Program Manager III, Operational Technology Security, Data Centers

A problem isn’t truly solved until it’s solved for all. That’s why Googlers build products that help create opportunities for everyone, whether down the street or across the globe. As a Program Manager at Google, you’ll lead complex, multi-disciplinary projects from start to finish — working with stakeholders to plan requirements, manage project schedules, identify risks, and communicate clearly with cross-functional partners across the company. Your projects will often span offices, time zones, and hemispheres. It's your job to coordinate the players and keep them up to date on progress and deadlines.

As a Program Manager for Operational Technology (OT) Cybersecurity, you will support vulnerability management programs across the operational technology that supports critical infrastructure. These environments have tight downtime limits, safety concerns and complex vendor dependencies, so standard IT remediation practices often don't apply. You will manage vulnerability projects including end-to-end remediation, metrics development, and exceptions reporting. You will also drive the initial triage of Common Vulnerabilities and Exposures (CVEs), judging exploitability in an OT context, checking applicability against the asset inventory, and coordinate with the OT Security Review Working Group to deliberate on a severity as needed. You will also build the program structure that makes this repeatable at scale, including tracking in Task Flow, SOPs and swimlanes. The role calls for strong ICS technical knowledge, comfort with ambiguity, and the ability to turn technical risk into prioritized plans that protect both security and uptime.

Responsibilities

• Read and interpret CVEs and ICS advisories from sources such as CISA ICS-CERT, vendor PSIRTs and Mandiant threat intelligence. Turn the technical findings into clear, actionable guidance for operational teams.
• Judge real-world exploitability in an OT context by looking at network exposure, the access an attacker would need, and device mode or state. Check advisories against the OT asset inventory to find affected devices, models and firmware versions, so remediation targets the right assets.
  
• Plan, track and report on cross-functional remediation programs in a project management tool such as Task Flow. 
• Keep milestones, dependencies, blockers and SLO performance visible. Write and maintain Standard Operating Procedures (SOPs).
  
• Run triage decisions on critical vulnerabilities and send qualified findings to the right engineering, operations or vendor teams.

Minimum qualifications:

• Bachelor's degree or equivalent practical experience.
• 5 years of experience in program or project management.
• Experience in data centers.
• Experience in cyber security, artificial intelligence, analysis, and process engineering.

Preferred qualifications:

• Experience in Task Flow.
• Experience with Lean, Six Sigma or similar methods to streamline workflows, cut cycle times and improve how well vulnerability remediation programs scale.
• Familiarity with data center critical infrastructure, including electrical, mechanical and cooling controls, and how cybersecurity risk turns into operational and uptime risk.