Confluent - Staff Security Risk & Compliance Program Manager

At IBM Software, we transform client challenges into solutions. Building the world’s leading AI-powered, cloud-native products that shape the future of business and society. Our legacy of innovation creates endless opportunities for IBMers to learn, grow, and make an impact on a global scale. Working in Software means joining a team fueled by curiosity and collaboration. You’ll work with diverse technologies, partners, and industries to design, develop, and deliver solutions that power digital transformation. With a culture that values innovation, growth, and continuous learning, IBM Software places you at the heart of IBM’s product and technology landscape. Here, you’ll have the tools and opportunities to advance your career while creating software that changes the world. Confluent is pioneering a fundamentally new category of data infrastructure focused on data in motion. Have you ever found a new favorite series on Netflix, picked up groceries curbside at Walmart, or paid for something using Square? That’s the power of data in motion in action—giving organizations instant access to the massive amounts of data that are constantly flowing throughout their business. At Confluent, we’re building the foundational platform for this new paradigm of data infrastructure. Our cloud-native offering is designed to be the intelligent connective tissue enabling real-time data to constantly stream across the organization. We’re looking for self-motivated team members who crave a challenge and feel energized to roll up their sleeves and help realize Confluent’s enormous potential. Chart your own path and take healthy risks as we solve big problems together. We value having diverse teams and want you to grow as we grow—whether you’re just starting out in your career or managing a large team, you’ll be amazed at the magnitude of your impact. About the Role The Governance, Risk & Compliance organization helps Confluent understand, prioritize, and reduce risk while enabling the company to operate with confidence, meet customer and regulatory expectations, and scale its security and compliance programs. We are looking for a highly motivated and experienced Staff Technical Program Manager, GRC Special Projects, to join the Trust & Security organization. This role will report to the Director of Governance, Risk & Compliance and will lead a portfolio of high-priority, cross-functional initiatives that spans the full breadth of GRC. The work will vary based on the company’s most important needs. Projects may include risk remediation areas, risk and compliance metrics, governance operating models, issue and action management, control and framework improvements, GRC tooling and automation, audit or regulatory readiness, customer assurance commitments, third-party risk, and other initiatives that require focused program leadership and strategy. This role is designed for someone who can take an ambiguous or under-structured problem, create the right mechanism to solve it, and drive it to a measurable outcome. You will work across Engineering, Security, Legal, Privacy, Product, and other business functions without relying on direct authority. You will bring structure, judgment, analytical rigor, and clear communication to work that often involves competing priorities, incomplete information, and executive visibility. The successful candidate will operate as a strategic partner to the Director of GRC while remaining close to the details. You will define the problem, establish the operating rhythm, align stakeholders, expose risks and tradeoffs, drive decisions, and leave behind a durable process or capability when the project is complete. What You Will Do Lead high-priority, ambiguous, and cross-functional GRC special projects from problem definition through implementation, measurable outcomes, and transition to a durable owner. Translate risk, remediation, compliance, audit, or governance needs into clear program charters, objectives, roadmaps, milestones, dependencies, decision rights, and success measures. Drive risk remediation programs by aligning accountable owners, identifying root causes, tracking corrective actions, managing exceptions, escalating blockers, and ensuring that work addresses the underlying risk rather than only the symptom. Design and improve GRC metrics and reporting, including metric definitions, data sources, quality checks, trend analysis, dashboards, executive narratives, and recommendations for action. Establish governance mechanisms such as working groups, operating reviews, steering committees, roadmap reviews, and executive reporting cadences that create accountability and accelerate decisions. Partner with GRC subject-matter experts and cross-functional leaders to assess control, process, framework, or operating-model gaps and turn findings into prioritized improvement plans. Lead implementation and adoption of GRC processes, tooling, and automation that improve consistency, visibility, evidence quality, risk intelligence, and operational efficiency. Connect related workflows—including vulnerability management, security incidents, access management, third-party risk, customer assurance, internal audit, and compliance obligations—to create a more complete view of risk and remediation. Prepare concise, decision-ready communications for senior leadership, including status, risk posture, tradeoffs, recommendations, and requests for action. Build reusable templates, playbooks, mechanisms, and operating practices that improve how GRC programs are launched and run beyond a single project. Influence and lead through partnership rather than formal authority, including resolving cross-functional friction and driving closure on decisions and commitments. Act as a trusted thought partner to the Director of GRC by identifying high-leverage opportunities, anticipating emerging risks, and recommending where focused program leadership can create the greatest impact. 8+ years of experience in technical program management, governance, risk, compliance, information security, audit, or a closely related discipline. Demonstrated experience leading complex, long-term, cross-functional programs in a technology, cloud, SaaS, or similarly complex environment. Strong knowledge of security and GRC concepts, including risk management, control environments, remediation, issue and action management, audit readiness, compliance frameworks, and governance reporting. The ability to quickly learn unfamiliar domains, identify the critical path, and create structure where the problem, ownership, or path forward is not yet clear. Strong program-management fundamentals, including chartering, planning, dependency management, risk management, decision tracking, stakeholder alignment, escalation, and executive communication. Experience defining meaningful metrics, working with imperfect data, analyzing trends, and translating analysis into clear recommendations and measurable outcomes. Technical fluency sufficient to engage credibly with Engineering, Security, IT, and other technical teams on cloud infrastructure, applications, data, controls, and operational processes. A track record of influencing senior stakeholders and driving outcomes across organizational boundaries without direct authority. Experience improving processes through tooling, automation, reusable mechanisms, or operating-model design. Strong judgment, ownership, organization, attention to detail, and bias for action, balanced with the ability to prioritize ruthlessly. A relevant certification such as CISSP, CISM, CRISC, CISA, or equivalent is welcome but not required. United States Security Remote Professional Multiple Cities (0147) International Business Machines Corporation