Security Program Manager, Norm AI

• 5+ years of experience in security program management, GRC, or a related security operations role
• Hands-on experience managing compliance programs across at least two major frameworks (e.g., SOC 2, ISO 27001, GDPR, HIPAA). You don't need to be a security controls expert, but you need to know how audits work and how to run one
• Working knowledge of risk management frameworks such as NIST RMF, ISO 31000, or FAIR
• Experience with GRC and compliance automation tooling; we use Vanta
• Strong project management skills with the ability to manage multiple concurrent initiatives; experience with Linear, Jira, Notion, or equivalent tools
• Comfortable using AI tools to accelerate security and compliance work
• Experience coordinating external audits and working directly with auditors
• Familiar enough with cloud environments (AWS) and developer tooling (GitHub) to have substantive conversations with engineering teams
• Proven ability to drive cross-functional work without direct authority
• Clear, concise communicator; experienced preparing executive-level updates and board materials
• Background in a fast-paced startup, scale-up, or boutique consulting environment where you had to build programs with limited resources

Desirable

• The Security Program Manager at Norm Ai is a hybrid between a GRC Manager and a Program Manager within the Office of the Chief Security Officer
• You will own the execution of Norm Ai's security compliance programs, serve as the CSO's operational right hand, and drive cross-functional security and compliance initiatives across Engineering, Legal, IT, and the affiliated Norm Law practice
• Security is your primary function, but this role sits at the intersection of compliance execution, risk management, and day-to-day program operations
• You are the person who brings structure to ambiguity and makes sure nothing falls through the cracks
• Own and mature the GRC program across SOC 2 Type II, ISO 27001, and other applicable frameworks, including control mapping, evidence collection, gap analysis, remediation tracking, and audit coordination
• Serve as the primary liaison with external auditors and certification bodies; manage the full audit lifecycle from scoping and evidence gathering through report issuance
• Build and maintain the enterprise risk register; conduct periodic risk assessments and track risk treatment plans to closure with clear stakeholder accountability
• Lead the vendor security assessment program: evaluate third-party security posture, manage security questionnaires, and track remediation to completion
• Maintain and update security policies, standards, and procedures; own the policy review lifecycle from drafting through approval
• Manage priorities, track deliverables, and maintain operational cadence across the security organization including but not limited to staff meetings, quarterly planning, board reporting
• Drive cross-functional security initiatives and ensure alignment between Security, Engineering, Product, Legal, IT, and Business teams
• Manage security OKRs, KPIs, and metrics reporting; prepare dashboards and executive summaries for leadership and board audiences
• Coordinate incident response program readiness: maintain runbooks, organize tabletop exercises, and drive post-incident reviews to ensure lessons learned are captured and tracked
• Design, implement, and manage the security awareness and training program, including phishing simulations and effectiveness reporting
• Participate in client due diligence reviews and manage the intake process for inbound security questionnaires
• Support business continuity and disaster recovery planning in coordination with Engineering and IT
• What Success Looks Like
• 30 Days:
• Map the existing security program and compliance calendar; understand Norm Ai's current control environment, open audit gaps, and active risks
• Get fully onboarded into Vanta, Linear, and Notion and establish working relationships with the CSO, Director of Compliance, Engineering leads, and Legal
• Identify the most pressing open thread and start driving it
• 60 Days:
• Own the GRC program calendar with a clear view of upcoming audit milestones, evidence collection owners, and remediation timelines
• Establish a regular reporting cadence for the CSO, including OKR tracking and cross-functional status updates
• Have moved at least one active compliance or risk initiative from intake to measurable progress