Program Manager, Security Risk Program

Meta; Menlo Park (CA); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Meta is seeking a Security Risk Program Manager to design and scale a new AI product launch risk assessment capability within the Risk and Compliance Program. You will translate product realities into defensible risk positions and coordinate across Security, Privacy, Integrity, and Legal to embed risk reviews in the launch cadence.

This role requires 8+ years in governance, risk, and compliance, and hands-on program building across cross-functional teams.

Qualifications

• 8+ years of governance, risk, and compliance experience.
• 3+ years of program management in a corporate environment.
• Experience designing a program from the ground up, including methodology, operating model, and rollout.
• Experience with AI risk frameworks (EU AI Act, NIST AI RMF).

Responsibilities

• Own the operating model for AI-launch security risk assessments.
• Lead cross-functional alignment with Engineering, Privacy, Integrity, and Legal.
• Scale from 5 to 20+ assessments per quarter by H1 2027.
• Define tooling requirements to automate and scale GRC processes.

Skills

GRC

Program management

Cross-functional collaboration

Stakeholder management

Verbal communication

Written communication

AI risk awareness

Regulatory knowledge

Education

Advanced degree in a relevant field

CISSP/CRISC/CISM/CISA certification

Tools

GRC tooling

Job description

We are building a governance, risk, and compliance function to enable our company to buildproducts that can withstand regulatory scrutiny, and ensure Meta continues to meet globalregulatory requirements and manage risk. Meta's Risk and Compliance Program (RCP) is the central engine driving risk management and compliance at the company, supporting Meta and the family of apps. Within RCP, the Security Risk Program (SRP) is the second-line function accountable for how Meta identifies, assesses, quantifies, and reports its security risk posture — delivering global security risk assessments, Capability Maturity & Effectiveness (CME) evaluations, AI and cloud risk assessments, and board-level and regulatory reporting.We are seeking a Security Risk Program Manager to build one of the program's highest-priority new capabilities: security risk assessment of AI product launches. Today, AI launches receivead-hoc coverage through security risk assessments designed for infrastructure — not forproduct-launch cadence, and not for cross-domain AI risk spanning Security, Privacy, Integrity,and Legal. You will design that capability from the ground up and scale it from roughly fiveassessments per quarter today to twenty or more per quarter by H1 2027, in step with Meta's AIproduct velocity.This is a builder and an influencer role in equal measure. AI launch risk cannot beassessed by one function acting alone — it requires Central Security, product groups, Privacy,Integrity, and Legal moving through a shared process on a launch timeline. You will own thatoperating model: translating product and engineering reality into a defensible risk position, andtranslating regulatory obligation into assessment work that product teams can actually absorbwithout stalling a launch. The ideal candidate is comfortable with ambiguity, effective inhigh-pressure and fast-moving situations, and able to build durable relationships across a widerange of technical and non-technical stakeholders. 8+ years of experience in governance, risk, and compliance, security risk management,regulatory compliance, or a directly related discipline3+ years of program management experience in a corporate environmentExperience with risk and compliance precepts, practices, and solutionsDemonstrated experience designing a program or process from the ground up — not solely running an established one — including methodology, operating model, and rolloutDemonstrated experience driving cross-functional alignment across technical and non-technical partners without direct authority, including with engineering or product organizationsProven verbal and written communication skills, with success influencing a range of audiences including senior leadership Experience assessing or managing risk for AI or machine learning systems, or familiarity with AI-specific regulatory and risk frameworks (EU AI Act, NIST AI RMF)Experience embedding risk, security, or compliance review into a fast-moving productdevelopment lifecycle and launch processExperience working in information security and/or cybersecurityExperience partnering with a central security or infrastructure security organization as asecond-line risk functionExperience defining tooling requirements or applying automation and AI to scale GRC operationsKnowledge of global regulatory frameworks, compliance practices, and risk management bestpracticesexperience with risk assessments, regulatory responses, audits, or control design3+ years working in a corporate environment subject to audit against federal or industry-wide regulationsExperience in a technology, financial services, consulting, or related fieldAdvanced degree and/or relevant certification (CISSP, CRISC, CISM, CISA)Demonstrated ability to integrate AI tools to optimize/redesign workflows and drive measurable impact (e.g., efficiency gains, quality improvements)Experience adhering to and implementing responsible, ethical AI practices (e.g., risk assessment, bias mitigation, quality and accuracy reviews)Demonstrated ongoing AI skill development (e.g., prompt/context engineering, agent orchestration) and staying current with emerging AI technologies