Security Program Manager

Norm Ai

3d•$140,000 - $155,000•Hybrid

About The Position

Norm Ai, the leading Legal & Compliance AI company, has a client base with a combined $30 trillion in assets under management. By turning legal code into AI code, Norm enables enterprises to move faster and more comprehensively in their legal and compliance processes with reliability and trust. Norm’s platform combines frontier AI, proprietary legal reasoning systems, and embedded legal and regulatory expertise. We have recently raised more than $140 million, backed by Blackstone, Bain Capital, Vanguard, Citi, New York Life, TIAA, Coatue, Craft Ventures, Henry R. Kravis (KKR co-founder), and Marc Benioff (Salesforce CEO). Norm Ai pioneered Legal Engineering, the process that empowers lawyers to build and supervise domain-specific AI agents with Norm’s proprietary suite of no-code software tools. We hired dozens of lawyers from premier U.S. law firms and trained them as Legal Engineers, who specialize in Large Language Model powered legal workflows. Norm Ai technology is deployed inside many of the largest and most consequential institutions in the world. The company is growing quickly and hiring across all teams. AI Fluency: Norm Ai expects all team members to be fluent in AI. Successful candidates actively use AI in their day-to-day work to support thinking, creation, and problem-solving. They use it to improve the quality and speed of their work and to continuously refine how work gets done end-to-end. Candidates should be prepared to demonstrate and discuss their AI usage throughout the interview process, including concrete examples of tools, workflows, and outcomes. We look for practical, hands-on experience, not theoretical familiarity. This Role: The Security Program Manager at Norm Ai is a hybrid between a GRC Manager and a Program Manager within the Office of the Chief Security Officer. You will own the execution of Norm Ai's security compliance programs, serve as the CSO's operational right hand, and drive cross-functional security and compliance initiatives across Engineering, Legal, IT, and the affiliated Norm Law practice. Security is your primary function, but this role sits at the intersection of compliance execution, risk management, and day-to-day program operations. You are the person who brings structure to ambiguity and makes sure nothing falls through the cracks.

Requirements

5+ years of experience in security program management, GRC, or a related security operations role.
Hands-on experience managing compliance programs across at least two major frameworks (e.g., SOC 2, ISO 27001, GDPR, HIPAA). You don't need to be a security controls expert, but you need to know how audits work and how to run one.
Working knowledge of risk management frameworks such as NIST RMF, ISO 31000, or FAIR.
Experience with GRC and compliance automation tooling; we use Vanta.
Strong project management skills with the ability to manage multiple concurrent initiatives; experience with Linear, Jira, Notion, or equivalent tools.
Comfortable using AI tools to accelerate security and compliance work.
Experience coordinating external audits and working directly with auditors.
Familiar enough with cloud environments (AWS) and developer tooling (GitHub) to have substantive conversations with engineering teams.
Proven ability to drive cross-functional work without direct authority.
Clear, concise communicator; experienced preparing executive-level updates and board materials.
Background in a fast-paced startup, scale-up, or boutique consulting environment where you had to build programs with limited resources.

Nice To Haves

Experience in a strategic operations role within a security or technology organization.
Background in government, financial services, or other highly regulated industries.
Relevant certifications: CISSP, CISM, CRISC, CISA, CGRC, or PMP.

Responsibilities

Own and mature the GRC program across SOC 2 Type II, ISO 27001, and other applicable frameworks, including control mapping, evidence collection, gap analysis, remediation tracking, and audit coordination.
Serve as the primary liaison with external auditors and certification bodies; manage the full audit lifecycle from scoping and evidence gathering through report issuance.
Build and maintain the enterprise risk register; conduct periodic risk assessments and track risk treatment plans to closure with clear stakeholder accountability.
Lead the vendor security assessment program: evaluate third-party security posture, manage security questionnaires, and track remediation to completion.
Maintain and update security policies, standards, and procedures; own the policy review lifecycle from drafting through approval.
Manage priorities, track deliverables, and maintain operational cadence across the security organization including but not limited to staff meetings, quarterly planning, board reporting.
Drive cross-functional security initiatives and ensure alignment between Security, Engineering, Product, Legal, IT, and Business teams.
Manage security OKRs, KPIs, and metrics reporting; prepare dashboards and executive summaries for leadership and board audiences.
Coordinate incident response program readiness: maintain runbooks, organize tabletop exercises, and drive post-incident reviews to ensure lessons learned are captured and tracked.
Design, implement, and manage the security awareness and training program, including phishing simulations and effectiveness reporting.
Participate in client due diligence reviews and manage the intake process for inbound security questionnaires.
Support business continuity and disaster recovery planning in coordination with Engineering and IT.

Benefits

401(k) plan with an employer match
Top-tier insurance coverage, encompassing health, dental, hospital, accident, and vision plans
Relocation reimbursement for candidates needing to relocate to NYC
Fast-paced learning environment where professional growth is constant

Stand Out From the Crowd

Upload your resume and get instant feedback on how well it matches this job.

Upload and Match Resume