Now Hiring: Senior Open Source Maintainer

招聘启事：资深开源项目维护者

We’re looking for a passionate, self-directed engineer to take full ownership of one of the most widely deployed libraries in the ecosystem. This is a rare opportunity to make a real impact on software that millions of developers depend on every single day. If you thrive on autonomy, love working in the open, and want to wear many hats in a fast-paced environment, we’d love to hear from you. 我们正在寻找一位充满激情、具备自主能力的工程师，来全面负责生态系统中部署最广泛的库之一。这是一个难得的机会，能够让你对数百万开发者每天依赖的软件产生真正的深远影响。如果你渴望自主权，热爱开源协作，并希望在快节奏的环境中身兼数职，我们非常期待你的加入。

About the role

关于职位

As Senior Open Source Maintainer you will be the primary technical owner and public face of the project. You’ll drive the roadmap, ship releases, support a global user base, and champion the project across the wider industry. This is a highly visible individual contributor role with enormous scope. No two days are the same, and you’ll have full autonomy to decide how you spend your time. 作为资深开源维护者，你将是该项目的主要技术负责人和公众形象代表。你将推动路线图规划、发布版本、支持全球用户群，并在更广泛的行业内推广该项目。这是一个高曝光度的个人贡献者职位，职责范围极广。每天的工作内容都各不相同，你将拥有完全的自主权来决定如何分配你的时间。

What you’ll do

你的职责

Own the technical roadmap and long-term architectural direction
Review and merge contributions from a diverse, global community of open source developers
Triage and prioritise the issue tracker and feature request backlog
Maintain comprehensive documentation, examples, migration guides, and API references
Ensure project websites and documentation meet current accessibility standards
Cut releases across all supported major version lines and write the release notes
Own the CI pipeline, release automation, and package publishing infrastructure
Keep dependencies current and promptly action automated update pull requests
Support users on GitHub, Discord, Slack, Stack Overflow, Mastodon, Bluesky, and email
Ensure compatibility across all current runtimes, operating systems, and architectures
Preserve backwards compatibility, including widely relied-upon undocumented behaviour
Coordinate release timing with downstream distributions, registries, and redistributors
负责技术路线图和长期架构方向
审查并合并来自全球多元化开源开发者社区的贡献
对问题追踪器和功能请求积压进行分类和优先级排序
维护全面的文档、示例、迁移指南和 API 参考
确保项目网站和文档符合当前的无障碍标准
在所有支持的主要版本线上发布版本并撰写发行说明
负责 CI 流水线、发布自动化和包发布基础设施
保持依赖项更新，并及时处理自动更新的 Pull Request
在 GitHub、Discord、Slack、Stack Overflow、Mastodon、Bluesky 和电子邮件上为用户提供支持
确保在所有当前运行时、操作系统和架构上的兼容性
保持向后兼容性，包括那些被广泛依赖的未文档化行为
协调下游发行版、注册中心和再分发商的发布时间

You’ll also

你还需要

Participate in the on-call rotation for incidents at downstream production deployments
Support enterprise consumers where project issues block business-critical systems
Define and communicate support, deprecation, and end-of-life policies for all release lines
Provide migration guidance to adopters upgrading from end-of-life releases
Coordinate advisories, CVE records, disclosure timelines, and researcher credits
Ship embargoed CVE patches across all supported version lines within the disclosure window
Produce SBOMs, VEX statements, and signed provenance attestations for every release
Maintain reproducible builds and independently verifiable release artifacts
Complete supplier security assessments and questionnaires for enterprise consumers
Remediate findings from OpenSSF Scorecard, dependency scanners, and compliance platforms
参与下游生产部署事故的轮值响应
在项目问题阻碍业务关键系统时，为企业用户提供支持
定义并传达所有发布线的支持、弃用和生命周期结束政策
为从已停止支持的版本升级的用户提供迁移指导
协调安全公告、CVE 记录、披露时间表和研究人员致谢
在披露窗口内，为所有支持的版本线发布受限的 CVE 补丁
为每次发布生成 SBOM、VEX 声明和签名的来源证明
维护可复现的构建和可独立验证的发布制品
为企业消费者完成供应商安全评估和问卷调查
修复来自 OpenSSF Scorecard、依赖扫描器和合规平台的发现问题

As well as

以及

Review high volumes of contributions from AI coding agents and automated refactoring tools
Triage vulnerability reports generated by commercial AI security scanners
Champion the project at international conferences, on podcasts, and across social media
Moderate all community spaces and enforce the Code of Conduct
Engage constructively with feedback shared on social media and public forums
Represent the project in working groups, standards bodies, and regulatory consultations
Prepare grant applications and quarterly reports for current and prospective funders
Administer domains, trademarks, signing keys, cloud accounts, and social media
Advise enterprise legal teams on licensing, patent, warranty, and export control matters
Own the succession plan: identify, recruit, and onboard your replacement
审查来自 AI 编码代理和自动化重构工具的大量贡献
对商业 AI 安全扫描器生成的漏洞报告进行分类
在国际会议、播客和社交媒体上推广该项目
管理所有社区空间并执行行为准则
以建设性的方式回应社交媒体和公共论坛上的反馈
在工作组、标准机构和监管咨询中代表该项目
为现有和潜在的资助者准备拨款申请和季度报告
管理域名、商标、签名密钥、云账户和社交媒体
就许可、专利、保修和出口管制事宜为企业法律团队提供建议
负责继任计划：识别、招募并引导你的继任者

How we’ll measure success

成功衡量标准

GitHub stars
Time to first response on issues and pull requests
Release cadence and mean time to patch for disclosed vulnerabilities
Open issue and stale pull request backlog
Dependency freshness
OpenSSF Scorecard result and other automated project scoring
Community sentiment across public channels
Downstream adoption
Bus factor
GitHub 星标数
对 Issue 和 Pull Request 的首次响应时间
发布节奏及披露漏洞的平均修复时间
未解决的 Issue 和陈旧的 Pull Request 积压情况
依赖项的新鲜度
OpenSSF Scorecard 结果及其他自动化项目评分
公共渠道中的社区情绪
下游采用率
“巴士系数”（Bus factor，即项目核心人员流失对项目的影响程度）

What we’re looking for

我们寻找的人才

8+ years of professional software engineering experience
Deep expertise in one systems language and professional proficiency in at least four others
Written communication pitched to audiences from first-time contributors to Fortune 500 CISOs
Consistent release cadence with minimal dependency churn and no breaking changes
Comfortable across engineering, support, security, community, marketing, finance, and legal
Balances contributors, enterprises, security researchers, regulators, and automated systems
Comfortable receiving direct public feedback and turning it into improvements
Availability overlapping core business hours in AMER, EMEA, and APAC
Able to respond to time-sensitive security matters outside normal working hours
Provides own hardware, reliable internet, and test environments for all supported platforms
8 年以上专业软件工程经验
精通一门系统级编程语言，并熟练掌握至少四门其他语言
具备能够面向从初次贡献者到财富 500 强 CISO 等不同受众的写作沟通能力
保持稳定的发布节奏，尽量减少依赖项变动，且不引入破坏性变更
能够胜任工程、支持、安全、社区、市场、财务和法律等多方面工作
能够平衡贡献者、企业、安全研究人员、监管机构和自动化系统的需求
乐于接受直接的公众反馈并将其转化为改进措施
工作时间需与美洲、欧洲、中东、非洲及亚太地区的核心业务时间重叠
能够在正常工作时间之外响应时间敏感的安全问题
自备硬件、可靠的网络以及所有支持平台的测试环境

Nice to have

加分项

Prior experience in technical writing, developer relations, or community management
Experience migrating existing codebases to memory-safe languages
Working knowledge of licence compatibility and international trademark registration
Grant writing and nonprofit financial reporting experience
Media training
An established personal audience on at least one major social platform
Conversational proficiency in a second and third language
A second job
具备技术写作、开发者关系或社区管理经验
有将现有代码库迁移至内存安全语言的经验
具备许可兼容性和国际商标注册的相关知识
具备拨款申请和非营利组织财务报告经验
接受过媒体培训
在至少一个主流社交平台上拥有一定的个人影响力
能用第二或第三语言进行日常对话
拥有一份兼职工作

What we offer

我们提供

100% remote, work from anywhere in the world
Complete flexibility over your working hours
High-impact work depended on by startups and Fortune 500 companies alike
Exceptional visibility and personal brand building opportunities
Regular speaking slots at leading industry events
The opportunity to develop close working relationships with several national CERTs
A passionate, highly engaged global user community
GitHub Sponsors enabled on the repository
100% 远程办公，全球任何地点均可
工作时间完全灵活
从事受初创公司和财富 500 强企业共同依赖的高影响力工作
卓越的曝光度和个人品牌建设机会
在行业领先活动中的定期演讲机会
与多个国家级 CERT（计算机应急响应小组）建立紧密工作关系的机会
充满激情、高度活跃的全球用户社区
仓库已开启 GitHub Sponsors 赞助功能

How to apply

如何申请

Please submit a CV, a link to your GitHub profile, and a short cover letter telling us what ownership means to you. Our interview process consists of a recruiter screen, a technical interview, a system design round, a take-home exercise. 请提交简历、GitHub 个人主页链接，以及一封简短的求职信，告诉我们“所有权（Ownership）”对你意味着什么。我们的面试流程包括：招聘人员筛选、技术面试、系统设计轮、以及一项居家作业。