Senior Technical Program Manager

Staff Technical Program Manager, Cybersecurity

Location: Palo Alto, CA (Hybrid) | Team: Enterprise Cybersecurity | Type: Full-time

JOB DESCRIPTION

Application question (required)

Vendors: include the candidate's answer in your submission notes. Submissions without it will not be reviewed.

Senior Engineer or Staff, Cybersecurity & AI Automation

Location: Palo Alto, CA (607 Hansen Way) or Irvine (14410 Myford Rd Irvine, CA 92606.), Hybrid
Team: Enterprise Cybersecurity
Type: Contract, full-time (40 hrs/week), Sep 2026 May 2027, possible extension

Job summary

Drive delivery across Rivian's Enterprise Cybersecurity portfolio, starting with a large-scale migration from Client Entra ID to Okta. Use AI and automation both to run the program and to roll out AI-enabled automation across the security function. We want someone who has already taken AI automation beyond pilots into governed production use that people actually rely on.

About the role

We're looking for a Senior Technical Program Manager to drive delivery across our Enterprise Cybersecurity portfolio. Your first charter is our identity and access management (IAM) program, anchored by a migration from Client Entra ID to Okta. This is a portfolio role, not a single-program role. As the identity program matures, you'll flex across the broader cybersecurity roadmap: security operations (SOC), governance/risk/compliance (GRC), vendor risk, security awareness, and whatever the function needs delivered next.

This is a lean team, and AI is how we scale it. You'll be expected to use AI and automation as everyday delivery tools, both to run the program itself and to roll out AI-enabled automation across cybersecurity. Examples include identity lifecycle workflows, access requests and reviews, alert triage in security operations, and collecting audit evidence. We want someone who has taken AI automation from experiment to production, with clear guardrails and measured results.

This role depends on relationships and prioritization as much as on plans. You'll coordinate across enterprise security, infrastructure, compliance, legal, digital workplace, and enterprise application teams. You'll align our identity roadmap with the product security teams' own identity projects and manage external implementation partners. If you're equally comfortable discussing federation cutover sequencing with an IAM architect, scoping an AI automation pilot with a security operations lead, and turning program risk into a crisp executive update, this role is for you.

What you'll do

Program delivery

• Own end-to-end program plans across the cybersecurity portfolio: scope, milestones, dependencies, resourcing, and critical path. Start with the Entra ID Okta migration, breaking the multi-year identity vision into executable milestones.
• Coordinate the federation, SSO, provisioning, and application onboarding workstreams. Sequence cutovers with rollback and hypercare plans that protect business continuity, and manage the external implementation partner through delivery.
• Run the operating cadence: planning, status reporting, RAID tracking (risks, actions, issues, decisions), and stakeholder syncs across internal teams and external partners.

AI and automation

• Lead AI and automation rollouts across the cybersecurity portfolio. Find the most repetitive manual processes, such as access requests, joiner/mover/leaver, access reviews, audit evidence, alert triage, and vendor risk questionnaires. Rank them by value and risk, and take them from pilot to production with measured adoption and time saved.
• Govern AI safely. Work with security architecture, legal, and privacy to define guardrails for AI tools and agents: data handling, model and vendor approval, human sign-off at key steps, and audit logging.
• Run the program with AI. Use AI for status reporting, summarizing risks and issues, turning meetings into tracked actions, and keeping Jira and Confluence current. Share the patterns that work with the wider team.
• Drive adoption, not just deployment. Own training, internal champions, feedback loops, and usage reporting so that automation is actually used and keeps improving.

Identity and security

• Drive governance of non-human identities: service accounts, service principals, workload identities, API credentials, AI agents, and automation accounts. Cover discovery, owner assignment and attestation, least-privilege scoping, rotation, and decommissioning, with full joiner/mover/leaver coverage for human and non-human accounts.
• Coordinate where identity meets the endpoint with digital workplace and infrastructure teams: device trust, conditional/adaptive access, and device-posture signals that inform access decisions.
• Partner with compliance and audit to put controls into practice, automate evidence collection where possible, and keep programs aligned to framework requirements (TISAX, ISO 27001, NIST CSF/800-53).

Alignment and communication

• Serve as the connective tissue between Enterprise Cybersecurity and the product security teams' identity initiatives. Keep a shared view of roadmaps and dependencies, surface collisions early, and broker sequencing and ownership decisions.
• Drive prioritization across teams. Build the relationships needed to get commitments from teams you don't manage, negotiate trade-offs when workstreams compete for the same people, and give leadership current, honest information for priority calls. On a lean team the answer is rarely "add headcount." It's usually a smarter sequence, a lighter process, or automation.
• Report up and down with equal fluency, and translate technical requirements into clear asks for legal, procurement, facilities, HR, and business stakeholders.
• Maintain program artifacts and single sources of truth (roadmaps, status decks, RACI, action logs) in Jira, Confluence, and related tools.
• Manage vendor and contract touchpoints (SOWs, order forms, implementation-partner deliverables) with procurement and legal.
• Define and report program metrics: application migration progress, service-account remediation, cutover readiness, milestone health, automation adoption, hours of manual work removed, and cycle time for AI-assisted processes.

What you'll bring

• Bachelor's degree in computer science, information systems, cybersecurity, engineering, or a related field, or equivalent practical experience.
• 8+ years of technical program or project management experience, including 3+ years delivering identity and/or security programs.
• Demonstrated experience leading at least one AI or AI automation rollout to production users in an enterprise, covering scoping, tool and vendor selection, governance, adoption, and measured outcomes.
• Daily hands-on use of AI tools (e.g., ChatGPT Enterprise, Claude, Client Copilot, Gemini, Atlassian Rovo) and automation platforms (e.g., Okta Workflows, Power Automate, ServiceNow, Workato, n8n). Be ready to show examples.
• Working knowledge of AI risks: data leakage, prompt injection, risk from AI vendors and models, and limiting what agents can access.
• Working fluency in IAM/IGA/PAM concepts (SSO, SAML/OIDC federation, SCIM provisioning, lifecycle management, least-privilege access). Hands-on configuration is not required.
• Experience delivering enterprise identity programs. Direct experience with an Okta and/or Client Entra ID migration or consolidation is strongly preferred.
• Breadth across cybersecurity domains beyond identity (security operations, GRC/audit, vendor risk, or incident response), enough to run programs credibly in those areas.
• A track record of coordinating across organizations: building trust with teams you don't manage, aligning parallel roadmaps owned by different groups, and driving prioritization without formal authority.
• Strong written and verbal communication. You can report up to executives and down to delivery teams, and turn technical requirements into clear asks for non-technical audiences.
• Fluency with Jira, Confluence, and slide/document production, with a bias toward clear, paste-ready artifacts.
• Comfort in a lean, fast-moving environment where you own execution end to end and resourcefulness beats headcount.

Nice to have

• Has personally built or configured AI agent workflows or connected AI models to business systems through APIs.
• Security automation tools for incident response (e.g., Tines, Torq, Cortex XSOAR), or compliance automation that monitors controls continuously (e.g., Vanta, Drata, AuditBoard).
• Familiarity with AI governance frameworks (NIST AI RMF, ISO/IEC 42001).
• Experience in a TISAX, ISO 27001, or NIST-regulated environment; automotive or enterprise joint-venture context a plus.
• Experience coordinating between enterprise/corporate security and product security organizations.
• Familiarity with non-human identity and secrets management tooling (e.g., 1Password, CyberArk, HashiCorp Vault).
• Exposure to IGA and PAM platforms, endpoint management (e.g., Client Intune, Jamf), and device-trust or passwordless approaches (FIDO2/passkeys, conditional access).
• Exposure to security operations tooling (SIEM, EDR, detection engineering) or GRC platforms.
• Relevant certifications: PMP, CISSP, Okta Certified Professional/Administrator, Client Identity & Access Administrator, or Certified ScrumMaster.