Trust Product Manager (Security, Privacy & Compliance | GovTech

The company builds technology that helps families access public benefits and enables governments, health plans, and other organizations to operate those programs effectively. The Trust Product Manager will lead the company-wide trust transformation, own product strategy for security, privacy, compliance, and auditability capabilities, manage the trust and compliance program, and lead audits and external security engagements.

Responsibilities:

• Own the company's new trust operating model across Product, Engineering, Customer Delivery and company operations
• Turn regulatory, customer, security and privacy requirements into clear product, technical and operational requirements
• Partner with the Trust engineering lead to design and build the Trust layer
• Set durable approaches to production access, data handling, environment separation, release governance and evidence collection
• Own product direction for:
• Identity and access management, with least-privilege access
• Tenant and environment isolation
• Data classification, privacy, consent and data provenance
• Audit logging and change history
• Retention and data governance
• Secure release and deployment controls
• Continuous control monitoring
• Move controls out of manual processes and into reusable, software-enforced capabilities, so the compliant path becomes the default path
• Maintain policies, controls and evidence in Vanta, and coordinate control owners across the company
• Own the compliance roadmap and turn new requirements into cross-functional initiatives people can execute
• Keep a clear view of risks, control gaps, exceptions and remediation commitments
• Give leadership clear recommendations when trust requirements force business or product trade-offs
• Keep the company continuously ready for recurring SOC 2 audits
• Coordinate external audits, penetration tests and vendor risk reviews, and drive findings through to closure
• Launch the NIST 800-series alignment program and help chart the path toward FedRAMP-aligned practices
• Act as the main contact for customer security, privacy, compliance and AI-governance requirements
• Lead responses to security questionnaires, privacy and AI-use assessments, and procurement reviews
• Represent the company with security, legal and procurement teams at government agencies, Medicaid organizations and health plans
• Turn recurring customer requirements into reusable controls instead of solving them one customer at a time

Requirements:

• Significant hands-on experience owning security, privacy, trust, risk or compliance programs inside a software company
• Experience in regulated environments such as government, public-sector tech, healthcare, Medicaid, health plans or similar high-trust industries
• Working knowledge of SOC 2, NIST 800-series controls, HIPAA and government security standards
• A track record of leading audits, security questionnaires, penetration-testing programs and remediation
• Strong product management skills: problem definition, requirements, prioritization, roadmap ownership and cross-functional delivery
• Enough technical fluency to go deep with senior engineers on architecture, access models, data flows and controls
• The credibility and communication skills to stand in front of sophisticated customer security teams
• Comfort working autonomously while the function and the product are both still being built
• You must be based in the U.S