About this role
The ideal candidate for this role enjoys blending technical judgment with tangible delivery, thriving in an individual contributor capacity. This position is central to the Vendor Security team at OpenAI, which is responsible for ensuring internal teams can interact securely with external products, services, and partners across various domains like software, infrastructure, and data. The team builds the programs and tools necessary to help teams effectively assess vendor risk and implement robust safeguards.
This Vendor Security Technical Program Manager will focus on transforming recurring vendor security challenges into reusable tools and processes. The role requires an individual who can independently manage complex vendor security engagements, moving from understanding the underlying business need to verifying that effective safeguards are in place. Success in this role is defined by enabling internal teams to use vendors securely and by creating reusable work that minimizes future risk.
This role is suited for someone who is comfortable making sound security decisions, clearly articulating trade-offs, and adapting their approach as new evidence emerges. It is perfect for a technical leader who can bridge the gap between security principles, operational workflows, and strategic risk management.
What you will do
- Own vendor security engagements through the entire lifecycle, from initial business need understanding to scoping, assessment, decision-making, treatment, and reassessment.
- Investigate vendor use cases, data flows, identities, and supply-chain dependencies to identify potential attack paths and their consequences for OpenAI.
- Assess existing architectures, configurations, and controls, verifying that evidence supports stated security claims and clearly documenting any gaps or uncertainties.
- Develop practical treatment plans, which may involve changes to operating models, data exposure, or control implementations, and drive their verification.
- Build reusable security patterns that include clear requirements, evidence needs, exception procedures, and review triggers.
- Collaborate with Legal and Procurement to evaluate vendor terms, explain security implications, and negotiate workable positions.
- Translate security goals into technical requirements and delivery plans, influencing implementation choices and resolving cross-functional dependencies.
- Utilize AI-assisted tools to build, inspect, test, and maintain improvements to scoping, evidence checks, and tracking mechanisms.
What you need
- Must have independently assessed consequential third-party, supply-chain, or comparable security risks and possess the judgment to apply this to unfamiliar vendor technologies and operating models.
- Requires a strong understanding of core security principles and controls, including data protection, access management, application security, and incident response.
- Candidates must be able to reason effectively about architecture, identity management, APIs, data flows, and the efficacy of various controls.
- Knowledge of relevant frameworks and standards, such as ISO 27001, NIST 800-53, and SOC 2, is required to inform security assessments.
- Must have experience translating security findings and requirements into practical contractual positions with legal and vendor representatives.
- Demonstrated ability to deliver useful product or workflow improvements, test expected behavior, and take ownership of performance post-launch.
- Proficiency in using Codex or comparable AI-assisted development tools to build, run, inspect, and test solutions is necessary.
- Must be capable of independently delivering cross-functional programs, converting ambiguity into technical plans, and adapting priorities effectively.
Nice to have
- Experience with specific vendor risk management platforms
Benefits
- Salary range of $231.3K – $256.5K
- Offers Equity
Skills and tech stack
Questions candidates ask
What is the remote policy?
The location for this role is listed as US - Remote.
What is the compensation structure?
The salary range for this position is listed between $231.3K and $256.5K, and the role offers Equity.
What tools are used in the role?
The role involves using Codex or comparable AI-assisted tools to build, inspect, test, and maintain practical improvements to scoping, evidence checks, routing, decision reuse, or treatment tracking.
How is the team structured?
The role involves leading delivery across Security and partner teams.