Security Program Manager, Exam and Audit

Meta; Menlo Park, Northern (CA, KY); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Meta seeks a Staff-level Security Program Manager for its Regulatory Compliance Program in Menlo Park. You will lead audit-readiness efforts, manage second-line compliance functions, and collaborate with security, legal, and policy teams to ensure regulator-ready security practices worldwide.

You will drive remediation of systemic gaps, coordinate evidence for audits, and engage with regulators and audit bodies on behalf of Meta, while advancing responsible AI practices across programs.

Qualifications

• 8+ years in security compliance/GRC/regulatory program management in tech/financial services/healthcare
• Experience leading external security audits/regulatory examinations/third-party assessments
• Experience applying ISO 27001, SOC 2, NIST CSF, FedRAMP or equivalent frameworks
• Proven written communication of security/compliance to technical, legal, and executive stakeholders
• Ability to identify and drive remediation of systemic compliance gaps across cross-functional teams
• Professional certifications such as CISSP, CISA, CISM or equivalent
• Demonstrated ability to integrate AI tools to optimize workflows and improve outcomes
• Experience engaging regulators/audit bodies for a large tech platform
• Experience maturing second-line-of-defense in security/privacy compliance
• Experience implementing responsible AI practices (risk assessment, bias mitigation, quality reviews)
• Ongoing AI skill development (prompt/context engineering, agent orchestration)
• Ability to integrate AI-assisted tools to improve audit workflow and evidence analysis at scale

Responsibilities

• Lead audit-readiness programs and second-line compliance functions
• Coordinate evidence, findings responses, and remediation with internal teams
• Partner with security, legal, and policy teams to meet regulator/auditor expectations worldwide
• Drive design and execution of security compliance programs across external examinations
• Identify systemic gaps and drive cross-functional remediation
• Represent the organization in interactions with regulators or audit bodies
• Develop and mature second-line oversight within the security/privacy program
• Promote responsible, ethical AI practices in audits and compliance processes

Skills

Security GRC

Audit management

Compliance frameworks

Stakeholder communication

Gap remediation

Certifications

AI integration

Regulator engagement

Second-line oversight

Responsible AI

AI skills development

AI tooling

Job description

Meta's Regulatory Compliance Program sits at the intersection of global security regulation, product integrity, and enterprise risk management. The Exam and Audit team is responsible for establishing, maturing, and managing Meta's security compliance posture across external regulatory examinations, third-party audits, and internal assurance activities. As a Staff-level Security Program Manager on this team, you will serve as a strategic leader and subject-matter expert, driving the design and execution of audit-readiness programs, overseeing second-line-of-defense compliance functions, and partnering with security engineering, legal, and policy teams to ensure Meta's security practices meet the expectations of regulators and auditors worldwide.

• 8+ years of experience in security compliance, governance, risk and compliance (GRC), or regulatory program management within the technology, financial services, or healthcare industry
• Experience leading or managing external security audits, regulatory examinations, or third-party assessments, including evidence coordination, findings response, and remediation oversight
• Experience applying security compliance frameworks such as ISO 27001, SOC 2, NIST CSF, FedRAMP, or equivalent regulatory standards in an enterprise environment
• Experience communicating complex security and compliance concepts in writing to technical, legal, and executive stakeholders, including audit reports, control narratives, and regulatory correspondence
• Experience identifying and driving resolution of systemic compliance gaps across cross-functional security and engineering organizations
• Professional certification in security or audit disciplines such as CISSP, CISA, CISM, or equivalent
• Demonstrated ability to integrate AI tools to optimize/redesign workflows and drive measurable impact (e.g., efficiency gains, quality improvements)
• Demonstrated ability to integrate AI tools to optimize/redesign workflows and drive measurable impact (e.g., efficiency gains, quality improvements)
• Experience engaging directly with external regulators or audit bodies on behalf of a large-scale technology platform
• Experience designing or maturing second-line-of-defense oversight functions within a security or privacy compliance program
• Experience adhering to and implementing responsible, ethical AI practices (e.g., risk assessment, bias mitigation, quality and accuracy reviews)
• Experience adhering to and implementing responsible, ethical AI practices (e.g., risk assessment, bias mitigation, quality and accuracy reviews)
• Demonstrated ongoing AI skill development (e.g., prompt/context engineering, agent orchestration) and staying current with emerging AI technologies
• Demonstrated ongoing AI skill development (e.g., prompt/context engineering, agent orchestration) and staying current with emerging AI technologies
• Demonstrated ability to integrate AI-assisted tools to improve audit workflow efficiency, evidence analysis, or compliance monitoring at scale