Technical Program Manager, Security
Brainco · San Francisco Bay Area
About this role
## Technical Program Manager, Security ### About Brain Co. Brain Co. builds AI-native operating systems for large, regulated institutions. Each system is built for a specific industry, powered by agents that push real workflows forward. Underneath it all is **Atlas**, our proprietary platform that keeps customers in control, secure by design, and never locked into one model. ### Why now Brain Co. is entering its next phase of production deployments on a national scale, with an elite team and a growing footprint across **government, insurance, health, and financial services**. Every project ships to production and is expected to create measurable customer value and impact. ### Role summary As our **first Technical Program Manager on the Security team**, you’ll run security programs that touch every part of the company—from unblocking enterprise and government deals, to owning identity and incident processes, to turning vulnerability management into a continuous, self-managing system. This is **not** ticket-herding. You’ll be technical enough to review IAM policies and architecture, and operational enough to turn recurring chaos into a system that runs without you in the room. You’ll report to the **Head of Security** as an individual contributor with the scope and trust to define how security programs run here. --- ## What you’ll work on ### 1) Security sales enablement operations - Operational backbone of the customer trust surface - Security questionnaires, RFP security sections, trust portal - DPA/BAA intake - Customer security reviews - Build reusable **answer libraries**, **evidence packages**, and an intake process so deals don’t restart from scratch ### 2) Vendor management process - Complete vendor security reviews for both: - internal/corporate vendors - vendors supporting customer-facing products/services - Streamline and improve the vendor management process ### 3) Audit readiness as a delivery program - Own the plan behind **SOC 2 Type II** and **HIPAA** today - Drive the path through **ISO 27001**, **NIST 800-171**, and **FedRAMP/GovRAMP** - Work with GRC on: - control owners - evidence collection - gap remediation tracking - auditor logistics - readiness milestones ### 4) Continuous vulnerability management - Turn vulnerability management into a continuous, self-managing program - Define: - severity definitions and SLAs - automated routing to engineering owners - an exception process people actually use - Dashboards that stay current without constant manual updates ### 5) GRC-related continuous monitoring planning - Support planning and tracking of continuous monitoring activities, including evidence for: - access provisioning/deprovisioning - access reviews cadence - BCP and IR testing - configuration reviews ### 6) Security-heavy product launches - Embed early with product/engineering/security/IT when security is load-bearing - Ensure threat modeling, security reviews, and sign-offs happen early - Surface launch blockers before launch week ### 7) Cross-functional corporate security programs Drive programs across the company, including: - SaaS security posture and shadow IT - identity - insider risk - physical and office security - security awareness and phishing You’ll give these programs owners, cadence, and measurable coverage. ### 8) Incident management operations - Operating process for escalation paths and communications templates - Tabletop exercises - Incident commander su
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.