Program Manager, Security Risk Program

About This Role

Planning and running the security risk assessment of AI product launches is the core of this program management role. This is a builder and an influencer role that requires designing a new capability from the ground up and scaling it to meet Meta's AI product velocity. The role suits a candidate comfortable with ambiguity, effective in high-pressure situations, and able to build durable relationships across a wide range of technical and non-technical stakeholders.

Responsibilities

• Design and implement Meta's AI Launch Risk Assessment framework end to end, including intake criteria, cross-domain risk taxonomy, assessment methodology, and launch-gate outputs
• Scale delivery from approximately 5 to 20+ assessments per quarter by H1 2027
• Build and partner to manage the cross-functional operating model that coordinates Central Security, product groups, Privacy Risk Management, Integrity Risk Management, and Legal through each assessment, with clear roles, handoffs, and decision rights on a launch timeline
• Partner directly with product and engineering teams on high-priority AI launches, engaging early enough that security risk review informs design decisions rather than gating release
• Give product teams a predictable, well-documented path through second-line review
• Serve as the connection point between the Security Risk Program, Central Security leadership, Legal, and first-line business teams, representing security risk positions and negotiating assessment scope, sequencing, and remediation commitments
• Build and maintain a consolidated AI risk register that gives leadership a single view of security risk across the AI product portfolio
• Produce reporting that keeps that view current for VP and executive audiences
• Define tooling requirements and drive AI-enabled automation across the assessment lifecycle, identifying where automation can scale throughput without compromising assessment defensibility
• Partner with tooling and engineering owners to deliver automation
• Ensure assessments and supporting artifacts are produced to internal standards, are submission-ready, and constitute defensible evidence of systematic security due diligence for regulators and auditors (including EU AI Act and NIST AI RMF expectations)
• Identify risks, dependencies, and blockers across the program, define mitigation plans, monitor key delivery and SLA metrics, and drive corrective action with stakeholders when performance deviates
• Create and facilitate presentations that build senior leadership understanding and influence decision-making
• Provide mentorship and guidance to junior team members on program design and assessment practice

Requirements

• 8+ years of experience in governance, risk, and compliance, security risk management, regulatory compliance, or a directly related discipline