitt supplies the *format* that makes all three legible to a general audience: put it in a job ad with the salary shown. > - [EVIDENCE] The security section is not comedy exaggeration — it's an accurate enumeration of CRA/SBOM-era supplier expectations now reaching volunteer upstreams. That's what makes it a citable artifact, not just a laugh: it's the compliance burden inventory, rendered as satire by an author (Ecosyste.ms) who measures this for a living. > - [INFERENCE] "Bus factor as a KPI you're graded on" is a genuinely sharp original observation worth extracting — resilience metrics applied to unresourced solo projects measure the problem and fund none of the solution. > - [INFERENCE] For Courtney's WPOCC work: this is a shareable, non-wonky way to make the maintainer-funding case — the broker model the WPOCC pitches exists precisely because this job description is real and unpaid. Pair the satire (emotional hook) with the WPOCC model (the proposed fix). > - [STATED] The "related posts" footer signals Nesbitt's broader body of work on this theme: "Open Source Fantasy Draft," "Supplier Security Questionnaire," "Taking Roads and Bridges literally" (UN Open Source Week 2026), "Open Source vs the Invisible Hand" — a corpus worth mining for the sustainability file. > ## 📚 References > [EVIDENCE] Named/implied: **OpenSSF Scorecard**, **SBOMs**, **VEX statements**, **signed provenance attestations**, **reproducible builds**, **CVE / embargoed disclosure**, **national CERTs**, **GitHub Sponsors**, platforms (GitHub, Discord, Slack, Stack Overflow, Mastodon, Bluesky), **AI coding agents / commercial AI security scanners**, **Bus factor**. Author context (not in-text): Andrew Nesbitt, **Ecosyste.ms A rare opportunity to make a real impact in a fast-paced, high-visibility role. **Location:** Lincoln, Nebraska, USA **Employment type:** Volunteer **Term:** Permanent **Compensation:** $0 **Reports to:** The community **Direct reports:** None **Start date:** Immediate We’re looking for a passionate, self-directed engineer to take full ownership of one of the most widely deployed libraries in the ecosystem. This is a rare opportunity to make a real impact on software that millions of developers depend on every single day. If you thrive on autonomy, love working in the open, and want to wear many hats in a fast-paced environment, we’d love to hear from you. **About the role** As Senior Open Source Maintainer you will be the primary technical owner and public face of the project. You’ll drive the roadmap, ship releases, support a global user base, and champion the project across the wider industry. This is a highly visible individual contributor role with enormous scope. No two days are the same, and you’ll have full autonomy to decide how you spend your time. **What you’ll do** * Own the technical roadmap and long-term architectural direction * Review and merge contributions from a diverse, global community of open source developers * Triage and prioritise the issue tracker and feature request backlog * Maintain comprehensive documentation, examples, migration guides, and API references * Ensure project websites and documentation meet current accessibility standards * Cut releases across all supported major version lines and write the release notes * Own the CI pipeline, release automation, and package publishing infrastructure * Keep dependencies current and promptly action automated update pull requests * Support users on GitHub, Discord, Slack, Stack Overflow, Mastodon, Bluesky, and email * Ensure compatibility across all current runtimes, operating systems, and architectures * Preserve backwards compatibility, including widely relied-upon undocumented behaviour * Coordinate release timing with downstream distributions, registries, and redistributors **You’ll also** * Participate in the on-call rotation for incidents at downstream production deployments * Support enterprise consumers where project issues block business-critical systems * Define and communicate support, deprecation, and end-of-life policies for all release lines * Provide migration guidance to adopters upgrading from end-of-life releases * Coordinate advisories, CVE records, disclosure timelines, and researcher credits * Ship embargoed CVE patches across all supported version lines within the disclosure window * Produce SBOMs, VEX statements, and signed provenance attestations for every release * Maintain reproducible builds and independently verifiable release artifacts * Complete supplier security assessments and questionnaires for enterprise consumers * Remediate findings from OpenSSF Scorecard, dependency scanners, and compliance platforms **As well as** * Review high volumes of contributions from AI coding agents and automated refactoring tools * Triage vulnerability reports generated by commercial AI security scanners * Champion the project at international conferences, on podcasts, and across social media * Moderate all community spaces and enforce the Code of Conduct * Engage constructively with feedback shared on social media and public forums * Represent the project in working groups, standards bodies, and regulatory consultations * Prepare grant applications and quarterly reports for current and prospective funders * Administer domains, trademarks, signing keys, cloud accounts, and social media * Advise enterprise legal teams on licensing, patent, warranty, and export control matters * Own the succession plan: identify, recruit, and onboard your replacement **How we’ll measure success** * GitHub stars * Time to first response on issues and pull requests * Release cadence and mean time to patch for disclosed vulnerabilities * Open issue and stale pull request backlog * Dependency freshness * OpenSSF Scorecard result and other automated project scoring * Community sentiment across public channels * Downstream adoption * Bus factor **What we’re looking for** * 8+ years of professional software engineering experience * Deep expertise in one systems language and professional proficiency in at least four others * Written communication pitched to audiences from first-time contributors to Fortune 500 CISOs * Consistent release cadence with minimal dependency churn and no breaking changes * Comfortable across engineering, support, security, community, marketing, finance, and legal * Balances contributors, enterprises, security researchers, regulators, and automated systems * Comfortable receiving direct public feedback and turning it into improvements * Availability overlapping core business hours in AMER, EMEA, and APAC * Able to respond to time-sensitive security matters outside normal working hours * Provides own hardware, reliable internet, and test environments for all supported platforms **Nice to have** * Prior experience in technical writing, developer relations, or community management * Experience migrating existing codebases to memory-safe languages * Working knowledge of licence compatibility and international trademark registration * Grant writing and nonprofit financial reporting experience * Media training * An established personal audience on at least one major social platform * Conversational proficiency in a second and third language * A second job **What we offer** * 100% remote, work from anywhere in the world * Complete flexibility over your working hours * High-impact work depended on by startups and Fortune 500 companies alike * Exceptional visibility and personal brand building opportunities * Regular speaking slots at leading industry events * The opportunity to develop close working relationships with several national CERTs * A passionate, highly engaged global user community * GitHub Sponsors enabled on the repository **How to apply** Please submit a CV, a link to your GitHub profile, and a short cover letter telling us what ownership means to you. Our interview process consists of a recruiter screen, a technical interview, a system design round, a take-home exercise, and a final community panel. If you don’t meet every requirement listed above, we’d still encourage you to apply. We are committed to building a diverse and inclusive community and welcome applicants from all backgrounds. This position will remain open until filled. Due to the volume of applications received, we are unable to respond to every candidate individually. *This role is not eligible for relocation assistance or visa sponsorship.* ##### Related posts * [Announcing the 2026 Open Source Fantasy Draft](https://nesbitt.io/2026/04/30/open-source-fantasy-draft.html) Apr 30, 2026Twelve teams, snake draft, standard scoring, no salary cap * [Supplier Security Questionnaire](https://nesbitt.io/2026/08/13/supplier-security-questionnaire.html) Aug 13, 2026Estimated time to complete: 20 minutes. * [Interview with a Maintainer](https://nesbitt.io/2026/07/24/interview-with-a-maintainer.html) Jul 24, 2026Episode 214 of Green Squares. * [Taking Roads and Bridges literally](https://nesbitt.io/2026/06/30/taking-roads-and-bridges-literally.html) Jun 30, 2026Reflections on UN Open Source Week 2026 * [Open Source vs the Invisible Hand](https://nesbitt.io/2026/06/18/open-source-vs-the-invisible-hand.html) Jun 18, 2026, Now Hiring: Senior Open Source Maintainer, Andrew Nesbitt, 01m14b7wssvpb1pwvkye9bw20m.