Security Program Manager, Exam and Audit

Meta; Washington (District of Columbia); On-site; USD 180,000 - 240,000; Full time

Job summary

Meta is seeking a Staff-level Security Program Manager to lead the design and execution of audit-readiness programs for external security regulatory examinations and third-party audits. You will act as a senior SME on security compliance frameworks and partner with security, legal, and policy teams to ensure regulator expectations are met.

You will drive second-line-of-defense oversight, manage evidence libraries, and coordinate remediation across product, infra, and operations, while shaping

Qualifications

• 8+ years of experience in security compliance, governance, risk and compliance (GRC) or regulatory program management
• Experience leading external security audits, regulatory examinations, or third-party assessments
• Experience applying security frameworks like ISO 27001, SOC 2, NIST CSF, FedRAMP or equivalents
• Experience communicating complex security concepts in writing to technical, legal and executive stakeholders
• Experience identifying and driving remediation of systemic compliance gaps across cross-functional teams

Responsibilities

• Lead end-to-end strategy and execution of external security regulatory examinations and audits
• Advise cross-functional teams on audit obligations and control expectations
• Develop and maintain an audit-readiness program with testing schedules and evidence libraries
• Oversee second-line-of-defense by assessing security controls across product, infra, and operations
• Partner with legal, privacy, and policy to translate regulatory requirements into control frameworks
• Identify compliance gaps and drive remediation and risk-mitigation strategies
• Define roadmaps for evolving the audit program and invest in tooling
• Communicate findings and program status to leadership through briefings and reports
• Mentor program managers and compliance professionals on audit practices
• Anticipate regulatory trends and adjust strategy accordingly

Skills

Security compliance

GRC

Audit management

ISO 27001

SOC 2

NIST CSF

FedRAMP

Regulatory frameworks

Job description

Meta's Regulatory Compliance Program sits at the intersection of global security regulation, product integrity, and enterprise risk management. The Exam and Audit team is responsible for establishing, maturing, and managing Meta's security compliance posture across external regulatory examinations, third-party audits, and internal assurance activities. As a Staff-level Security Program Manager on this team, you will serve as a strategic leader and subject-matter expert, driving the design and execution of audit-readiness programs, overseeing second-line-of-defense compliance functions, and partnering with security engineering, legal, and policy teams to ensure Meta's security practices meet the expectations of regulators and auditors worldwide.

Security Program Manager, Exam and Audit Responsibilities:

• Lead the end-to-end strategy and execution of external security regulatory examinations and third-party audits, including scoping, evidence coordination, findings management, and remediation tracking
• Serve as a senior subject-matter expert on security compliance frameworks such as ISO 27001, SOC 2, NIST CSF, and applicable regulatory requirements, advising cross-functional teams on audit obligations and control expectations
• Develop and maintain a comprehensive audit-readiness program, including control testing schedules, evidence libraries, and continuous monitoring mechanisms to sustain audit-ready posture
• Provide second-line-of-defense oversight by independently assessing the design and operating effectiveness of security controls across product, infrastructure, and operational domains
• Partner with security engineering, legal, privacy, and policy teams to translate regulatory requirements into actionable control frameworks and scalable compliance processes
• Identify systemic compliance gaps and drive prioritized remediation efforts, serving as a key escalation point for risk acceptance decisions and regulatory risk mitigation strategies
• Define long-term roadmaps for the evolution of Meta's security exam and audit program, including operating model improvements, tooling investments, and program maturity milestones
• Communicate audit findings, compliance posture, and program status to senior leadership and external stakeholders through clear written briefings, executive summaries, and regulatory response documentation
• Mentor other program managers and compliance professionals on audit methodology, regulatory engagement, and security control assessment practices
• Anticipate regulatory trends and emerging audit requirements, proactively adjusting program strategy to address new obligations before they become compliance risks

Minimum Qualifications:

• 8+ years of experience in security compliance, governance, risk and compliance (GRC), or regulatory program management within the technology, financial services, or healthcare industry
• Experience leading or managing external security audits, regulatory examinations, or third-party assessments, including evidence coordination, findings response, and remediation oversight
• Experience applying security compliance frameworks such as ISO 27001, SOC 2, NIST CSF, FedRAMP, or equivalent regulatory standards in an enterprise environment
• Experience communicating complex security and compliance concepts in writing to technical, legal, and executive stakeholders, including audit reports, control narratives, and regulatory correspondence
• Experience identifying and driving resolution of systemic compliance gaps across cross-functional security and engineering organizations

Preferred Qualifications:

• Professional certification in security or audit disciplines such as CISSP, CISA, CISM, or equivalent
• Demonstrated ability to integrate AI tools to optimize/redesign workflows and drive measurable impact (e.g., efficiency gains, quality improvements)
• Demonstrated ability to integrate AI tools to optimize/redesign workflows and drive measurable impact (e.g., efficiency gains, quality improvements)
• Experience engaging directly with external regulators or audit bodies on behalf of a large-scale technology platform
• Experience designing or maturing second-line-of-defense oversight functions within a security or privacy compliance program
• Experience adhering to and implementing responsible, ethical AI practices (e.g., risk assessment, bias mitigation, quality and accuracy reviews)
• Experience adhering to and implementing responsible, ethical AI practices (e.g., risk assessment, bias mitigation, quality and accuracy reviews)
• Demonstrated ongoing AI skill development (e.g., prompt/context engineering, agent orchestration) and staying current with emerging AI technologies
• Demonstrated ongoing AI skill development (e.g., prompt/context engineering, agent orchestration) and staying current with emerging AI technologies
• Demonstrated ability to integrate AI-assisted tools to improve audit workflow efficiency, evidence analysis, or compliance monitoring at scale

About Meta:

Meta builds technologies that help people connect, find communities, and grow businesses. When Facebook launched in 2004, it changed the way people connect. Apps like Messenger, Instagram and WhatsApp further empowered billions around the world. Now, Meta is moving beyond 2D screens toward immersive experiences like augmented and virtual reality to help build the next evolution in social technology. People who choose to build their careers by building with us at Meta help shape a future that will take us beyond what digital connection makes possible today—beyond the constraints of screens, the limits