Vendor Security Technical Program Manager

Overview

An individual-contributor role leading vendor-security engagements for OpenAI's Vendor Security team, combining security judgment with building reusable tools and workflows.

What you'll do

• Own vendor security engagements from understanding the business need through scoping, assessment, decision, treatment, and reassessment when material facts change.
• Make assessment decisions independently and route formal exceptions and risk acceptance to the appropriate decision owners.
• Understand vendor use cases, workflows, user journeys, data flows, identities, access, integrations, and supply-chain dependencies, and identify plausible attack paths and their consequences for OpenAI.
• Assess relevant architectures, configurations, controls, logs, and operational practices, and test whether the evidence supports the security claims that matter to the engagement.
• Develop practical treatments, including changes to the operating model, data exposure, access, architecture, vendor choice, controls, or containment, and verify that they work.
• Build reusable security patterns with clear applicability, safeguards, evidence requirements, exceptions, and review triggers.
• Work with Legal, Procurement, and vendors on security addenda, evaluating proposed terms and deviations and developing workable positions with the appropriate decision owners.
• Define the requirements, roadmap, and success measures for the bounded programs, products, and services you own.
• Use Codex or comparable AI-assisted tools to build, inspect, test, and maintain improvements to scoping, evidence checks, routing, decision reuse, or treatment tracking.
• Lead delivery across Security and partner teams, translating goals into technical requirements, milestones, and delivery plans.
• Use casework, incidents, threat information, and customer feedback to improve decisions and the program.

What you'll need

• Have independently assessed consequential third-party, supply-chain, or comparable security risks, and can apply that judgment to unfamiliar vendor technologies and operating models.
• Understand security principles and controls, including data protection, access management, application security, prevention, detection, and response.
• Can reason about architecture, identity, APIs, data flows, logging, integrations, and whether controls work.
• Know relevant frameworks and standards, including ISO 27001, NIST 800-53, and SOC 2, and can use them to inform an assessment of the actual engagement.
• Have translated security findings and requirements into practical contractual positions with Legal, Procurement, and vendor representatives.
• Have delivered useful products or workflow improvements, tested expected behavior and failure cases, learned from users, and owned performance after launch.
• Can use Codex or comparable AI-assisted development tools to build, run, inspect, and test working solutions.
• Have independently delivered cross-functional programs, turned ambiguity into technical requirements and plans, and adapted priorities to achieve measurable outcomes.
• Can judge when to build, use existing systems, or engage partners to resolve blockers.
• Build constructive relationships with Security, Engineering, Product, Privacy, Legal, business teams, and vendors.
• Communicate complex security issues clearly in writing and conversation, including recommendation, supporting evidence, and relevant tradeoffs.
• Question assumptions, investigate unfamiliar systems, and revise judgment when new evidence changes the situation.

Details

• Location: US - Remote.