Technical Program Manager, Security

About the Role

Security work at Brain Co. does not stay inside the security team. Audit readiness needs Engineering, HR, Finance, and Legal. Enterprise deals stall on security questionnaires and customer security reviews. Identity spans IT and Security, and neither can finish it alone. Vulnerability remediation lands on engineering teams that don't report to us. Someone has to own the delivery of that work end-to-end: the plan, the owners, the cadence, and the finish line. That's this role.

Brain Co. carries one of the most demanding regulatory loads of any company our size: SOC 2 Type II and HIPAA in place today, with ISO 27001, NIST 800-171, and FedRAMP/GovRAMP on the near-term roadmap. As our first Technical Program Manager on the Security team, you'll run the security programs that touch every part of the company. You'll report to the Head of Security as an individual contributor with the scope and trust to define how security programs run here.

What You'll Work On

• Drive security sales enablement operations: security questionnaires, RFP security sections, the trust portal, DPA/BAA intake, and customer security reviews. Build the reusable answer library, evidence packages, and intake process in close partnership with GRC.
• Complete Vendor Security Reviews for internal/corporate vendors and vendors supporting customer-facing products/services, and streamline the vendor management process.
• Support audit readiness as a delivery program: own the plan behind SOC 2 Type II and HIPAA today and the path through ISO 27001, NIST 800-171, and FedRAMP/GovRAMP, including control owners, evidence collection, gap remediation tracking, auditor logistics, and readiness milestones.
• Turn vulnerability management into a continuous, self-managing program: definitions, SLAs by severity, automated routing to engineering teams, an exception process, and self-updating dashboards.
• Support the planning and tracking of GRC-related continuous monitoring activities, including access provisioning/deprovisioning evidence, access reviews, BCP and IR testing, and configuration reviews.
• Drive security-heavy product launches when security is load-bearing, embedding with product and engineering teams to ensure threat modeling, security reviews, and sign-offs happen early.
• Drive cross-functional corporate security programs across SaaS security posture and shadow IT, identity, insider risk, physical and office security, and security awareness and phishing programs.
• Own the operating process around incident management: escalation paths, comms templates, tabletop exercises, incident commander support, and post-incident reviews.
• Run the security team's operating cadence: roadmap and planning, program status, metrics and reporting to leadership, third-party risk operations, and strategic initiatives.
• Be the person who knows the state of the most critical security programs: who owns what, what's at risk, what's blocked, and what leadership needs to hear before they ask.

You Might Be a Great Fit If You…

• Have 5+ years in technical program or project management, including time spent on security, infrastructure, IT, or compliance programs.
• Have run cross-functional programs where you had zero formal authority over the people doing the work — and still landed them.
• Can hold your own with engineers: read an IAM policy, follow a cloud or Kubernetes architecture discussion, and tell the difference between a CVE that matters and one that doesn't.
• Have run or been deep in at least one real audit cycle — SOC 2, HIPAA, ISO 27001, FedRAMP, or equivalent — on the delivery side, owning evidence and remediation.
• Have supported the security side of enterprise deals: questionnaires, customer security reviews, and the calls where a customer's security team asks the hard question.
• Build systems instead of reporting status.
• Are comfortable being the first TPM in a function, to build the systems driving the outcomes.
• Write clearly.
• Close loops compulsively.

Bonus Points For

• High level privacy/legal documentation (e.g. DPAs, BAAs, etc.) review experience.
• Hands-on experience with FedRAMP/GovRAMP, IL4/IL5, or equivalent government-customer compliance requirements, including on-prem deployments.
• A practitioner background in security engineering, IT, or GRC that you still use.
• Fluency with compliance automation and security tooling — Vanta, Drata, Secureframe, vulnerability scanners, identity platforms.
• Experience at an AI or ML-heavy company.
• Time as an incident commander or incident process owner.