Technical Program Manager, Security

Brain Co.•San Francisco, CA

About The Position

Brain Co. is hiring its first Technical Program Manager for the Security team. This individual-contributor role reports to the Head of Security and owns delivery of security programs across the company, working with Security, IT, GRC, Engineering, Legal, Finance, HR, and go-to-market teams. The TPM will establish plans, ownership, operating cadences, and measurable outcomes for programs that cross organizational boundaries, helping the company meet demanding regulatory requirements and support enterprise and government deployments. The role spans customer security and sales enablement, vendor security reviews, audit readiness, vulnerability management, compliance monitoring, security-heavy product launches, corporate security initiatives, incident management, and the Security team’s operating cadence. The TPM is expected to be technically capable of engaging with IAM policies, architecture discussions, and vulnerability remediation, while building durable processes and automation rather than merely tracking tasks. The position offers the opportunity to define how security programs operate as Brain Co. scales its AI platform across government, healthcare, financial services, and other regulated industries.

Requirements

At least 5 years of technical program or project management experience, including work on security, infrastructure, IT, or compliance programs.
Experience delivering cross-functional programs without formal authority over the people doing the work.
Ability to engage technically with engineers, including reading IAM policies, following cloud or Kubernetes architecture discussions, and assessing the significance of CVEs.
Experience running or contributing deeply to at least one audit cycle, such as SOC 2, HIPAA, ISO 27001, or FedRAMP, with responsibility for evidence and remediation.
Experience supporting enterprise security sales processes, including questionnaires, customer security reviews, and discussions with customer security teams.
Ability to build repeatable systems, processes, templates, or automation rather than only reporting status.
Comfort being the first TPM in a function and building systems that drive outcomes.
Strong written communication for program plans, customer responses, executive updates, and post-incident reviews.
Strong follow-through and ability to close loops on owned work.

Nice To Haves

Experience reviewing privacy or legal documentation such as DPAs and BAAs, including identifying items to flag for legal review.
Hands-on experience with FedRAMP/GovRAMP, IL4/IL5, or equivalent government-customer compliance requirements, including on-prem deployments.
Practitioner background in security engineering, IT, or GRC.
Familiarity with compliance automation and security tools such as Vanta, Drata, Secureframe, vulnerability scanners, and identity platforms, and sound judgment about when a tool is not the right answer.
Experience at an AI- or ML-focused company, including security and evidence questions involving model data and agent actions.
Experience as an incident commander or incident process owner.

Responsibilities

Own security sales enablement operations, including security questionnaires, RFP security sections, the trust portal, DPA/BAA intake, customer security reviews, reusable answer libraries, evidence packages, and intake processes, in partnership with GRC.
Complete vendor security reviews for internal and corporate vendors and vendors supporting customer-facing products or services; distinguish the requirements for each vendor type and streamline the vendor management process.
Deliver audit readiness programs for SOC 2 Type II and HIPAA and plan the path toward ISO 27001, NIST 800-171, and FedRAMP/GovRAMP, including control owners, evidence collection, remediation tracking, auditor logistics, and readiness milestones.
Build and operate a continuous vulnerability management program, including severity-based SLAs, automated routing to responsible engineering teams, exception processes, and current dashboards.
Support planning and tracking of GRC-related continuous monitoring, including access provisioning and deprovisioning evidence, access reviews, business continuity and incident response testing, and configuration reviews.
Drive security-heavy product launches when needed by coordinating threat modeling, security reviews, dependencies, and sign-offs with product, engineering, security, and IT teams, and surfacing blockers early.
Lead cross-functional corporate security programs covering SaaS security posture and shadow IT, identity, insider risk, physical and office security, and security awareness and phishing.
Own incident management processes, including escalation paths, communications templates, tabletop exercises, incident commander support during live events, and follow-through on post-incident remediation.
Run the Security team’s operating cadence, including roadmap and planning, program status, metrics and leadership reporting, third-party risk operations, and strategic initiatives.
Maintain visibility into critical security programs, including ownership, risks, blockers, and information leadership needs.