Sr. Security Program Manager

What You’ll Do (Essential Responsibilities)

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Program & Project Coordination

Own the security program roadmap at the execution level across all security functions

Track initiatives, timelines, and blockers without requiring VP involvement day-to-day

Coordinate cross-functional dependencies across Security Operations, Vulnerability Management, Security Engineering, Identity & Access Management, Cloud Security, IT, Legal, and Compliance.

Act with delegated authority from the VP on operational execution matters

Metrics, Reporting & Dashboards

Build and maintain the security metrics framework — vulnerability SLA compliance, incident-response timelines, audit-finding closure, and training completion

Produce dashboards for board reporting, SEC disclosure prep, audit-committee updates, and customer security reviews

Translate raw tool and team data into a coherent program narrative for executive and external audiences

Security Operations & Security Program Coordination

Partner with Security Operations, Engineering, and IT teams to coordinate security initiatives, remediation efforts, and operational follow-through across the security program.

Coordinate security team evidence collection for SOC 2, ISO 27001, PCI-DSS, and customer audits.

Serve as the security team's interface to the General Counsel's Compliance team during audits and regulatory activities.

Track audit findings, operational remediation activities, and follow issues through closure to improve the organization's overall security posture.

Security Governance & Operational Enablement

Own the security policy lifecycle: annual review, version control, approval, accessibility

Own the security awareness and training program including phishing simulations

Manage security-tool contracts, renewals, license utilization, and MSSP relationship logistics

This job description reflects management’s assignment of essential functions; and nothing in this herein restricts management’s right to assign or reassign duties and responsibilities to this job at any time.

Managerial Responsibilities

Non-Manager: No oversight or accountability for others, an individual contributor.

What You Need (Education/Licenses/Certifications, Experience, Knowledge, Technical Skills and Abilities)

5–8+ years of experience working within an Information Security or Cybersecurity organization, with increasing responsibility for leading security programs, coordinating cross-functional initiatives, and driving operational execution.

Experience partnering closely with technical security teams such as Security Operations, Vulnerability Management, Cloud Security, Identity & Access Management, Security Engineering, or Incident Response.

Experience working in close partnership with Engineering and Security teams to drive remediation efforts, operational improvements, and security program execution.

Ability to translate operational security priorities, risks, and technical initiatives into executive reporting, program execution, and actionable plans for cross-functional stakeholders.

Solid understanding of operational security concepts including vulnerability management, incident response, cloud security, identity and access management, and security monitoring.

Working familiarity with security frameworks and standards such as NIST CSF, SOC 2, ISO 27001, and PCI-DSS, with the ability to apply them in support of operational security programs.

Strong written and verbal communication skills with the ability to communicate effectively with technical teams, executives, and cross-functional stakeholders.

Experience coordinating security audits by partnering with technical teams on evidence collection, remediation tracking, and driving findings through closure.

What Would be Nice (Preferred Skills & Experience)

Experience in financial services, fintech, SaaS, or other highly regulated industries.

Experience supporting or coordinating operational security programs within a mature Information Security organization.

Familiarity with modern security and regulatory frameworks such as GDPR, NIS2, or DORA.

Professional certifications such as CISSP, CISM, or PMP.

Experience supporting executive cybersecurity reporting, SEC cybersecurity disclosures, or Audit Committee reporting.

Experience partnering with Managed Security Service Providers (MSSPs) or other security technology vendors.

Success Metrics -First Year

Roadmap documented, socialized, and tracked within 60 days.

Security metrics dashboard established and reported monthly within 90 days.

Build trusted partnerships across Security Operations, Engineering, IT, and other cross-functional teams while improving visibility into security program execution.

Zero missed audit evidence deadlines during the first audit cycle.

Improve visibility into operational security initiatives by ensuring remediation efforts, program milestones, and key security metrics are consistently tracked and communicated to leadership.

VP time spent on day-to-day operational coordination materially reduced, enabling greater focus on strategic initiatives, customer engagement, and executive priorities.