Technical Program Manager, Vulnerability, Configuration & Attack Surface Management

ServiceNow•Santa Clara, CA

About The Position

The ServiceNow Security Organization is hiring a Technical Program Manager in Enterprise Security to bring delivery discipline to Vulnerability Management, Configuration Management, and Attack Surface Management programs. The role manages the programs’ OKR and epic portfolio, keeps priorities current, and ensures committed work is reflected in engineering teams’ agile backlogs so delivery dates can be met. The position tracks, communicates, and resolves cross-team dependencies so engineers can focus on delivery and leaders can focus on strategy and people. The role includes managing portfolio creation, refinement, sequencing, and status tracking; leading reprioritization and communicating trade-offs; aligning team backlogs with current priorities and delivery commitments; tracking risks and blockers; producing executive-ready reporting; running milestone gate reviews and go/no-go checkpoints; modeling capacity; and creating repeatable governance and planning standards. Success in the first 6 to 12 months means establishing a current shared OKR and epic view across the three programs, aligning team backlogs with delivery dates, resolving blockers on a predictable cadence, defining and regularly reporting Attack Surface Management success measures, and reducing coordination work carried by managers and engineers. West Palm Beach, Florida is available as a relocation location, with full relocation costs provided. For positions in this location, base pay is $190,900–$334,100, plus equity when applicable, variable or incentive compensation, and benefits. Compensation varies by qualifications, skill level, competencies, and work location. ServiceNow describes its work personas as flexible, remote, or required in office, assigned according to the nature of the work and location; the specific persona for this role is not stated.

Requirements

12+ years of program or project management experience in software, security, or infrastructure organizations, or similar experience with education.
Track record of managing multi-team programs with competing priorities and dependencies.
Strong working knowledge of agile delivery, including backlog, epic, and sprint planning in enterprise tools such as ServiceNow Agile.
Experience managing OKRs and tying delivery to measurable outcomes.
Excellent written and verbal communication, including executive-level reporting.
Ability to influence and align teams without direct authority.
Experience leveraging or critically thinking about integrating AI into work processes, decision-making, or problem-solving; examples may include AI-powered tools, workflow automation, AI-driven insights, or exploring AI's impact.

Nice To Haves

Experience in security operations, vulnerability management, configuration or compliance management, CMDB, or attack surface and exposure management.
Familiarity with regulated or government environments, such as FedRAMP and federal directives.
Experience launching a new program, including defining metrics and reporting cadence.
Experience with capacity planning and portfolio-level road mapping.
PMP, SAFe, or similar certification (nice to have, not required).

Responsibilities

Manage the OKR and epic portfolio across Vulnerability Management, Configuration Management, and Attack Surface Management, including creation, refinement, sequencing, and status tracking.
Lead reprioritization as scope and demand change, and communicate trade-offs clearly to stakeholders.
Work with team leads to ensure each team's agile funnel reflects current priorities and supports committed delivery dates.
Track cross-team dependencies, risks, and blockers, driving them to resolution or escalating early.
Produce executive-ready status, risk, and progress reporting for the portfolio.
Run gate reviews and go/no-go checkpoints for major milestones.
Model team capacity against competing priorities and raise conflicts early.
Build repeatable standards, including OKR governance and intake and planning templates.
Define Attack Surface Management success measures and establish regular reporting to leadership.