Strategic Information Security Programs Lead (Remote)

Figma; San Francisco (CA); On-site; USD 169,000 - 296,000; Full time

Job summary

Figma is seeking a Strategic Program Manager in Information Security to drive strategic initiatives and cross‑functional engagement across the organization. You will design programs and manage portfolios that scale with our growth.

This full‑time role can be held from one of our US hubs or remotely in the United States, collaborating with GRC, Security Operations, Engineering, Legal, People, Product, Sales, and business teams.

Qualifications

• 5+ years in security program management or related strategic role
• Experience leading cross‑functional security programs
• Ability to communicate security risks to technical and non‑technical leaders
• Knowledge of NIST CSF, SOC 2, ISO 27001, or equivalent frameworks
• Experience with security awareness and change management initiatives

Responsibilities

• Lead strategic security programs from planning through execution
• Partner with teams to identify and address security risks
• Define and track security program metrics, OKRs, risk registers, and reporting
• Coordinate remediation of security gaps with control owners and stakeholders
• Design scalable security practices, policies, processes, operating models, and change management plans
• Drive security awareness and engagement through trainings and communications
• Support leadership with strategic planning and portfolio management

Skills

Strategic program management

Cross-functional collaboration

Stakeholder communication

Security risk assessment

OKR & KPI tracking

Education

Bachelor's degree in a security/technical field

Tools

GRC platforms

Job description

Figma is seeking a Strategic Program Manager in Information Security to drive strategic initiatives and cross‑functional engagement across the organization. You will design programs and manage portfolios that scale with our growth.

This full‑time role can be held from one of our US hubs or remotely in the United States, collaborating with GRC, Security Operations, Engineering, Legal, People, Product, Sales, and business teams.