Senior Security Program Manager

About the role

You'll own the operational backbone — Vanta, audits, vulnerability SLAs, policy lifecycle, vendor risk, customer security reviews — so our Security Lead can stay focused on architecture and threat work, and security requirements run smoothly across our enterprise deals. This is an IC role reporting to the Staff Program Manager, working closely with our Security Lead. You'll be the first hire whose full-time job is running the program rather than building the controls.

About us

TinyFish builds browser-based AI agents that do real work on the open web for enterprise customers. We're a small, technical team shipping fast against serious enterprise buyers who ask serious security questions. We're mid-flight on ISO 27001 certification renewal (Schellman external, Alameda internal) and our security posture is moving from "small startup" to "we can answer a 400-line questionnaire without flinching."

Responsibilities

• Compliance lifecycle. Maintain ISO 27001 certification, prep for SOC 2 Type 1 and 2, manage auditor relationships, own evidence collection in Vanta. You'll know what's failing before the dashboard turns red, and the forecast of when the next certification is anticipated to complete.
• Vulnerability management as a program. Own the SLA layer — weekly dashboard, breach escalation, exception tracking, monthly view to leadership. Engineers fix the bugs; you make sure they fix them on time.
• Policy lifecycle. Annual reviews, new policies as scope expands, training rollout, attestation tracking, exception requests. We run reviews through an adversarial AI pipeline today; you'll own the cadence and the human decisions inside it.
• People-ops security controls. Onboarding/offboarding evidence, access reviews, security awareness training, background-check tracking, permission-management security groups. Partner with HR on the workflow, own the auditable artifact.
• Vendor risk. Vendor inventory, pre-procurement assessments, annual reassessments, DPA and sub-processor tracking.
• Customer-facing security. Security questionnaires, CAIQs, custom RFPs, customer security calls. You're the named SPM in our trust center.
• Product Terms of Service and Privacy Policy. Own the update cadence and the cross-functional process when product changes trigger policy revisions.
• Risk and incident program ownership. Maintain the risk register, run quarterly reviews, own the incident runbook artifact (technical response stays with Security Engineering), schedule and run tabletops.

Ideal experience

• 4-7 years in security or GRC program management, ideally at a B2B SaaS company that grew through early stages.
• Lived experience running and owning ISO 27001 and SOC 2 audits end-to-end, including auditor management.
• Deep fluency in Vanta (or Drata/Tugboat with willingness to switch). You know what the platforms do well and where you have to compensate manually.
• Comfortable in front of customer security teams to both represent the capabilities of our security program as well as instill confidence in the team.
• Strong written communication.
• Good judgment on when a control gap is a real risk vs. a paperwork issue, and the ability to escalate issues quickly to the right audiences.

Bonus qualifications

• AI/ML security experience, especially model providers, prompt injection, data handling in agentic systems.
• Prior work at a company with a browser-based product (extensions, agents, scraping at scale).
• Experience standing up an additional framework (HIPAA, FedRAMP, ISO 27017/27018, C5).
• Background in pen-test coordination or bug bounty program management.