Senior Technical Program Manager I, Security and Compliance, Google Cloud

Google•Sunnyvale, CA

2d•$192,000 - $278,000

About The Position

As a Technical Program Manager at Google, you will lead complex, multidisciplinary projects from start to finish. You will plan requirements, identify risks, manage schedules, and communicate with cross-functional stakeholders, explaining recommendations to executives and discussing technical trade-offs with engineers. The Google Distributed Cloud (GDC) TPM Team leads cross-functional engineering execution for Google's sovereign, air-gapped (GDCag), and connected (GDCc) edge cloud platforms serving public sector, defense, intelligence, and regulated enterprise customers globally. In this role, you will partner with Security Engineering, Product Management, Operable Component Tech Leads, and Cloud CISO/Compliance teams to drive GDC's security and accreditation roadmap. You will lead horizontal security mandates, including Post-Quantum Cryptography migration, continuous vulnerability and CVE remediation, and automated SecAssure compliance controls. You will also coordinate government and commercial or sovereign regulatory certifications from architectural scoping through audit readiness and release sign-off.

Requirements

Bachelor's degree in a technical field, or equivalent practical experience.
8 years of experience in program management.
Experience with security assessment.
Experience with security controls.

Nice To Haves

8 years of experience managing cross-functional or cross-team projects.
Experience guiding cloud, infrastructure, or enterprise products through regulatory compliance assessments, audit readiness, and continuous compliance monitoring, including DoD IL5/IL6, FedRAMP High, NIST, ISO, or regional data sovereignty frameworks.
Experience operating within cleared national security environments with an active US Government security clearance.
Experience leading vulnerability assessment and management programs, including scan coverage, triage, remediation tracking, and exception governance, across large-scale software or hardware environments.
Experience embedding shift-left security assessments, such as secure-by-design reviews, penetration testing, or cryptographic modernization, into the product lifecycle.
Relevant certifications such as CISSP, CISM, or CCSP.

Responsibilities

Own and drive cross-functional security and compliance roadmaps across GDC Air-Gapped (GDCag), GDC Connected (GDCc), and Gemini on GDC Connected (GGC) to support sovereign, defense, and regulated enterprise accreditations, including IL5/IL6, FedRAMP, and FIPS.
Operationalize shift-left security and compliance gates across the software and hardware release lifecycle, creating master execution plans, dependency maps, risk registers, and executive readiness reviews.
Partner with engineering and security architects across the GDC technology stack, including bare-metal servers, GPU/AI serving infrastructure, Kubernetes/GKE, Linux OS, networking, storage, KMS/HSMs, IAM, and zero-trust boundary controls.
Drive cryptographic modernization, continuous vulnerability management (CVE/SBOM), and secure software and firmware supply-chain workflows for disconnected and hybrid topologies.
Align Engineering, Security, Compliance, Product, and Operations (SovOps) stakeholders to resolve technical trade-offs and ensure predictable, audit-ready customer releases.
Orchestrate US Government and commercial or sovereign regulatory certifications from architectural scoping through audit readiness and release sign-off.