{"id":3991903,"url":"https://alion.io/job/brain-co-technical-program-manager-security","title":"Technical Program Manager, Security","company":{"id":2051367,"name":"Brain Co.","domain":"brain.co","url":"https://alion.io/company/brain-7","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":90,"open_postings":41,"ghost_share":0,"stale_share":0.195,"repost_share":0,"time_to_fill_p50_days":96,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Product","role_family":"Product","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CVE","optional":false},{"name":"FedRAMP","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"Incident Management","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"NIST 800-171","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Databricks","optional":true}],"status":"live","first_seen_at":"2026-11-09T20:17:05Z","employer_posted_date":"2026-11-09","last_verified_at":"2026-11-10T10:25:45Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Our Mission\nRebuild how the world works, to make institutions work better for the people they serve.\nAbout Brain Co.\nBrain Co. builds AI-native operating systems for large, regulated institutions. Each system is built for a specific industry, powered by agents that push real workflows forward. Underneath it all is Atlas, our proprietary platform that keeps customers in control, secure by design, and never locked into one model.\nWhy Now\nBrain Co. is entering its next phase of production deployments on a national scale with an elite team built from Palantir, Google, Meta, and Nvidia, and a growing footprint across government, insurance, health, and financial services.\nJoining now means shaping both the company and a new category of applied AI. Every project here ships to production and is expected to create measurable customer value and impact.\nYou'll work alongside exceptional peers on some of the hardest problems in applied AI. It’s the kind of work you'll still be proud of in ten years from now.\nAt Brain Co., we focus on applying frontier AI to real institutional challenges, working alongside governments, healthcare systems, and critical industries to modernize how essential services operate. We are looking for leaders who want to help bring new technology into institutions that impact millions of people.\nSecurity work at Brain Co. does not stay inside the security team. Audit readiness needs Engineering, HR, Finance, and Legal. Enterprise deals stall on security questionnaires and customer security reviews. Identity spans IT and Security, and neither can finish it alone. Vulnerability remediation lands on engineering teams that don’t report to us. Someone has to own the delivery of that work end-to-end: the plan, the owners, the cadence, and the finish line. That’s this role.\nBrain Co. carries one of the most demanding regulatory loads of any company our size: SOC 2 Type II and HIPAA in place today, with ISO 27001, NIST 800-171, and FedRAMP/GovRAMP on the near-term roadmap. That’s what it costs to sell to governments, hospitals, and financial institutions and done right, it’s how we win the next ones.\nAs our first Technical Program Manager on the Security team, you’ll run the security programs that touch every part of the company from the security review that unblocks a government deal, to the identity program that spans IT and Security, to the incident process the whole company depends on. You’ll report to the Head of Security as an individual contributor with the scope and trust to define how security programs run here.\nThis is not a ticket-herding job. You’ll be technical enough to read an IAM policy, follow an architecture diagram, and push back on a remediation plan that doesn’t hold up, and operational enough to turn a recurring mess into a system that runs without you in the room.\nYou won’t be doing this alone. Security, IT, GRC, Engineering, and GTM all want these programs to move. You’ll arrive with teams that are eager to be pulled in rather than dragged, and partners who’ll do the work if you give them a clear plan and a clear finish line. What’s been missing is the person who holds the whole picture, not the willingness to help.\nWhat You’ll Work On\nDrive security sales enablement operations: the operational backbone of the customer trust surface. Security questionnaires, RFP security sections, the trust portal, DPA/BAA intake, and customer security reviews. Build the reusable answer library, evidence packages, and intake process so no deal restarts from scratch and security is never the reason a cycle slips in close partnership with GRC.\nVendor Management Process: Complete Vendor Security Reviews for vendors that will be both internal/ corporate vendors and vendors supporting customer facing products/ services. Understanding the difference between what is required for each of those types of vendors. Awhile looking for ways and streamline our vendor management process.\nSupport audit readiness as a delivery program, not a scramble. Own the plan behind SOC 2 Type II and HIPAA today and the path through ISO 27001, NIST 800-171, and FedRAMP/GovRAMP, control owners, evidence collection, gap remediation tracking, auditor logistics, and readiness milestones, in close partnership with GRC.\nTurn vulnerability management into a continuous, self-managing program that runs at machine speed. Definitions, SLAs by severity, automated routing to the engineering teams that own the fix, an exception process people actually use, and dashboards that stay current on their own - so the program reports itself and only the exceptions reach a human.\nSupport the planning and tracking of GRC-related continuous monitoring activities to ensure all necessary compliance related requirements are being met. This may include, proper access provisioning/deprovision tasks are being evidenced, access reviews are being performed in proper cadence, BCP and IR testing, configuration reviews, etc.\nDrive security-heavy product launches as needed. Most launches won’t need you; some can’t ship without you. When security is load-bearing, such as government and healthcare deployments, multi-cloud environments, you’ll embed with the product and engineering teams and make sure threat modeling, security reviews, and sign-offs happen early enough to matter, with launch blockers surfaced before launch week.\nDrive cross functional corporate security programs across the company SaaS security posture and shadow IT, identity, insider risk, physical and office security, and security awareness and phishing programs. These programs live in everyone’s workflow and nobody’s job description; you’ll give them owners, a cadence, and measurable coverage.\nDrive security-heavy product launches as needed. Most launches won’t need you; some can’t ship without you. When security is load-bearing, government and healthcare deployments, on-prem environments, agent workloads running inside customer systems - you’ll embed with the product, engineering, security and IT teams and make sure dependencies and sign-offs happen early enough to matter, with launch blockers surfaced well before launching deadlines.\nOwn the operating process around incident management escalation paths, comms templates, tabletop exercises, incident commander support during live events, and post-incident reviews where the remediation items get driven to done, not filed.\nRun the security team’s operating cadence: roadmap and planning, program status, metrics and reporting to leadership, third-party risk operations, and the strategic initiatives that show up mid-quarter without a plan attached.\nBe the person who knows the state of the most critical security programs: who owns what, what’s at risk, what’s blocked, and what leadership needs to hear before they ask.\nYou Might Be a Great Fit If You…\nHave 5+ years in technical program or project management, including time spent on security, infrastructure, IT, or compliance programs.\nHave run cross-functional programs where you had zero formal authority over the people doing the work - and still landed them.\nCan hold your own with engineers. You can read an IAM policy, follow a cloud or Kubernetes architecture discussion, and tell the difference between a CVE that matters and one that doesn’t, without needing everything translated for you.\nHave run or been deep in at least one real audit cycle - SOC 2, HIPAA, ISO 27001, FedRAMP, or equivalent - on the delivery side, owning evidence and remediation rather than watching from a dashboard.\nHave supported the security side of enterprise deals: questionnaires, customer security reviews, and the calls where a customer’s security team asks the hard question.\nBuild systems instead of reporting status. When you see the same fire drill twice, your instinct is to build the intake, the template, or the automation that kills it.\nAre comfortable being the first TPM in a function, to build the systems driving the outcomes.\nWrite clearly. Much of this job is written: the program plan, the customer response, the executive update, the post-incident review.\nClose loops compulsively. Nothing you own goes quiet.\nBonus Points For\nHigh level privacy/legal documentation (e.g. DPAs, BAAs, etc.) review experience (e.g. you don’t need to be a lawyer but understanding what to look for and flag for review)\nHands-on experience with FedRAMP/GovRAMP, IL4/IL5, or equivalent government-customer compliance requirements, including on-prem deployments.\nA practitioner background in security engineering, IT, or GRC that you still use.\nFluency with compliance automation and security tooling - Vanta, Drata, Secureframe, vulnerability scanners, identity platforms - and the judgment to know when the tool is the wrong answer.\nExperience at an AI or ML-heavy company, including the novel security and evidence questions that come with model data and agent actions.\nTime as an incident commander or incident process owner.\nWhy Join Us\nOwn the delivery of security programs for an AI platform deployed in governments, hospitals, and critical industries worldwide - where the regulatory bar is real and the work matters.\nDefine the role 0→1. You’re the first security TPM here, with a direct line to the Head of Security and room to grow the scope as the company scales.\nLand with the org behind you. This role was created because teams across the company asked for it - you’ll have executive sponsorship and cross-functional partners who are genuinely eager to push these programs forward with you.\nDo work with visible impact: the programs you run are what unblock enterprise and government deals.\nWork alongside senior engineers from Tesla, DeepMind, Databricks, and other top engineering orgs who treat security as a partner, not a tax.\nEarn competitive compensation and meaningful equity in a high-growth company.","description_format":"text","description_chars":9842,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["AI Agents","AI Consulting & Integration"],"lifecycle":[{"event":"open","at":"2026-11-09T23:45:40Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":0,"expected_fill_days":96,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-11-10T06:52:35Z"},"pay":null,"html_url":"https://alion.io/job/brain-co-technical-program-manager-security","json_url":"https://alion.io/job/brain-co-technical-program-manager-security.json","meta":{"generated_at":"2026-11-10T12:37:57Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":29297,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2051367},"rest":"https://alion.io/mcp/rest/get_company?id=2051367"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbrain-co-technical-program-manager-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbrain-co-technical-program-manager-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbrain-co-technical-program-manager-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/brain-co-technical-program-manager-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbrain-co-technical-program-manager-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3991903}},{"tool":"search_jobs","arguments":{"company":"brain.co","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3991903},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}