A single job posting asks for a volunteer Senior Open Source Maintainer with full ownership, enterprise security duties, and on-call obligations, while offering $0 and no benefits. The ad makes explicit the unpaid scope and self-replacement requirement.
A public job posting dated 2026-08-28 seeks a Senior Open Source Maintainer for a widely deployed library, listing duties from roadmap ownership and release management to CVE coordination and SBOM production. The employment type is "Volunteer", term "Permanent", compensation "$0", and it reports to "The community".1
Context
The posting appears on a personal site, nesbitt.io, rather than an established open source foundation or company career page. It asks applicants to submit a CV, GitHub profile, and cover letter, and to pass a five-stage interview. This context makes the offer plausible as either genuine community hiring or a pointed commentary on uncompensated maintainer labor.1
Assessment
What is new is the explicit transfer of enterprise-grade obligations onto an unpaid volunteer: the role includes on-call incident response at downstream production deployments, embargoed CVE patching, reproducible builds, and supplier security assessments. These are typically compensated positions at vendors or foundations. The ad thereby surfaces the gap between the de facto responsibility of maintainers and the economic value assigned to them.1
Caveats
AI hypothesisThe document is a single source, possibly satirical or deliberately exaggerated. No project or library is named, and no verifiable applicant process exists. Treating the posting as evidence of actual practice requires corroboration; however, as a cultural artifact it accurately reflects known pressures in open source sustainability.1
Location: Lincoln, Nebraska, USA Employment type: Volunteer Term: Permanent Compensation: $0 Reports to: The community Direct reports: None Start date: Immediate
We’re looking for a passionate, self-directed engineer to take full ownership of one of the most widely deployed libraries in the ecosystem. This is a rare opportunity to make a real impact on software that millions of developers depend on every single day. If you thrive on autonomy, love working in the open, and want to wear many hats in a fast-paced environment, we’d love to hear from you.
About the role
As Senior Open Source Maintainer you will be the primary technical owner and public face of the project. You’ll drive the roadmap, ship releases, support a global user base, and champion the project across the wider industry. This is a highly visible individual contributor role with enormous scope. No two days are the same, and you’ll have full autonomy to decide how you spend your time.
What you’ll do
Own the technical roadmap and long-term architectural direction
Review and merge contributions from a diverse, global community of open source developers
Triage and prioritise the issue tracker and feature request backlog
Maintain comprehensive documentation, examples, migration guides, and API references
Ensure project websites and documentation meet current accessibility standards
Cut releases across all supported major version lines and write the release notes
Own the CI pipeline, release automation, and package publishing infrastructure
Keep dependencies current and promptly action automated update pull requests
Support users on GitHub, Discord, Slack, Stack Overflow, Mastodon, Bluesky, and email
Ensure compatibility across all current runtimes, operating systems, and architectures
Preserve backwards compatibility, including widely relied-upon undocumented behaviour
Coordinate release timing with downstream distributions, registries, and redistributors
You’ll also
Participate in the on-call rotation for incidents at downstream production deployments
Support enterprise consumers where project issues block business-critical systems
Define and communicate support, deprecation, and end-of-life policies for all release lines
Provide migration guidance to adopters upgrading from end-of-life releases
Coordinate advisories, CVE records, disclosure timelines, and researcher credits
Ship embargoed CVE patches across all supported version lines within the disclosure window
Produce SBOMs, VEX statements, and signed provenance attestations for every release
Maintain reproducible builds and independently verifiable release artifacts
Complete supplier security assessments and questionnaires for enterprise consumers
Remediate findings from OpenSSF Scorecard, dependency scanners, and compliance platforms
As well as
Review high volumes of contributions from AI coding agents and automated refactoring tools
Triage vulnerability reports generated by commercial AI security scanners
Champion the project at international conferences, on podcasts, and across social media
Moderate all community spaces and enforce the Code of Conduct
Engage constructively with feedback shared on social media and public forums
Represent the project in working groups, standards bodies, and regulatory consultations
Prepare grant applications and quarterly reports for current and prospective funders
Administer domains, trademarks, signing keys, cloud accounts, and social media
Advise enterprise legal teams on licensing, patent, warranty, and export control matters
Own the succession plan: identify, recruit, and onboard your replacement
How we’ll measure success
GitHub stars
Time to first response on issues and pull requests
Release cadence and mean time to patch for disclosed vulnerabilities
Open issue and stale pull request backlog
Dependency freshness
OpenSSF Scorecard result and other automated project scoring
Community sentiment across public channels
Downstream adoption
Bus factor
What we’re looking for
8+ years of professional software engineering experience
Deep expertise in one systems language and professional proficiency in at least four others
Written communication pitched to audiences from first-time contributors to Fortune 500 CISOs
Consistent release cadence with minimal dependency churn and no breaking changes
Comfortable across engineering, support, security, community, marketing, finance, and legal
Balances contributors, enterprises, security researchers, regulators, and automated systems
Comfortable receiving direct public feedback and turning it into improvements
Availability overlapping core business hours in AMER, EMEA, and APAC
Able to respond to time-sensitive security matters outside normal working hours
Provides own hardware, reliable internet, and test environments for all supported platforms
Nice to have
Prior experience in technical writing, developer relations, or community management
Experience migrating existing codebases to memory-safe languages
Working knowledge of licence compatibility and international trademark registration
Grant writing and nonprofit financial reporting experience
Media training
An established personal audience on at least one major social platform
Conversational proficiency in a second and third language
A second job
What we offer
100% remote, work from anywhere in the world
Complete flexibility over your working hours
High-impact work depended on by startups and Fortune 500 companies alike
Exceptional visibility and personal brand building opportunities
Regular speaking slots at leading industry events
The opportunity to develop close working relationships with several national CERTs
A passionate, highly engaged global user community
GitHub Sponsors enabled on the repository
How to apply
Please submit a CV, a link to your GitHub profile, and a short cover letter telling us what ownership means to you. Our interview process consists of a recruiter screen, a technical interview, a system design round, a take-home exercise, and a final community panel.
If you don’t meet every requirement listed above, we’d still encourage you to apply.
We are committed to building a diverse and inclusive community and welcome applicants from all backgrounds. This position will remain open until filled. Due to the volume of applications received, we are unable to respond to every candidate individually.
This role is not eligible for relocation assistance or visa sponsorship.
The source text above remains the property of its publisher and is reproduced for commentary.
