Technical Product Manager - Authorization Tooling - CTO Office

Bloomberg•New York, NY

1d•$240,000 - $330,000•Onsite

About The Position

Our team, the CTO Security Service Infrastructure group, solves complex systems problems to enable engineers to quickly ship new products and prototype next-generation infrastructure security technologies. We design security controls, threat model distributed systems, and aim to define the future of securing Bloomberg’s infrastructure. As a product owner in the CTO’s office, you will be responsible for understanding the intersections between Bloomberg’s global technology footprint, software stack, and security requirements. You will provide guidance for usable infrastructure security, ensure logical security controls are manageable at scale, and influence the roadmap for future security technologies. You will work alongside motivated engineers across the company to keep Bloomberg at the forefront. This role offers the opportunity to focus on projects you are passionate about and apply your expertise to achieve team goals. In this role, you will serve as the technical product owner for Bloomberg’s home-grown authorization tooling, which governs what people and systems are permitted to do after authentication. You will partner closely with engineering to maintain state-of-the-art tools, continually assess the suitability of an in-house approach versus market alternatives, and collaborate with internal stakeholders to anticipate emerging authorization needs. You will own the prioritization of development efforts, lead the creation of roadmaps, metrics, and OKRs, and contribute to the overall strategy and vision for authorization design, delivery, and governance across the firm. This is a technical role requiring an understanding of system interactions, technology and access model differences, and their implications for authorization tooling.

Requirements

7+ years of experience building, maintaining and managing security aspects of large-scale, distributed infrastructure and applications.
Strong experience with authorization and access control technologies with an emphasis on security, integration and automation.
Sufficient technical depth to understand how systems interact, how different technologies and access models differ and what those differences mean for the underlying authorization tooling.
A track record of building collaborative relationships with stakeholders across many functions, with a focus on correctness, scalability, and usability of distributed infrastructure.
A long history of leading through influence and establishing consensus for execution.
Ability to collect and document detailed product requirements including RFCs, design rationale and decision making.
The experience of knowing when to build, buy or re-use.
Deep knowledge of authorization and access control concepts and standards and how they are adopted in large enterprises.
Demonstrated polished written and oral communication skills, in a variety of circumstances (from presenting to audiences through to 1:1 communication), ability to present complex topics to senior leadership.

Nice To Haves

Ability to build proof-of-concept solutions and prototype approaches, and to partner with engineering teams to drive adoption.
Experience and knowledge of handling regulatory requirements such as GDPR, DORA, and HIPAA.
Experience integrating with and securing a combination of in-house developed and third-party solutions.

Responsibilities

Partner with engineering counterparts to keep our home-grown authorization tooling state of the art, evolving it in step with changing platforms, technologies, and security requirements.
Continually assess whether an in-house approach remains the right one, evaluating build, buy, and re-use trade-offs against the organization’s needs and the state of the industry.
Work with internal stakeholders across engineering, product, and business teams to anticipate future authorization needs and shape the tooling to meet them.
Own prioritization of development efforts, balancing security, usability, scalability, and delivery timelines.
Lead the creation of roadmaps, metrics, and OKRs that make progress and impact measurable and transparent.
Define and track metrics that measure the health, performance, and current state of the authorization tooling, so decisions about where to invest, modernize, or retire are grounded in evidence.
Contribute to the overall strategy and vision for authorization across the firm, and translate that direction into concrete implementation priorities.
Establish a comprehensive understanding of current authorization workflows, dependencies, pain points, and future-state opportunities.
Produce clear requirements, architecture direction, and implementation guidance for authorization-related initiatives, including RFCs and design rationale.
Ensure appropriate auditing, reporting, and observability exist for authorization workflows and related controls.
Assess risks and identify opportunities to strengthen authorization models and controls across the organization.
Collaborate with vendors, consultants, and industry peers to exchange knowledge and stay informed about the latest advancements in authorization and access management technologies.