Want to know if this job is worth applying to?
San Francisco, California, United States
Onsite
Rebuild how the world works, to make institutions work better for the people they serve.
Brain Co. builds AI-native operating systems for large, regulated institutions. Each system is built for a specific industry, powered by agents that push real workflows forward. Underneath it all is Atlas, our proprietary platform that keeps customers in control, secure by design, and never locked into one model.
Brain Co. is entering its next phase of production deployments on a national scale with an elite team built from Palantir, Google, Meta, and Nvidia, and a growing footprint across government, insurance, health, and financial services.
Joining now means shaping both the company and a new category of applied AI. Every project here ships to production and is expected to create measurable customer value and impact.
You'll work alongside exceptional peers on some of the hardest problems in applied AI. It’s the kind of work you'll still be proud of in ten years from now.
At Brain Co., we focus on applying frontier AI to real institutional challenges, working alongside governments, healthcare systems, and critical industries to modernize how essential services operate. We are looking for leaders who want to help bring new technology into institutions that impact millions of people.
Security work at Brain Co. does not stay inside the security team. Audit readiness needs Engineering, HR, Finance, and Legal. Enterprise deals stall on security questionnaires and customer security reviews. Identity spans IT and Security, and neither can finish it alone. Vulnerability remediation lands on engineering teams that don’t report to us. Someone has to own the delivery of that work end-to-end: the plan, the owners, the cadence, and the finish line. That’s this role.
Brain Co. carries one of the most demanding regulatory loads of any company our size: SOC 2 Type II and HIPAA in place today, with ISO 27001, NIST 800-171, and FedRAMP/GovRAMP on the near-term roadmap. That’s what it costs to sell to governments, hospitals, and financial institutions and done right, it’s how we win the next ones.
As our first Technical Program Manager on the Security team, you’ll run the security programs that touch every part of the company from the security review that unblocks a government deal, to the identity program that spans IT and Security, to the incident process the whole company depends on. You’ll report to the Head of Security as an individual contributor with the scope and trust to define how security programs run here.
This is not a ticket-herding job. You’ll be technical enough to read an IAM policy, follow an architecture diagram, and push back on a remediation plan that doesn’t hold up, and operational enough to turn a recurring mess into a system that runs without you in the room.
You won’t be doing this alone. Security, IT, GRC, Engineering, and GTM all want these programs to move. You’ll arrive with teams that are eager to be pulled in rather than dragged, and partners who’ll do the work if you give them a clear plan and a clear finish line. What’s been missing is the person who holds the whole picture, not the willingness to help.
What You’ll Work On
• Drive security sales enablement operations: the operational backbone of the customer trust surface. Security questionnaires, RFP security sections, the trust portal, DPA/BAA intake, and customer security reviews. Build the reusable answer library, evidence packages, and intake process so no deal restarts from scratch and security is never the reason a cycle slips in close partnership with GRC.
• Vendor Management Process: Complete Vendor Security Reviews for vendors that will be both internal/ corporate vendors and vendors supporting customer facing products/ services. Understanding the difference between what is required for each of those types of vendors. Awhile looking for ways and streamline our vendor management process.
• Support audit readiness as a delivery program, not a scramble. Own the plan behind SOC 2 Type II and HIPAA today and the path through ISO 27001, NIST 800-171, and FedRAMP/GovRAMP, control owners, evidence collection, gap remediation tracking, auditor logistics, and readiness milestones, in close partnership with GRC.
• Turn vulnerability management into a continuous, self-managing program that runs at machine speed. Definitions, SLAs by severity, automated routing to the engineering teams that own the fix, an exception process people actually use, and dashboards that stay current on their own — so the program reports itself and only the exceptions reach a human.
• Support the planning and tracking of GRC-related continuous monitoring activities to ensure all necessary compliance related requirements are being met. This may include, proper access provisioning/deprovision tasks are being evidenced, access reviews are being performed in proper cadence, BCP and IR testing, configuration reviews, etc.
• Drive security-heavy product launches as needed. Most launches won’t need you; some can’t ship without you. When security is load-bearing, such as government and healthcare deployments, multi-cloud environments, you’ll embed with the product and engineering teams and make sure threat modeling, security reviews, and sign-offs happen early enough to matter, with launch blockers surfaced before launch week.
• Drive cross functional corporate security programs across the company SaaS security posture and shadow IT, identity, insider risk, physical and office security, and security awareness and phishing programs. These programs live in everyone’s workflow and nobody’s job description; you’ll give them owners, a cadence, and measurable coverage.
• Drive security-heavy product launches as needed. Most launches won’t need you; some can’t ship without you. When security is load-bearing, government and healthcare deployments, on-prem environments, agent workloads running inside customer systems — you’ll embed with the product, engineering, security and IT teams and make sure dependencies and sign-offs happen early enough to matter, with launch blockers surfaced well before launching deadlines.
• Own the operating process around incident management escalation paths, comms templates, tabletop exercises, incident commander support during live events, and post-incident reviews where the remediation items get driven to done, not filed.
• Run the security team’s operating cadence: roadmap and planning, program status, metrics and reporting to leadership, third-party risk operations, and the strategic initiatives that show up mid-quarter without a plan attached.
• Be the person who knows the state of the most critical security programs: who owns what, what’s at risk, what’s blocked, and what leadership needs to hear before they ask.
You Might Be a Great Fit If You…
• Have 5+ years in technical program or project management, including time spent on security, infrastructure, IT, or compliance programs.
• Have run cross-functional programs where you had zero formal authority over the people doing the work — and still landed them.
• Can hold your own with engineers. You can read an IAM policy, follow a cloud or Kubernetes architecture discussion, and tell the difference between a CVE that matters and one that doesn’t, without needing everything translated for you.
• Have run or been deep in at least one real audit cycle — SOC 2, HIPAA, ISO 27001, FedRAMP, or equivalent — on the delivery side, owning evidence and remediation rather than watching from a dashboard.
• Have supported the security side of enterprise deals: questionnaires, customer security reviews, and the calls where a customer’s security team asks the hard question.
• Build systems instead of reporting status. When you see the same fire drill twice, your instinct is to build the intake, the template, or the automation that kills it.
• Are comfortable being the first TPM in a function, to build the systems driving the outcomes.
• Write clearly. Much of this job is written: the program plan, the customer response, the executive update, the post-incident review.
• Close loops compulsively. Nothing you own goes quiet.
Bonus Points For
• High level privacy/legal documentation (e.g. DPAs, BAAs, etc.) review experience (e.g. you don’t need to be a lawyer but understanding what to look for and flag for review)
• Hands-on experience with FedRAMP/GovRAMP, IL4/IL5, or equivalent government-customer compliance requirements, including on-prem deployments.
• A practitioner background in security engineering, IT, or GRC that you still use.
• Fluency with compliance automation and security tooling — Vanta, Drata, Secureframe, vulnerability scanners, identity platforms — and the judgment to know when the tool is the wrong answer.
• Experience at an AI or ML-heavy company, including the novel security and evidence questions that come with model data and agent actions.
• Time as an incident commander or incident process owner.
Why Join Us
• Own the delivery of security programs for an AI platform deployed in governments, hospitals, and critical industries worldwide — where the regulatory bar is real and the work matters.
• Define the role 0→1. You’re the first security TPM here, with a direct line to the Head of Security and room to grow the scope as the company scales.
• Land with the org behind you. This role was created because teams across the company asked for it — you’ll have executive sponsorship and cross-functional partners who are genuinely eager to push these programs forward with you.
• Do work with visible impact: the programs you run are what unblock enterprise and government deals.
• Work alongside senior engineers from Tesla, DeepMind, Databricks, and other top engineering orgs who treat security as a partner, not a tax.
• Earn competitive compensation and meaningful equity in a high-growth company.