Senior Staff Technical Program Manager | Product Security

ServiceNow•Santa Clara, CA

1d•$190,900 - $334,100•Hybrid

About The Position

The Senior Staff Technical Program Manager in Product Security ensures that technical programs land on time by translating security strategy and ambiguous initiatives into defined, sequenced workstreams and driving them to measured closure. The role owns how programs are structured, sequenced, and staged, including dependencies, milestones, technical tradeoffs, completion criteria, and evidence of closure. It delivers secure-by-default initiatives, tooling rollouts, and remediation campaigns from intake through closure and measurement, and coordinates cross-team dependencies and releases where Product Security gates engineering releases. The role is the first stop for engineering-facing delivery escalations, resolving blockers at the engineering level when possible and escalating with recommendations when needed. It works closely with Product Security directors and team leads, engineering partner teams, and Business Operations. It reports directly to the VP of Product Security. The position requires working at least two days per week in the Santa Clara or San Diego office. Success includes mapping assigned programs and engineering dependencies, providing reliable delivery status, shaping ambiguous initiatives into sequenced outcomes, influencing the upstream integration of security requirements into the SDLC, and reducing downstream remediation load.

Requirements

12 years of technical program or project management experience, including 3+ years in security, product security, or a closely adjacent technical domain; independently run multi-team programs from intake to close, or similar experience plus education.
Hands-on software development background, or sufficient embedded experience with engineering teams to read a codebase, follow architecture discussions, and challenge engineering estimates.
Ability to turn an ambiguous strategic goal into a sequenced, resourced delivery plan stakeholders commit to, including identifying when a proposed timeline is not achievable.
Experience in a large-scale product engineering organization shipping continuously at high volume, with associated dependency and release complexity.
Ability to drive delivery through teams that do not report to the role, including holding a release or negotiating an exception under pressure.
Familiarity with Secure Development Lifecycle frameworks such as NIST 800-218, BSIMM, and Microsoft SDL.
Familiarity with Software Development Lifecycle frameworks such as Agile, Scrum, and CI/CD.
Bachelor's degree in a technical or related field such as computer science, engineering, or information security, or equivalent practical experience.
Experience leveraging or critically thinking about integrating AI into work processes, decision-making, or problem-solving; examples may include AI-powered tools, workflow automation, AI-driven insights, or exploring AI's potential impact.

Nice To Haves

Certifications that strengthen the candidate's qualifications, such as PMP, CISSP, CSM, or Security+.

Responsibilities

Translate strategic direction and ambiguous initiatives into defined workstreams with owners, dependencies, milestones, and a defensible sequence.
Determine program sequencing, staging, parallelization, and prerequisites.
Deliver secure-by-default initiatives, tooling rollouts, and remediation campaigns from intake through closure and measurement.
Own program plans, sequencing, outcomes, completion criteria, and closure evidence.
Coordinate cross-team dependencies, launches, sequencing, and critical paths where Product Security gates engineering releases.
Resolve engineering-facing delivery blockers or contested work at the engineering level where possible; escalate with recommendations when needed.
Make technical tradeoff decisions within programs and recommend prioritization tradeoffs or initiatives to stop, defer, or absorb.
Identify when strategy cannot be sequenced as written and recommend scope or timeline changes.
Supply delivery truth to Business Operations and escalate cross-program conflicts, aging risk, and sequencing infeasibility for prioritization.
Influence how security requirements enter the SDLC upstream and help reduce downstream remediation load.