Partner 20, Staff Security Technical Program Manager

About the role

We're hiring a Staff Security Technical Program Manager to run the operating system of the a16z Security team. You'll own the firm's vulnerability management program, drive cross-team security initiatives to completion, and own the planning rhythm that keeps the team and its stakeholders aligned: sprints, OKRs, timelines, and the documentation and ticketing hygiene that make all of it real. Security at a16z moves fast and touches every part of the firm. We work in close partnership with teams across the firm. Your job is to keep that work on schedule, keep decisions written down, and make sure nothing gets dropped between teams. Leadership should be able to get the real status from you, and engineers should see you as someone who removes obstacles, not someone who adds process.

Responsibilities

• Own security remediation across the firm, end to end: Pull findings from threat models, code reviews, penetration tests, vulnerability management, audits, and incident postmortems into a single tracked backlog, and manage it with clear owners, priorities, remediation SLAs
• Run the vulnerability management program: Scan coverage, patching cadence, exceptions and risk acceptance, and reporting that shows leadership where risk stands
• Work with stakeholders to keep vendor security reviews fast and consistent, and keep requesters informed on where their review stands
• Drive cross-team security initiatives from kickoff through delivery, coordinating work across Security, IT, Legal, HR, and Compliance, and partnering with owners to keep commitments on track
• Build and run the team's execution rhythm: Sprint planning, quarterly OKRs, and ticket hygiene that keeps the work visible
• Raise the bar on documentation: Program docs, runbooks, decision records, and postmortem follow-ups that stay findable and current
• Define and track the metrics that tell us whether our programs are working, and turn them into actionable insights

Qualifications

• 7+ years of technical program management experience, with at least 3 years running security programs
• A track record of owning a vulnerability management program at scale: SLAs, remediation tracking across teams you don't control, executive reporting, and measurable risk reduction
• Technical fluency to be credible with security engineers: you can read a finding, understand severity