Prospance

About the role
We're looking for a Staff Technical Program Manager to drive delivery across our Enterprise Cybersecurity portfolio. Your first charter is our identity and access management (IAM) program — anchored by a large-scale migration from Microsoft Entra ID to Okta — but this is a portfolio role, not a single-program role. As the identity program matures, you'll flex across the broader cybersecurity roadmap: security operations (SOC), governance/risk/compliance (GRC), vendor risk, security awareness, and whatever the function needs delivered next.
This role lives on relationships and prioritization as much as on plans. You'll coordinate across enterprise security, infrastructure, compliance, legal, endpoint/digital workplace, and enterprise application teams; align our identity roadmap with the product security teams' own identity projects; and manage external implementation partners — keeping many threads moving, visible, and correctly sequenced against each other. If you're equally comfortable talking federation cutover sequencing with an IAM architect, reconciling priorities across two security organizations, and translating program risk into a crisp update for executive sponsors, this role is for you.
What you'll do
Own end-to-end program plans across the cybersecurity portfolio: scope, milestones, dependencies, resourcing, and critical path — starting with the Entra ID → Okta migration, decomposing the multi-year identity vision into executable milestones.
Coordinate federation, SSO, provisioning, and application onboarding workstreams, sequencing cutovers and rollback/hypercare plans to protect business continuity, and managing the external implementation partner through delivery.
Serve as the connective tissue between Enterprise Cybersecurity and the product security teams' identity initiatives: maintain a shared view of roadmaps and dependencies, surface collisions and overlaps early, and broker sequencing and ownership decisions so the two portfolios reinforce rather than block each other.
Run the operating cadence — planning, status reporting, RAID (risks, actions, issues, decisions) tracking, and stakeholder syncs — across internal teams and external partners, managing dependencies and controlling change in a fast-moving environment.
Drive cross-functional prioritization: build and maintain the relationships needed to get commitments from teams you don't manage, negotiate trade-offs when workstreams compete for the same people, and keep leadership equipped to make priority calls with current, honest information.
Juggle multiple complex problems in parallel and find creative solutions with limited resources — this is a lean team, and the answer is rarely "add headcount"; it's a smarter sequence, a lighter-weight process, or an unconventional path to the same outcome.
Drive governance of non-human identities — service accounts, service principals, workload identities, and API credentials — spanning discovery, ownership assignment and attestation, least-privilege scoping, rotation, and decommissioning, with full lifecycle (joiner/mover/leaver) coverage for human and non-human accounts.
Coordinate the identity↔endpoint seam with digital workplace and infrastructure teams: device trust, conditional/adaptive access, and device-posture signals informing access decisions.
Partner with compliance and audit teams to operationalize controls, coordinate evidence collection, and keep programs aligned to framework requirements (TISAX, ISO 27001, NIST CSF/800-53).
Report up and down with equal fluency: help prepare the reports, briefings, and materials that keep executives, sponsors, and delivery teams aligned on the same priorities — playing a pivotal role in the team's success by making its work visible, understood, and correctly prioritized.
Translate technical requirements into terms non-technical teams (legal, procurement, facilities, HR, business stakeholders) can act on, communicating priorities so every team understands what's needed from them, why, and by when.
Maintain program artifacts and single sources of truth (roadmaps, Gantt/status decks, RACI, action logs) in Jira, Confluence, and related tooling.
Manage vendor and contract touchpoints — SOWs, order forms, and implementation-partner deliverables — in coordination with procurement and legal.
Define and report program metrics (application migration progress, service-account remediation, cutover readiness, milestone health) to measure and communicate delivery.
What you'll bring
Bachelor's degree in computer science, information systems, cybersecurity, engineering, or a related field — or equivalent practical experience.
8+ years of technical program or project management experience, including 3+ years delivering identity and/or security programs.
Direct experience running an enterprise IAM platform migration or consolidation involving Okta and/or Microsoft Entra ID (Azure AD).
Working fluency (not necessarily hands-on configuration) in IAM/IGA/PAM concepts: SSO, federation (SAML/OIDC), SCIM provisioning, lifecycle management, and least-privilege access models.
Breadth across cybersecurity domains beyond identity — familiarity with security operations, GRC/audit, vendor risk, or incident response sufficient to run programs credibly in those areas.
A track record of cross-organizational coordination: building trusted relationships across teams you don't manage, aligning parallel roadmaps owned by different organizations, and driving prioritization without formal authority.
Demonstrated ability to lead cross-functional programs across technical and non-technical stakeholders in a matrixed environment, including external implementation partners and vendors.
Strong written and verbal communication, with the ability to report up to executives and down to delivery teams, and to translate technical requirements into clear priorities and asks for non-technical audiences.
Fluency with program tooling — Jira, Confluence, and slide/document production — and a bias toward clear, paste-ready artifacts.
Ability to juggle multiple complex problems simultaneously and find creative solutions with limited resources — comfort operating in a lean, fast-moving environment where you own execution end to end and resourcefulness beats headcount.
Nice to have
Experience in a TISAX, ISO 27001, or NIST-regulated environment; automotive or enterprise-JV context a plus.
Experience coordinating between enterprise/corporate security and product security organizations.
Familiarity with non-human identity/service-account governance and secrets management concepts and tooling (e.g., 1Password, CyberArk, HashiCorp Vault).
Familiarity with IGA/governance platforms and PAM tooling; exposure to endpoint/UEM platforms (e.g., Microsoft Intune, Jamf) and device-trust or passwordless approaches (FIDO2/passkeys, conditional access).
Exposure to SOC tooling and operations (SIEM, EDR, detection engineering programs) or GRC platforms.
Relevant certifications: PMP, CISSP, Okta Certified Professional/Administrator, Microsoft Identity & Access Administrator, or Certified ScrumMaster.