Rockstar Role: Security TPM

The talk opens with the observation that the security technical program manager role is widely misunderstood, which makes it hard for people to enter it or to hire for it. The speaker, a principal security engineer who once worked as a TPM, describes the role as leading large, cross-functional programs end to end. Examples include preparing an organization for a privacy regulation and building an internal capture-the-flag program. Security expertise is expected, since the person is hired for it.

The middle contrasts the role with product managers, who focus on the what and why, and with engineering managers, whose scope is a single team. A TPM instead concentrates on the how, when and who across an organization. The speaker warns that people who only take notes, schedule meetings or write status reports are not doing the job, and suggests ways to take ownership, such as turning meeting discussions into action items or automating a small task. Useful traits include an understanding of system design, active listening, tenacity, and communicating with different audiences. Common entry paths include engineering backgrounds, security awareness or developer education, organizing volunteer events, and internal transfers.

The talk closes with the speaker's own non-linear career and the recurring challenge of explaining the value of the role to colleagues. The main takeaway is that the job suits people who move toward problems and enjoy building networks, and that the field needs more security TPMs.