Senior Technical Program Manager, Security

Replit•Foster City, CA

5d•$190,000 - $250,000•Hybrid

About The Position

Replit is seeking a Senior Technical Program Manager to own their vulnerability management program end to end. This role involves driving vulnerability intake, triage, remediation, and reporting across various areas including their bug bounty program, Google Cloud Platform (GCP) infrastructure, source code on GitHub, and third-party SaaS services. The successful candidate will collaborate with platform engineering, product engineering, SRE, security, IT, legal, and vendor management to ensure vulnerabilities are identified quickly, triaged accurately, and resolved within Service Level Agreements (SLAs). A key aspect of this role is to provide leadership with a clear and current understanding of the organization's risk posture. The ideal candidate will leverage AI and automation to enhance their effectiveness, focusing on clarity, trade-offs, and execution.

Requirements

4–6+ years of experience in technical program management, security program management, or security operations, with direct ownership of a vulnerability management or application security program.
Hands-on experience running a bug bounty program (e.g., HackerOne, Bugcrowd, Intigriti), including triage and payout workflows.
Working knowledge of GCP security fundamentals: IAM, VPC/networking, Security Command Center, Cloud Logging/Monitoring, and common cloud misconfiguration risks.
Familiarity with GitHub-based development workflows and code security tooling (Wiz Code, Dependabot, SAST/DAST/SCA tools such as Snyk, Semgrep, or CodeQL).
Strong grasp of vulnerability scoring frameworks (CVSS) and risk-based prioritization.
Excellent cross-functional communication skills — able to translate technical vulnerability data into business risk for executive audiences and hold engineering teams accountable without owning the code themselves.
Proven ability to build reporting/dashboards (e.g., Linear, Jira, ServiceNow, Tableau, Looker) that give leadership real-time visibility into program health.
Experience supporting compliance frameworks such as SOC 2, ISO 27001, PCI-DSS, or FedRAMP.

Nice To Haves

Systems Thinking: The ability to see the “big picture” and understand how vulnerability management decisions impact the entire stack — cloud, code, and vendor ecosystem alike.
Technical Influence: The ability to drive alignment across engineering and security through expertise and collaboration rather than direct authority.
Autonomy: Comfortable owning a program end to end and driving outcomes with minimal oversight.
Bias for Action: A track record of closing the gap between finding a vulnerability and actually getting it fixed.

Responsibilities

Own and continuously improve the vulnerability management program, including intake, severity scoring (CVSS/risk-based), SLA definition, and remediation tracking across all asset types.
Manage the triage/payouts/rewards workflow for the bug bounty program, and report on program health and trends.
Drive remediation of vulnerabilities found in GCP infrastructure (IAM, networking, Compute/GKE, storage, and logging/monitoring configuration) by partnering with security, cloud, and platform engineering teams.
Coordinate remediation of vulnerabilities surfaced through SAST/DAST/SCA tooling (Wiz Code, Snyk, Dependabot, code scanning, secret scanning) across engineering repos, including dependency and supply-chain risk.
Build and manage the process for assessing and tracking security posture across third-party SaaS applications.
Define and enforce escalation paths for overdue or critical/high-severity findings, including risk acceptance and exception processes with appropriate sign-off.
Partner with engineering managers and tech leads to embed remediation work into sprint planning and hold teams accountable to remediation SLAs.
Establish and maintain a single source of truth for vulnerability status, aging, SLA compliance, and risk trends, with dashboards for engineering leadership, security leadership, and executives.
Support audit and compliance efforts (SOC 2, ISO 27001, customer security questionnaires) by keeping vulnerability management evidence and metrics audit-ready.
Drive process improvements and automation to reduce manual triage effort and improve time-to-remediation across all vulnerability sources.