Security Technical Program Manager, Customer Trust

Our Mission

Rebuild how the world works, to make institutions work better for the people they serve.

About Brain Co.

Brain Co. builds AI-native operating systems for large, regulated institutions. Each system is built for a specific industry, powered by agents that push real workflows forward. Underneath it all is Atlas, our proprietary platform that keeps customers in control, secure by design, and never locked into one model.

Why Now

Brain Co. is entering its next phase of production deployments on a national scale with an elite team built from Palantir, Google, Meta, and Nvidia, and a growing footprint across government, insurance, health, and financial services.

Joining now means shaping both the company and a new category of applied AI. Every project here ships to production and is expected to create measurable customer value and impact.

You'll work alongside exceptional peers on some of the hardest problems in applied AI. It’s the kind of work you'll still be proud of in ten years from now.

Security work at Brain Co. does not stay inside the security team. Audit readiness needs Engineering, HR, Finance, and Legal. Enterprise deals stall on security questionnaires and customer security reviews. Identity spans IT and Security, and neither can finish it alone. Vulnerability remediation lands on engineering teams that don’t report to us. Someone has to own the delivery of that work end-to-end: the plan, the owners, the cadence, and the finish line. That’s this role.

Brain Co. carries one of the most demanding regulatory loads of any company our size: SOC 2 Type II and HIPAA in place today, with ISO 27001, NIST 800-171, and FedRAMP/GovRAMP on the near-term roadmap. That’s what it costs to sell to governments, hospitals, and financial institutions and done right, it’s how we win the next ones.

As our first Technical Program Manager on the Security team, you’ll run the security programs that touch every part of the company from the security review that unblocks a government deal, to the identity program that spans IT and Security, to the incident process the whole company depends on. You’ll report to the Head of Security as an individual contributor with the scope and trust to define how security programs run here.

This is not a ticket-herding job. You’ll be technical enough to read an IAM policy, follow an architecture diagram, and push back on a remediation plan that doesn’t hold up, and operational enough to turn a recurring mess into a system that runs without you in the room.

You won’t be doing this alone. Security, IT, GRC, Engineering, and GTM all want these programs to move. You’ll arrive with teams that are eager to be pulled in rather than dragged, and partners who’ll do the work if you give them a clear plan and a clear finish line. What’s been missing is the person who holds the whole picture, not the willingness to help.

What You’ll Work On

• Drive security sales enablement operations: the operational backbone of the customer trust surface. Security questionnaires, RFP security sections, the trust portal, DPA/BAA intake, and customer security reviews. Build the reusable answer library, evidence packages, and intake process so no deal restarts from scratch and security is never the reason a cycle slips in close partnership with GRC.
• Vendor Management Process: Complete Vendor Security Reviews for vendors that will be both internal/ corporate vendors and vendors supporting customer facing products/ services. Understanding the difference between what is required for each of those types of vendors. Look for ways to streamline our vendor management process.
• Cross-Functional Collaboration: Work with security, legal/ privacy and the GTM team to develop internal and public facing whitepapers and documentation.
• Trust Center Management: Own and operate public or gated trust portals (using tools like OneLeet, Vanta, Drata, etc.) that share security whitepapers, compliance certifications, and architecture details with enterprise clients
• Support audit readiness as a delivery program, not a scramble. Own the plan behind SOC 2 Type II and HIPAA today and the path through ISO 27001, NIST 800-171, and FedRAMP/GovRAMP, control owners, evidence collection, gap remediation tracking, auditor logistics, and readiness milestones, in close partnership with GRC.
• Drive cross functional security programs across the company SaaS security posture and shadow IT, identity, insider risk, physical and office security, and security awareness and phishing programs. These programs live in everyone’s workflow and nobody’s job description; you’ll give them owners, a cadence, and measurable coverage.
• Support the security team’s operating cadence: roadmap and planning, program status, metrics and reporting to leadership, third-party risk operations, and the strategic initiatives that show up mid-quarter without a plan attached.
• Be the person who knows the state of the most critical security programs: who owns what, what’s at risk, what’s blocked, and what leadership needs to hear before they ask.

You Might Be a Great Fit If You…

• Have 5+ years in technical program or project management, including time spent on customer trust, security, or compliance programs.
• Have run cross-functional programs where you had zero formal authority over the people doing the work — and still landed them.
• Have supported the security side of enterprise deals: questionnaires, customer security reviews, and the calls where a customer’s security team asks the hard question.
• Build systems instead of reporting status. When you see the same fire drill twice, your instinct is to build the intake, the template, or the automation that kills it.
• Are comfortable being the first TPM in a function, to build the systems driving the outcomes.
• Write clearly. Much of this job is written: the program plan, the customer response, the executive update, the post-incident review.
• Close loops compulsively. Nothing you own goes quiet.

Bonus Points For

• High level privacy/legal documentation (e.g. DPAs, BAAs, etc.) review experience (e.g. you don’t need to be a lawyer but understanding what to look for and flag for review)
• Hands-on experience with FedRAMP/GovRAMP, IL4/IL5, or equivalent government-customer compliance requirements, including on-prem deployments.
• A practitioner background in security engineering, IT, or GRC that you still use.
• Fluency with compliance automation and security tooling — Vanta, Drata, Secureframe, vulnerability scanners, identity platforms — and the judgment to know when the tool is the wrong answer.
• Experience at an AI or ML-heavy company, including the novel security and evidence questions that come with model data and agent actions.
• Time as an incident commander or incident process owner.

Why Join Us

• Define the role 0→1. You’re the first security TPM here, with a direct line to the Head of Security and room to grow the scope as the company scales.
• Land with the org behind you. This role was created because teams across the company asked for it — you’ll have executive sponsorship and cross-functional partners who are genuinely eager to push these programs forward with you.
• Do work with visible impact: the programs you run are what unblock enterprise and government deals.