Senior Technical Program Manager, Security Risk and M&A Security

CoreWeave•San Francisco, NY

About The Position

CoreWeave is The Essential Cloud for AI™. Built for pioneers by pioneers, CoreWeave delivers a platform of technology, tools, and teams that enables innovators to build and scale AI with confidence. Trusted by leading AI labs, startups, and global enterprises, CoreWeave combines superior infrastructure performance with deep technical expertise to accelerate breakthroughs and turn compute into capability. Founded in 2017, CoreWeave became a publicly traded company (Nasdaq: CRWV) in March 2025. Learn more at www.coreweave.com . You'll partner closely with our Assurance Engineering team to build and scale the capabilities that power our security risk management function: an AI-assisted exception and risk-acceptance management workflow and a key risk indicator (KRI) dashboard, both already live in pilot. This is a hands-on building role as much as an operating one. You will mature both capabilities from pilot into embedded, business-as-usual process, and build the operating cadence and visibility that make them stick. Alongside the build work, you'll run the ongoing operations of the risk program, from recurring risk reviews with security leadership to the annual enterprise risk assessment. You'll also keep our M&A security integration program running in steady state. This role will report to the Security Risk Management and M&A Security Lead and sit within the Chief Information Security Officer (CISO) organization.

Requirements

5+ years in security or risk program operations, technical program management, consulting, or a comparable role, with a track record of owning programs end to end and driving them to a closed state
Genuine security risk management fluency — you understand how security risk gets identified, assessed, owned, and accepted, and you can hold your own with security domain experts; command of the discipline matters here more than any specific job title; experience managing program or delivery risk alone (scope, schedule, dependencies) is not enough for this role
A builder's mindset, required for this role — you build capabilities and operational process where little exists, going deep into the exception data, workflow logic, and metrics, and partnering hands-on with Assurance Engineering on what gets built without needing to write the code; you set up intake, service-level agreements, escalation paths, and metrics, then drive adoption so they stick
A strong bias for action and sound judgment under imperfect information — you prioritize and reprioritize as things shift, present clear decisions and trade-offs, and keep work moving instead of looping; you know when to escalate or force a risk-acceptance call when something stalls
You use AI tools effectively to multiply your impact, so a lean team delivers well beyond its size
A real understanding of what it takes to provide ongoing visibility, with clear, concise communication that gives leadership a live view of risk, blockers, and progress
Bachelor's degree or equivalent experience

Nice To Haves

Exposure to a breadth of security domains, from both an M&A integration and a risk standpoint
Credible with senior technical and non-technical stakeholders, including negotiating scope and timelines
Familiarity with governance, risk, and compliance (GRC) tooling, KRI frameworks, or exception and risk-acceptance management; a pure GRC background is not required
Exposure to M&A security integration or post-close program management

Responsibilities

Mature AI-assisted security exception management from pilot to embedded business process — our Assurance Engineering team builds the workflow; you own the program around it (requirements, rollout, adoption, intake, triage, service-level agreements, and the escalation path for past-due items), and you design the intake experience to meet engineers where they already work so the fast path is also the right path
Take KRI dashboards from pilot to a tool leadership relies on — partner with Assurance Engineering, who build it; you define, in partnership with domain leads, what leadership needs to see and how it gets used, and you own adoption and accuracy
Run the Security Risk Management operating cadence — drive periodic risk reviews with the CISO and security leadership, run the annual enterprise security risk assessment, and apply our security risk assessment framework to new risk intakes so risks are consistently identified, assessed, and routed to owners
Own program reporting and visibility for Security Risk Management: operating cadence, dashboards, and executive updates
Keep the M&A security integration program running in steady state — maintain integration tracking across active acquisitions, support new acquisitions through the established M&A security integration playbook, and identify and execute improvements to the playbook where you find gaps
Drive stalled work to a decision — when a timeline slips, escalate or push a risk-acceptance call so the blocker resolves
Partner across teams to land cross-functional dependencies