Senior Product Manager, Security Controls & Risk Programs

State Street; Austin (TX); Hybrid; USD 120,000 - 203,000; Full time

Benefits offered by this job

401K with company match

Health insurance

Paid time off

Employee Assistance Program

Performance-based awards

Tax-advantaged savings plans

Job summary

State Street is seeking a Principal Product Manager for Defensive Engineering Programs & Controls within Global Cyber Security. The role blends program management with GRC strategy, embedding within a security engineering function to modernize controls and ensure measurable risk reduction.

You will translate regulatory and audit requirements into technical roadmaps, drive complex programs across teams, and report to executives with governance updates. Financial services experience is a plus.

Qualifications

• Bachelor’s degree or equivalent in a technical field and >10 years in cybersecurity, product/program management or governance.
• Experience leading regulatory, audit, controls, or security modernization initiatives.
• Certifications such as CISSP, CISM, CRISC, PMP or equivalent preferred.

Responsibilities

• Lead modernization of security engineering controls across multiple domains.
• Define control objectives, KPIs, and metrics for effectiveness and risk reduction.
• Partner with engineering, risk, compliance, legal, and audit to drive implementation and remediation.
• Translate regulatory requirements into technical roadmaps and executable programs.
• Provide executive-level reporting and governance for cross-functional programs.

Skills

Cybersecurity programs

Governance & risk

Bridge engineering & risk

Program management

Financial services knowledge

Education

Bachelor’s degree in CS/InfoSec/Engineering/Business

10+ years cybersecurity/program management

Regulatory/audit/controls leadership

CISSP/CISM/CRISC/PMP

NIST/CIS/ISO27001 familiarity

Job description

State Street is seeking a Principal Product Manager for Defensive Engineering Programs & Controls within Global Cyber Security. The role blends program management with GRC strategy, embedding within a security engineering function to modernize controls and ensure measurable risk reduction.

You will translate regulatory and audit requirements into technical roadmaps, drive complex programs across teams, and report to executives with governance updates. Financial services experience is a plus.