供应商安全技术项目经理
Vendor Security Technical Program Manager
关于团队
OpenAI的供应商安全团队帮助内部团队安全地与外部产品、服务和合作伙伴协作。我们的工作涵盖软件、基础设施、硬件、专业和管理服务、供应商提供的员工、数据和研究。我们构建程序和产品，帮助团队了解供应商风险并建立有效的防护措施，保护我们的客户、员工和公司。
关于职位
我们正在寻找一位供应商安全技术项目经理，能够做出合理的安全决策，并将常见的供应商安全问题转化为有效工具和实践。
你将独立领导供应商安全相关的工作：理解业务需求，调查实际数据和访问情况，推荐可行的路径，并与相关负责人合作直到防护措施得到验证。你还将利用所学知识，构建和改进有限的工具和流程，优先级由供应商安全负责人确定。
这是一个需要结合技术判断和有效交付能力的个人贡献者职位。你应该能够坚定地表达立场，解释权衡因素，并在证据变化时改变自己的想法。成功意味着内部团队可以安全地使用供应商，重复使用仍适用的工作，并清楚下一步需要做什么。
在此职位中，你将：
- 从理解业务需求开始，到范围定义、评估、决策、处理以及当关键事实发生变化时重新评估，全面负责供应商安全工作。独立做出评估决策，并判断何时需要与同事、专家或管理层进行沟通。将正式的例外情况和风险接受提交给相应的决策负责人。
- 理解供应商的使用场景、工作流程、用户旅程、数据流、身份、访问、集成和供应链依赖关系。识别可能的攻击路径及其对OpenAI的后果。
- 评估相关的架构、配置、控制、日志和操作实践。测试证据是否支持与工作相关的安全声明，并明确指出差距和不确定性。
- 开发实用的处理方案，包括运营模式、数据暴露、访问、架构、供应商选择、控制或隔离方面的变更。与相关负责人合作推动实施，并验证处理方案是否有效。
- 构建可重复使用的安全模式，明确适用性、防护措施、证据要求和例外情况。
查看英文原文
About the Team
OpenAI's Vendor Security team helps internal teams work securely with external products, services, and partners. Our work spans software, infrastructure, hardware, professional and managed services, vendor-provided workforces, data, and research. We build the programs and products that help teams understand vendor risk and put effective safeguards in place, protecting our customers, employees, and the company.
About the Role
We are looking for a Vendor Security Technical Program Manager who can make sound security decisions and turn recurring vendor-security problems into tools and practices that work.
You will independently lead vendor-security engagements: understand the business need, investigate the actual data and access, recommend a practical path, and work with the responsible owners until the safeguards are verified. You will also use what you learn to build and improve bounded tools and workflows, with priorities agreed with the Vendor Security lead.
This is an individual-contributor role for someone who combines technical judgment with useful delivery. You should be comfortable taking a position, explaining the tradeoff, and changing your mind when the evidence changes. Success means internal teams can use vendors securely, reuse work that still applies, and understand what needs to happen next.
In this role, you will:
- Own vendor security engagements from understanding the business need through scoping, assessment, decision, treatment, and reassessment when material facts change. Make assessment decisions independently and use judgment about when to involve peers, specialists, or leadership. Route formal exceptions and risk acceptance to the appropriate decision owners.
- Understand vendor use cases, workflows, user journeys, data flows, identities, access, integrations, and supply-chain dependencies. Identify plausible attack paths and their consequences for OpenAI.
- Assess relevant architectures, configurations, controls, logs, and operational practices. Test whether the evidence supports the security claims that matter to the engagement, and make gaps and uncertainty clear.
- Develop practical treatments, including changes to the operating model, data exposure, access, architecture, vendor choice, controls, or containment. Drive implementation with the responsible owners and verify that the treatment works.
- Build reusable security patterns with clear applicability, safeguards, evidence requirements, exceptions, and review triggers.
- Work with Legal, Procurement, and vendors on security addenda. Evaluate proposed terms and deviations against the engagement, explain their security implications, and develop workable positions with the appropriate decision owners. Legal leads wording and negotiation.
- Learn from internal customers, agree priorities with the Vendor Security lead, and define the requirements, roadmap, and success measures for the bounded programs, products, and services you own.
- Use Codex or comparable AI-assisted tools to build, inspect, test, and maintain practical improvements to scoping, evidence checks, routing, decision reuse, or treatment tracking. Investigate failures and own the result through adoption, continued operation, and explicit handoff or retirement.
- Lead delivery across Security and partner teams. Translate goals into technical requirements, milestones, and delivery plans; influence implementation choices; identify systemic risks; resolve dependencies and disagreements; and carry commitments through completion.
- Use casework, incidents, threat information, and customer feedback to improve decisions and the program. As priorities change, recommend what to do next and explain the tradeoffs and effects on existing commitments.
You might thrive in this role if you:
- Have independently assessed consequential third-party, supply-chain, or comparable security risks, and can apply that judgment to unfamiliar vendor technologies and operating models.
- Understand security principles and controls, including data protection, access management, application security, prevention, detection, and response. Can reason about architecture, identity, APIs, data flows, logging, integrations, and whether controls work.
- Know relevant frameworks and standards, including ISO 27001, NIST 800-53, and SOC 2, and can use them to inform an assessment of the actual engagement.
- Have translated security findings and requirements into practical contractual positions with Legal, Procurement, and vendor representatives.
- Have delivered useful products or workflow improvements, tested expected behavior and failure cases, learned from users, and owned performance after launch.
- Can use Codex or comparable AI-assisted development tools to build, run, inspect, and test working solutions.
- Have independently delivered cross-functional programs, turned ambiguity into technical requirements and plans, and adapted priorities to achieve measurable outcomes. Can judge when to build, use existing systems, or engage partners to resolve blockers.
- Build constructive relationships with Security, Engineering, Product, Privacy, Legal, business teams, and vendors. Communicate complex security issues clearly in writing and conversation, including your recommendation, supporting evidence, and relevant tradeoffs.
- Question assumptions, try thoughtful new approaches, investigate unfamiliar systems, and revise your judgment when new evidence changes the situation.
About OpenAI
OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. We push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through our products. AI is an extremely powerful tool that must be created with safety and human needs at its core, and to achieve our mission, we must encompass and value the many different perspectives, voices, and experiences that form the full spectrum of humanity.
We are an equal opportunity employer, and we do not discriminate on the basis of race, religion, color, national origin, sex, sexual orientation, age, veteran status, disability, genetic information, or other applicable legally protected characteristic.
For additional information, please see OpenAI’s Affirmative Action and Equal Employment Opportunity Policy Statement https://cdn.openai.com/policies/eeo-policy-statement.pdf.
Background checks for applicants will be administered in accordance with applicable law, and qualified applicants with arrest or conviction records will be considered for employment consistent with those laws, including the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act, for US-based candidates. For unincorporated Los Angeles County workers: we reasonably believe that criminal history may have a direct, adverse and negative relationship with the following job duties, potentially resulting in the withdrawal of a conditional offer of employment: protect computer hardware entrusted to you from theft, loss or damage; return all computer hardware in your possession (including the data contained therein) upon termination of employment or end of assignment; and maintain the confidentiality of proprietary, confidential, and non-public information. In addition, job duties require access to secure and protected information technology systems and related data security obligations.
To notify OpenAI that you believe this job posting is non-compliant, please submit a report through this form https://form.asana.com/?d=57018692298241&k=5MqR40fZd7jlxVUh5J-UeA. No response will be provided to inquiries unrelated to job posting compliance.
We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made via this link https://form.asana.com/?k=bQ7w9h3iexRlicUdWRiwvg&d=57018692298241.
OpenAI Global Applicant Privacy Policy https://cdn.openai.com/policies/global-employee-and-contractor-privacy-policy.pdf
At OpenAI, we believe artificial intelligence has the potential to help people solve immense global challenges, and we want the upside of AI to be widely shared. Join us in shaping the future of technology.