Replit is seeking a Senior Technical Program Manager to own our vulnerability management program end to end. In this role you will drive vulnerability intake, triage, remediation, and reporting across the bug bounty program, Google Cloud Platform infrastructure, source code hosted on GitHub, and a broad portfolio of third-party SaaS services. You will partner with platform engineering, product engineering, SRE, security, IT, legal, and vendor management to ensure vulnerabilities are found quickly, triaged accurately, and closed within SLA — and that leadership always has a clear, current picture of the organization's risk posture. The ideal candidate uses AI and automation aggressively to scale themselves, but understands that the core value is clarity, tradeoffs, and execution, not just tooling. What you'll do: Program Ownership — own and continuously improve the vulnerability management program, including intake, severity scoring, SLA definition, and remediation tracking across all asset types. Bug Bounty Operations — manage the triage/payouts/rewards workflow, and report on program health and trends. Cloud Remediation (GCP) — drive remediation of vulnerabilities found in GCP infrastructure across IAM, networking, Compute/GKE, storage, and logging/monitoring configuration. Code & Supply Chain Security — coordinate remediation of vulnerabilities surfaced through SAST/DAST/SCA tooling across engineering repos, including dependency and supply-chain risk. SaaS Vendor Risk — build and manage the process for assessing and tracking security posture across third-party SaaS applic

Replit is seeking a Senior Technical Program Manager to own our vulnerability management program end to end. In this role you will drive vulnerability intake, triage, remediation, and reporting across the bug bounty program, Google Cloud Platform infrastructure, source code hosted on GitHub, and a broad portfolio of third-party SaaS services. You will partner with platform engineering, product engineering, SRE, security, IT, legal, and vendor management to ensure vulnerabilities are found quickly, triaged accurately, and closed within SLA — and that leadership always has a clear, current picture of the organization's risk posture. The ideal candidate uses AI and automation aggressively to scale themselves, but understands that the core value is clarity, tradeoffs, and execution, not just tooling. What you'll do: Program Ownership — own and continuously improve the vulnerability management program, including intake, severity scoring, SLA definition, and remediation tracking across all asset types. Bug Bounty Operations — manage the triage/payouts/rewards workflow, and report on program health and trends. Cloud Remediation (GCP) — drive remediation of vulnerabilities found in GCP infrastructure across IAM, networking, Compute/GKE, storage, and logging/monitoring configuration. Code & Supply Chain Security — coordinate remediation of vulnerabilities surfaced through SAST/DAST/SCA tooling across engineering repos, including dependency and supply-chain risk. SaaS Vendor Risk — build and manage the process for assessing and tracking security posture across third-party SaaS applic