Senior Technical Program Manager, Third Party Risk Management
About this role
The Security Trust & Assurance team at CoreWeave is building leading Governance, Risk, and Compliance programs, including third-party risk management and data governance initiatives. As a Senior Technical Program Manager for Third Party Risk Management, you will work closely with cross-functional partners across engineering, procurement, IT, and Legal to govern external data sharing and secure operational workflows.
Your day-to-day work centers on maintaining comprehensive registers of external data shares, defining onboarding controls, monitoring data flows for undocumented sharing, and executing third-party security risk assessments. This operational role requires building programs from the ground up where limited established process exists, making it an ideal fit for someone who thrives amidst ambiguity and communicates complex technical risks effectively to both engineering and executive audiences.
What you will do
- Maintain a complete register of external data shares encompassing data categories, legal bases, purposes, transfer mechanisms, and contractual restrictions.
- Define and operationalize controls for onboarding new external data shares, covering pre-share reviews, data minimization, and documented approvals.
- Monitor external data flows to detect undocumented or out-of-scope sharing, driving remediation to closure with accountable teams.
- Establish metrics and reporting on data mapping coverage and external sharing risk for leadership and governance forums.
- Contribute to the Third-Party Risk Management strategy and roadmap to ensure alignment with security, privacy, and business objectives.
- Oversee and execute third-party security risk assessments, analyzing appropriate security controls, contract requirements, and compliance documentation.
- Act as the primary subject matter expert for technical third-party risk management and privacy risks while communicating complex concepts to technical and executive audiences.
What you need
- Have at least 5 years of professional experience in third-party risk management, data governance, privacy, or information security risk.
- Bring a minimum of 2 years of focused experience specifically working with external data sharing.
- Demonstrate hands-on experience building or maintaining data inventories and data maps, including classification and cross-border transfer mechanisms.
- Possess working knowledge of major privacy regulations such as GDPR, CCPA, and CPRA alongside transfer mechanisms like SCCs and DPAs.
- Hold relevant industry certifications such as CIPP/E, CIPM, CIPT, CISSP, CISA, CISM, or CRISC.
- Demonstrate experience conducting third-party security risk assessments and evaluating compliance artifacts like SOC 2, ISO 27001, and penetration test reports.
- Exhibit strong written and verbal communication skills with the ability to translate technical risk into business impact for executive stakeholders.
Nice to have
- Experience working with CSPs and Hyperscalers
- Ability to write lightweight automation or queries using SQL, Python, or scripting to reconcile data-sharing inventories
- Experience supporting audits or certifications and responding to customer inquiries regarding subprocessor practices
- Experience negotiating or reviewing DPAs, subprocessor agreements, and security exhibits with legal and procurement teams
- Prior work building a compliance program entirely from the ground up rather than operating an established one
Benefits
- Medical, dental, and vision insurance - 100% paid for by CoreWeave
- Company-paid Life Insurance and voluntary supplemental life insurance
- Short and long-term disability insurance, Flexible Spending Account, and Health Savings Account
- Tuition Reimbursement and participation in Employee Stock Purchase Program
- Mental Wellness Benefits through Spring Health and family-forming support provided by Carrot
- Paid Parental Leave, childcare support with Kinside, and a 401(k) with a generous employer match
Skills and tech stack
Questions candidates ask
What is the salary range for this role?
The base salary range for this position is $157,000 to $210,000. The starting salary is determined based on job-related knowledge, skills, experience, and market location.
What locations are available for this position?
This role can be based out of Livingston, New Jersey; New York, New York; Sunnyvale, California; or Bellevue, Washington.
What kind of benefits are provided for US-based employees?
US-based full-time employees receive 100% employer-paid medical, dental, and vision insurance, life and disability insurance, flexible PTO, catered lunches in office and data center locations, and a 401(k) with a generous employer match.