Technical Program Manager, Product Security

Waymo’s Product Management Team is a mission-driven team responsible for writing and enacting first-of-their-kind playbooks to bring fully autonomous driving technology to market. Our team develops simple solutions for complex problems by orchestrating cross-functional efforts to safely drive Waymo’s technology and the products it enables forward. We do this by understanding the customer, the business, and the technology. We are humble about the scope of our work, collaborative in our approach to problem-solving, and ambitious about our vision for the future.

This role follows a hybrid work schedule and reports to the Manager of Technical Program Management, Cybersecurity.

You will:

• Own and drive the multi-year product security roadmap for the Waymo Driver and the vehicle platforms it integrates with, spanning embedded compute, sensors, vehicle networks, and the cloud services that provision, update, and operate our fleet.
• Lead cross-functional security programs through hardware, embedded software, cloud infrastructure, manufacturing, and fleet operations teams, turning security goals into committed plans, owners, and milestones.
• Drive security requirements from threat analysis through implementation and verification, and own release security reporting: requirement coverage, open risks, exceptions, and readiness for each software and hardware release.
• Frame trade-offs between security, performance, schedule, and operability as clear options, and drive decisions to completion with accountable owners.
• Drive security across the full device lifecycle, from secure manufacturing and key provisioning through secure boot, over-the-air updates, field operations, and vulnerability response, until controls are verified across the deployed fleet.
• Partner with vehicle and hardware platform partners, and keep programs aligned with applicable product security standards and regulations (e.g., ISO/SAE 21434, UN R155/R156) as Waymo expands internationally.

You have:

• 8+ years of relevant experience, including 5+ years of technical program management delivering hardware, embedded, or device-to-cloud products.
• A hands-on security background (e.g., security engineering, embedded or firmware security, product security architecture). You can explain how security controls work, how they fail, and what they cost to build, and you act as a technical peer to security and systems engineers.
• Experience delivering security capabilities on shipped hardware or embedded products, such as secure or verified boot, hardware roots of trust (HSM, TPM, secure element, TEE), PKI and key management, code signing, secure OTA updates, or authenticated communication.
• A track record of delivering cross-functional programs through teams you did not manage, including getting security work prioritized against competing product goals.
• Experience framing technical risk for decision makers and driving decisions through to execution, with clear communication to both engineers and executives.
• A BS in Computer Science, Electrical or Computer Engineering, Cybersecurity, or equivalent practical experience.

We prefer:

• Prior engineering experience in security, firmware, or embedded systems before moving into technical program management.
• Experience securing production fleets of connected devices (vehicles, robots, drones, consumer or industrial devices), including vulnerability response and verifying remediation across the deployed fleet.
• Experience with secure manufacturing at contract manufacturers: device identity, key injection, and factory signing infrastructure.
• Experience with real-time or in-vehicle networks and their security (e.g., CAN/CAN FD, Automotive Ethernet, SecOC, diagnostic authentication), or with safety-critical systems (e.g., ISO 26262, DO-178C, IEC 61508).
• Familiarity with product security standards and regulation (e.g., ISO/SAE 21434, UN R155/R156, IEC 62443, EU Cyber Resilience Act, FIPS 140-3) and threat analysis methods (TARA, STRIDE); experience building release security metrics and exception and risk-acceptance processes.

Travel requirements:

• Approximately 10%: quarterly team alignment in the Bay Area (for hires based outside the Bay Area), plus program travel to vehicle platform partners, manufacturing sites, and depots as needed.