Senior Staff Technical Program Manager | Product Security

ServiceNow•Santa Clara, CA

14h•Hybrid

About The Position

The Senior Staff Technical Program Manager supports Product Security within ServiceNow’s Security Organization. The role turns security strategy and ambiguous initiatives into sequenced, measurable workstreams and drives technical programs from intake through closure. It owns program plans, sequencing, technical tradeoffs, delivery outcomes, and the evidence required to determine completion. The position reports directly to the VP of Product Security. The role coordinates cross-team dependencies and releases, including situations where Product Security gates an engineering release. It is the first point of contact for delivery escalations when security work is blocked or contested, resolving issues with engineering where possible and escalating with a recommendation when necessary. The role works with Product Security directors and team leads as a delivery partner, engineering teams as its primary day-to-day partners, and Business Operations to translate strategic direction into sequenced workstreams and provide delivery status and prioritization escalations. The position requires attendance at the Santa Clara or San Diego office at least two days per week. For the specified location, the base pay range is $190,900–$334,100, plus equity where applicable, variable/incentive compensation, and benefits. Compensation varies based on qualifications, skills, competencies, and work location.

Requirements

Experience leveraging or critically considering how to integrate AI into work processes, decision-making, or problem-solving; examples include AI-powered tools, workflow automation, AI-driven insights, or exploring AI’s impact.
12 years of technical program or project management experience, including 3 or more years in security, product security, or a closely adjacent technical domain; the posting also allows similar experience plus education.
Experience independently running multi-team programs from intake to close.
Hands-on software development background, or sufficient time embedded with engineering teams to read a codebase, follow architecture discussions, and challenge engineering estimates without translation.
Ability to turn an ambiguous strategic goal into a sequenced, resourced delivery plan that stakeholders commit to, including communicating when a timeline is not achievable.
Experience in a large-scale product engineering organization that ships continuously at high volume and has complex dependencies and releases.
Ability to drive delivery through teams that do not report to the role, including holding a release or negotiating an exception under pressure.
Familiarity with Secure Development Lifecycle frameworks such as NIST 800-218, BSIMM, and Microsoft SDL.
Familiarity with Software Development Lifecycle frameworks such as Agile, Scrum, and CI/CD.
Bachelor’s degree in a technical or related field, such as computer science, engineering, or information security, or equivalent practical experience.

Nice To Haves

Certifications that strengthen the candidate’s profile, such as PMP, CISSP, CSM, or Security+.

Responsibilities

Translate strategic direction and ambiguous initiatives into defined workstreams with owners, dependencies, milestones, and a defensible sequence.
Determine program sequencing, including prerequisites and which work should be staged or run in parallel.
Own technical program delivery for secure-by-default initiatives, tooling rollouts, and remediation campaigns from intake through closure and measurement.
Coordinate cross-team dependencies, launches, sequencing, and critical paths where Product Security gates an engineering release.
Resolve engineering-facing delivery blockers or contested security work, and escalate with a recommendation when resolution requires higher authority.
Make program-level decisions about structure, sequencing, staging, technical tradeoffs, and completion evidence.
Recommend prioritization tradeoffs across programs and workstreams, including whether initiatives should be stopped, deferred, or absorbed.
Identify when strategy cannot be sequenced as written and recommend scope or timeline changes.
Map program dependencies across engineering, establish reliable delivery status, and provide delivery information to Business Operations.
Escalate cross-program conflicts, aging risk, and sequencing infeasibility for prioritization.
Influence how security requirements enter the Software Development Lifecycle upstream and help reduce downstream remediation load.