Program Manager, Security & Privacy - Kubota Credit Corporation

For Earth For Life


Weekly onsite required a few days a week - Grapevine TX.
This position is not fully remote.

The Program Manager, Security & Privacy position is an individual contributor on the Kubota Credit Corporation Security & Privacy team, reporting to the Security & Privacy Manager.
This role owns both the product management function and Agile delivery execution for the Security & Privacy program, operating across security operations, privacy compliance, and governance, risk & compliance (GRC) domains.
In the product management capacity, this role maintains and prioritizes the Security & Privacy program backlog, translating regulatory obligations, control gaps, and audit findings into actionable initiatives, and owns the program roadmap from intake through closure, ensuring alignment with NYDFS CYRR Part 500, CCPA, and KCC’s broader risk posture. In the Agile delivery capacity, this role serves as servant-leader for Security & Privacy delivery services, facilitating ceremonies, removing impediments, and driving Kanban execution with rigor and transparency.
The ideal candidate combines strategic program ownership with hands-on Agile facilitation expertise, is versed in regulatory and compliance contexts, and brings the analytical discipline to translate complex, cross-functional security and privacy requirements into well-structured, Jira-ready work that the program owners can execute with confidence.
KEY RESPONSIBILITIES
This position does the following in accordance with all applicable Federal, State and local laws / regulations and the Company’s policies, procedures and guidelines:
Program & Product Management
• Own and maintain the Security & Privacy program backlog, translating requirements, audit and penetration test findings, risk register items, and privacy compliance obligations into clearly scoped, prioritized initiatives with defined acceptance criteria and measurable outcomes.
• Develop and manage the Security & Privacy program roadmap, partnering with the Manager, Security & Privacy, risk owners, KCC-IT, and business stakeholders to sequence initiatives against regulatory deadlines, remediation commitments, and resource capacity.
• Lead initiative planning from intake through closure: defining objectives, success metrics, scope, resource alignment, dependencies, and timelines, ensuring each initiative maps to an organizational or regulatory outcome.
• Prepare and lead status updates, briefings, and decision forums, producing clear reporting on program performance, and open risks with recommendations.
• Support capacity planning across the Security & Privacy portfolio, partnering with KCC-IT leadership and delivery leads to balance demand, prioritizing remediation stories, and sequence compliance initiatives against operational security work.
• Identify, escalate, and manage program-level risks and issues; maintain risk logs and dependency maps; drive resolutions with clear ownership and documented outcomes.
Agile Delivery & Facilitation
• Facilitate daily standups, sprint planning, sprint reviews and demos, and retrospectives for Security & Privacy delivery squads; ensure ceremonies are purposeful, time-efficient, and outcome-oriented.
• Partner with security product owners and control owners to structure and maintain healthy backlogs, ensuring work items, including remediation stories, compliance initiatives, and security architecture tasks that are well-defined, estimated, and prioritized.
• Design, configure, and maintain Jira projects, kanban boards, workflows for Security & Privacy delivery.
• Monitor and report on team delivery metrics and produce clear sprint and release reporting; leverage data-informed insights to drive continuous improvement in delivery practices.
• Identify and remove impediments across technical, organizational, and vendor dimensions; coordinate with KCC-IT delivery teams, and affiliate partners to unblock work, escalate with clear context when required.
• Provide the Manager of Cybersecurity & Privacy with timely, data-informed visibility into delivery progress, risks, dependencies, and compliance milestone status to support reporting and executive-level communication.
Governance, Compliance & Responsible Tool Use
• Ensure Security & Privacy program artifacts, including Jira stories, remediation evidence, and status reports, and meet documentation standards required to support NYDFS CYRR Part 500 examinations, internal audits, and regulatory submissions.
• Support governance over security program documentation, ensuring policy and procedure documentation, runbooks, and control evidence libraries are current, version-controlled, and audit-ready.
• Leverage AI and standard productivity tools to improve personal effectiveness an