Application Security owns the security of the software we build: secure development practices, product and application security programs, vulnerability management, and the controls that keep our codebase and pipelines defensible. Platform Security owns the security of the environments that software runs in: cloud and platform security, identity and access management, infrastructure hardening, and the operational processes that keep those domains healthy. Your job is to make both teams more predictable and more effective—turning technical work into tracked, milestone-oriented programs and surfacing conflicts before they become delivery problems. It is also part engagement manager and part product manager: the company's software engineering teams are App Security and Platform Security's customers, and you help understand their needs and shape how security capabilities are delivered back to them.
This is a dedicated role, but not a static one. Your primary charter is Application Security and Platform Security, and that is where you'll build the deepest context. As portfolio priorities shift, you should expect to flex across other Security & Infrastructure programs when the PMO needs it, bringing the same execution rigor wherever you're pointed.
RESPONSIBILITIES
- Own end-to-end delivery for Application Security and Platform Security initiatives—building and maintaining the program plans, milestone schedules, and dependency maps in Jira, and driving them from intake through close
- Run both teams' operational cadences—sprint/backlog grooming, weekly status, and quarterly planning—and keep backlog health and ticket hygiene good enough that status is trustworthy without a fire drill
- Partner with the team leads on effort estimation, task decomposition, and resource alignment across concurrent workstreams; surface capacity conflicts and schedule risk early, with options
- Serve the software engineering teams as the primary customers of App Security and Platform Security—intake their requests, set expectations on what security can deliver and when, and keep that channel active rather than reactive
- Manage cross-functional dependencies with software engineering, IT, GRC, cloud/platform, and external vendors and assessors
- Produce leadership-ready program visibility—milestone-oriented, risk-flagged, and current—including the roll-ups and tear-sheets the PMO uses for steering
- Partner with the PMO Lead on roadmap planning: prioritization, capacity planning, and keeping the plan of record maintained as priorities shift
- Flex to other Security & Infrastructure programs as portfolio demand requires, bringing the same execution discipline to an unfamiliar domain
QUALIFICATIONS
10+ years combining application and platform security with the technical program management of that work—deep in at least one domain (secure SDLC, vulnerability management, CI/CD pipeline security; cloud and infrastructure security, identity and access management), credible in the other, with a track record of owning and running programs end to end Demonstrated ability to manage concurrent workstreams with cross-functional dependencies and external stakeholders Strong Jira or equivalent proficiency; able to build and maintain structured tracking across multi-team portfolios Comfortable operating where scope, priorities, and assignments shift with portfolio demand Clear, direct communicator; able to simplify complex status for executive audiences and push back when warranted U.S. citizenship required; clearable required
PREFERRED SKILLS AND EXPERIENCE
- Prior experience as an information security engineer who has since moved into technical program management (preferred over a TPM background without hands-on security experience)
- Familiarity working directly with software engineering and platform/DevOps teams
- Familiarity with NIST RMF, FedRAMP, or federal compliance environments
- Experience in defense technology, aerospace, or DoD contractor environments
COMPENSATION
Base Salary: $140,000-$210,000
Equity + Benefits including Health, Dental, Vision, HRA/HSA options, PTO and paid holidays, 401K, Parental Leave
Your actual level and base salary will be determined on a case-by-case basis and may vary based on the following considerations: job-related knowledge and skills, education, location, and experience.
ADDITIONAL REQUIREMENTS
Work Location—Successful candidates will be located near Long Beach. While we observe a hybrid work environment, some work must be done on site.
Work environment—the work environment; temperature, noise level, inside or outside, or other factors that will affect the person's working conditions while performing the job.
Physical demands—the physical demands of the job, including bending, sitting, lifting and driving.
This position will be open until it is successfully filled. To submit your application, please follow the directions below. #LI-Onsite
To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.
True Anomaly is committed to equal employment opportunity on any basis protected by applicable state and federal laws. If you have a disability or additional need that requires accommodation, please do not hesitate to let us know.
To protect candidates and our company from application fraud and impersonation, we use third-party tools to verify applicant identity and detect fraudulent applications. Learn more in our Privacy Notice.
