Security Technical Program Manager, Risk & Compliance, Level 5

Snap, Los Angeles, California +2

The role

We’re looking for a Security Technical Program Manage to join Snap’s Security Governance, Risk & Compliance (GRC) team. In this role, you will design and build the continuous controls monitoring (CCM) capability that gives Snap real-time visibility into the health of its security and compliance controls. Your scope covers IT General Controls (ITGCs) and controls supporting SOX, CCPA, NIS2, ISO 27001, ISO 42001, SOC 2, PCI DSS, and related laws and regulations.

You will set the technical standard for how controls are designed, built into our systems, monitored, and evidenced. You will partner closely with Engineering, Internal Audit, Legal, Privacy, and Finance so that compliance is something we can measure continuously, not a once-a-year exercise.

All jobs

Security Technical Program Manager, Risk & Compliance, Level 5

Snap, Los Angeles, California +2

Posted pay

$162K–$284K

a year

Compared with similar jobs

This base pay is above the median for product management jobs in the Bay Area with no level in the job title.

Median: $212K a year
Other jobs in the group: 499

We compare the middle of each posted range. This is base pay as posted. The group does not include this job.

Location: Los Angeles, California +2
Work type: Not given
Level: Not given
Experience: 6+ years
Skills in the job text: AWS
GCP
Posted: 9 days ago
Last check: 4 h ago
Job type: Product management

Apply on the Snap site Sign in to save

The Snap site opens in a new tab.

Snap

Open tech jobs: 97
With posted pay: 85%
Median posted base: $178K–$313K

About Snap: funding, hiring and pay

Snap

About Snap: funding, hiring and pay

Check my fit

Compare your résumé with this job. See where you match, what is missing and which lines to change.

The role

What you will do

Architect, build, and own Snap’s continuous controls monitoring program, including automated control testing, evidence collection, and dashboards that show control health across all in-scope frameworks.
Define clear, testable control requirements and acceptance criteria across the ITGC domains of access management, change management, IT operations, and system development, as well as framework-specific controls for security, privacy, and operational resilience.
Partner with engineering teams early in the design of new or re-platformed systems so that capabilities like audit logging, segregation of duties, change approval, and evidence retention are built in before launch rather than added later.
Review significant infrastructure, platform, and AI/agent framework changes for compliance and risk mitigation impact while designs are still flexible, and keep an up-to-date view of how changes affect control scope, key control populations, and evidence needs.
Advance our GRC platform that supports a unified common controls framework and maps requirements across SOX, CCPA, NIS2, ISO 27001, ISO 42001, SOC 2, and PCI DSS, so each control is designed once, tested once, and reused across frameworks.
Design agentic automations that pull control evidence directly from source systems such as cloud platforms, identity providers, CI/CD tooling, ticketing systems, and infrastructure-as-code, and that validate the completeness and accuracy of control populations.
Identify, track, and root-cause control gaps surfaced through monitoring, internal reviews, or audits. Work with control owners and partner engineering teams on durable, engineering-driven fixes, and confirm that remediation actually resolves the issue before re-testing.
Act as a second-line partner, advising and challenging control owners without taking ownership of their controls, and maintaining a clear boundary between GRC monitoring and Internal Audit’s independent testing.
Significantly increase automated evidence coverage, reduce manual audit preparation effort, and shorten the time from control failure to detection.
Apply AI and LLM tools to accelerate control testing, evidence review, and compliance analysis, with sound judgment about where automation is reliable and where human review is still required.

Knowledge, skills, & abilities

Deep understanding of risk and compliance including common control frameworks and how auditors scope, test, and evaluate technology controls and deficiencies.
Broad familiarity with privacy, security, and resilience frameworks including CCPA/CPRA, NIS2, ISO 27001, ISO 42001, SOC 2, and PCI DSS v4.0, and an understanding of where their requirements overlap and differ.
Strong engineering fluency: comfortable reading and writing code, reviewing infrastructure-as-code, tracing a CI/CD pipeline end to end, and challenging a system design on its technical merits.
Ability to translate regulatory and framework language into concrete requirements engineers can build against, and to translate engineering reality back into assurance language that auditors, regulators, and leadership can rely on.
A strong preference for solving control gaps through system design and automation rather than manual procedures and workarounds.
Comfort making sound decisions with incomplete information and adjusting priorities as scope and business needs evolve.
Exceptional verbal and written communication skills, with the ability to tailor the message to engineers, executives, and auditors alike.
Proven ability to influence cross-functional stakeholders across Engineering, Finance, Legal, Privacy, and Internal Audit without direct authority.

Security Technical Program Manager, Risk & Compliance, Level 5

The role

Security Technical Program Manager, Risk & Compliance, Level 5

The role

What you will do

Knowledge, skills, & abilities

What you need

Nice to have

Pay and benefits

Zone A (CA, WA, NYC)

Zone B

Zone C

About Snap

Similar jobs at other companies

Member of Technical Staff, Security & Compliance Lead

Security Compliance Lead

Security Risk Management Lead

Product Manager, Compliance

GRC Engineer

Security GRC Engineer

Snap

Compared with similar jobs