Bharath N.

About Bharath N.

FOSS Compliance Engineer and Consultant at Ernst & Young LLP with 3+ years of experience in open-source governance, SBOM automation, and software composition analysis.I work with industry-standard compliance tooling — SCANOSS Workbench, FOSSology, ScanCode Toolkit, Syft, and Black Duck Protex — delivering end-to-end compliance workflows for global clients. My work spans generating SBOMs (SPDX, CycloneDX), authoring FOSS Disclosure Documents, and SC & BI reports, and building automated SCA pipelines via GitHub Actions aligned with OpenChain (ISO/IEC 5230) standards.On the automation side, I build Python scripts (Pandas, NumPy, OpenPyXL) to extract and process compliance data, and author YAML workflows to orchestrate tooling at scale. I also have a strong Java background with Spring Boot, Microservices, and REST APIs.Currently exploring next-generation BOM formats — CBOM, QBOM, and AI-BOM — and working to extend automation workflows to cover these emerging standards.Motivated by solving complex problems at the intersection of software engineering and open-source governance, with a focus on helping organizations adopt OSS responsibly.

Experience

1. Consultant

   EY

   Sep 2025 — Present · Bengaluru, IN

   Leading FOSS compliance and SBOM automation initiatives at EY within the Universal-OSS-Compliance framework. Integrating tools such as FOSSology, ScanCode Toolkit, SCANOSS, and Syft into automated CI/CD workflows to streamline open-source governance at scale.→ Design and maintain GitHub Actions pipelines (YAML) to orchestrate SCA tool execution, SBOM generation, and license dashboard publishing aligned with ISO/IEC 5230 (OpenChain) standards.→ Build Python automation scripts (Pandas, NumPy, OpenPyXL) to extract and process compliance data from Excel-based datasets.→ Actively researching and prototyping automation workflows for emerging BOM formats: CBOM (Cryptography BOM), QBOM (Quality BOM), and AI-BOM (Artificial Intelligence BOM).→ Mentoring junior engineers on open-source governance practices and compliance toolchain adoption.