Senior Technical Program Manager, Security Risk and M&A Security

CoreWeave•Sunnyvale, CA

4d•$157,000 - $210,000•Onsite

About The Position

CoreWeave is seeking a Senior Technical Program Manager, Security Risk and M&A Security to join their CISO organization. This role will partner closely with the Assurance Engineering team to build and scale security risk management capabilities, including an AI-assisted exception and risk-acceptance management workflow and a key risk indicator (KRI) dashboard. The position involves maturing these capabilities from pilot to embedded processes, establishing operating cadences, and managing ongoing operations. Additionally, the role will oversee the M&A security integration program and drive stalled work to resolution. This is a hands-on building and operating role, reporting to the Security Risk Management and M&A Security Lead.

Requirements

5+ years in security or risk program operations, technical program management, consulting, or a comparable role.
Track record of owning programs end to end and driving them to a closed state.
Genuine security risk management fluency, understanding how security risk is identified, assessed, owned, and accepted.
Ability to hold your own with security domain experts.
A builder's mindset, capable of building capabilities and operational process where little exists, going deep into exception data, workflow logic, and metrics, and partnering hands-on with Assurance Engineering.
Ability to set up intake, service-level agreements, escalation paths, and metrics, then drive adoption.
A strong bias for action and sound judgment under imperfect information, prioritizing and reprioritizing as things shift, presenting clear decisions and trade-offs, and keeping work moving.
Effective use of AI tools to multiply impact.
Clear, concise communication providing leadership a live view of risk, blockers, and progress.
Bachelor's degree or equivalent experience.

Nice To Haves

Exposure to a breadth of security domains, from both an M&A integration and a risk standpoint.
Credibility with senior technical and non-technical stakeholders, including negotiating scope and timelines.
Familiarity with governance, risk, and compliance (GRC) tooling, KRI frameworks, or exception and risk-acceptance management.
Exposure to M&A security integration or post-close program management.

Responsibilities

Mature AI-assisted security exception management from pilot to embedded business process, owning the program around the workflow built by Assurance Engineering (requirements, rollout, adoption, intake, triage, SLAs, escalation path).
Design the intake experience to meet engineers where they work, ensuring the fast path is also the right path.
Take KRI dashboards from pilot to a tool leadership relies on, partnering with Assurance Engineering to define what leadership needs to see and how it gets used, and owning adoption and accuracy.
Run the Security Risk Management operating cadence, including periodic risk reviews with the CISO and security leadership, the annual enterprise security risk assessment, and applying the security risk assessment framework to new risk intakes.
Own program reporting and visibility for Security Risk Management, including operating cadence, dashboards, and executive updates.
Keep the M&A security integration program running in steady state, maintaining integration tracking, supporting new acquisitions, and identifying and executing improvements to the M&A security integration playbook.
Drive stalled work to a decision by escalating or pushing risk-acceptance calls when timelines slip.
Partner across teams to land cross-functional dependencies.