Security Technical Program Manager

Gusto•San Francisco, CA

2d•Hybrid

About The Position

Gusto is becoming an AI-native company, and that only works if our security posture keeps pace. As the Security TPM, you'll own the definition and delivery of Gusto's vulnerability management and security operations programs across Security, AIT, R&D, Infrastructure, GRC, and Risk. You'll drive the centralized vulnerability scorecard, expand detection and monitoring coverage, harden the SDLC, and stand up the security metrics leadership runs the business on. You'll drive the timelines, manage the dependencies, head off the risk, and use AI plugins to do the work itself, so security becomes something that helps Gusto move faster instead of slowing it down.

Requirements

A history of taking programs from ambiguous to shipped in regulated environments.
5 to 8+ years leading cross-functional TPM or delivery work, with real time spent on security, infrastructure, or platform engineering.
A solid handle on vulnerability management and security operations, from scanning coverage and remediation SLAs to detection engineering, SIEM/monitoring, and identity and privileged access, and a sense for how they help Gusto move faster on AI.
A way of working where AI plugins drive your everyday delivery, and you help the people around you work the same way.
The ability to speak the language of security engineering, infrastructure, GRC, and R&D, and keep everyone rowing together.

Nice To Haves

Familiarity with the modern security stack, including vulnerability and asset scanners (e.g., Wiz, Axonius), code security (dependency and secret scanning), SIEM/detection (e.g., Panther), and identity/JIT access (e.g., Opal).
Hands-on experience using AI clients and plugins (MCPs) to generate program artifacts and take the busywork off your plate.
A working knowledge of control frameworks like SOC 1/2 and ISO 27001, plus secure SDLC practices.
A PM certification (PMP, CAPM, Scrum, or Prosci) and time spent in high-growth fintech or another regulated, fast-paced industry.

Responsibilities

Set the strategy and the roadmap for vulnerability management and security operations as Gusto becomes an AI-native company.
Define what good vulnerability management and security operations look like for an AI-first business, and set the multi-quarter vision.
Run intake and prioritization with senior stakeholders.
Decide where security should clear the way for AI speed and where it needs to hold the line.
Put AI plugins to work to pull together stakeholder input, map dependencies, and keep the roadmap grounded.
Lead delivery of the centralized vulnerability management program: coverage across code, cloud, data, and edge; CSPM/DSPM, container scanning, dependency and secrets detection, and owner-based remediation routing to closure.
Lead security operations delivery: expand high-risk detection and alerting across systems and vendors, impersonation and privileged-access logging, SIEM integration, insider-risk telemetry, and logging of agentic activity.
Stand up the daily security-health and vulnerability-management metrics dashboards leadership uses to run the business, and drive monthly vulnerability reporting.
Build security workflows that run on AI plugins by default, so coverage checks and evidence collection happen automatically.
Build the plans, manage scope and risk, track milestones, and deliver against every audit and regulatory commitment.
Roll out new controls, like risk-scored PR review, JIT privileged access, and secrets management, and help teams adopt them with training, comms, and runbooks.
Keep a busy, fast-moving group of stakeholders aligned with clear, steady updates on where things stand.
Hold vendors and partners to their commitments and push them toward AI-forward ways of working.
Stay on top of how every workstream is tracking, raise flags early, and get teams unstuck when they stall.
Watch the program budget, tooling spend, and implementation costs.