Technical Program Manager, Security (Coordinated Vulnerability Disclosure)
When to Use
- Stand up or improve CVD / responsible disclosure policy and operating model
- Run intake triage queue (email, portal, bounty platform) with SLAs
- Coordinate researcher communication, extensions, and safe harbor questions
- Track remediation milestones across product and platform teams
- Manage embargo, coordinated disclosure date, and publication checklist
- Operate bug bounty scope, rewards, and platform workflows
- Produce program status, RAID, and steering updates for security leadership
- Plan advisory/CVE release with legal and communications
When NOT to Use
- Execute authorized exploitation or write PoCs →
offensive-security-analyst
- Triage SOC alerts or tune detections →
defensive-security-analyst
- Implement scanner gates, SBOM, pipeline fixes →
devsecops
- Remediate findings in code (own the fix) →
information-security-engineer, senior-software-engineer
- Enterprise security architecture or GRC strategy →
cybersecurity, compliance-engineer
- Generic multi-team delivery (non-security) →
technical-program-manager
- Customer contract security exhibits →
commercial-counsel
- Public crisis comms narrative (non-advisory) →
communication-lead
Related skills
| Need |
Skill |
| Generic TPM patterns (charter, RAID, status) |
technical-program-manager |
| Security strategy and vuln management program |
cybersecurity |
| Fix implementation and validation in infra |
information-security-engineer |
| Pipeline scanning and CI evidence |
devsecops |
| Pentest / offensive validation |
offensive-security-analyst |
| Legal terms for bounty / safe harbor |
commercial-counsel |
| Public messaging for security incidents |
communication-lead |
| Audit evidence for vuln SLAs |
compliance-engineer |
| AI-specific red team findings |
ai-redteam |
Core Workflows
1. CVD program charter
Policy scope, channels, SLAs, roles, escalation.
See references/program_charter_cvd.md.
2. Intake and triage
Receive report, dedupe, severity, assign DRI, researcher ack.
See references/intake_triage.md.
3. Remediation and validation tracking
Fix milestones, retest, waiver/exception path.
See references/remediation_tracking.md.
4. Coordinated disclosure timeline
Embargo, extensions, publication date, multi-party coordination.
See references/disclosure_timeline.md.
5. Advisory and publication
CVE, advisory draft, legal/comms gates, customer notification.
See references/advisory_publication.md.
6. Bug bounty operations
Scope, rewards, platform hygiene, researcher relations.
See references/bug_bounty_operations.md.
Outputs
Prefer structured artifacts:
- Intake record — reporter, asset, severity, status, DRI, dates
- Disclosure tracker — embargo end, parties, blockers, go/no-go
- Weekly program status — inflow, SLA breaches, aging criticals, upcoming publications
- RAID — risks (premature leak, incomplete fix), actions, decisions (severity disputes)
- Publication checklist — signed advisory, CVE, comms, support/KB, bounty payout
Principles
- Coordinated disclosure by default — align publication with fix readiness unless active exploitation forces earlier notice
- Single intake DRI — one queue owner; engineering DRIs per product/component
- Document researcher comms — timestamps, promises, extension rationale
- No legal advice — route safe harbor, bounty terms, and advisory language to qualified counsel
- Separate incident response — active exploitation in production may parallel IR (
incident-management-engineer) while CVD track continues
1---2name: technical-program-manager-security-cvd3description: Guides technical program management for security coordinated vulnerability disclosure (CVD)— disclosure policy, intake and triage SLAs, researcher coordination, fix/remediation tracking, embargo and publication timelines, CVE/advisory coordination, bug bounty program operations, and cross-functional gates (security engineering, legal, comms, product). Use when running a CVD or responsible disclosure program, disclosure calendar, bounty ops, or unblocking multi-team remediation for reported vulnerabilities—not for hands-on pentest (offensive-security-analyst), SOC triage (defensive-security-analyst), vuln scanning in CI (devsecops), enterprise security strategy (cybersecurity), generic non-security programs (technical-program-manager), or contract redlines (commercial-counsel).4---56# Technical Program Manager, Security (Coordinated Vulnerability Disclosure)78## When to Use910- Stand up or improve **CVD / responsible disclosure** policy and operating model11- Run **intake triage** queue (email, portal, bounty platform) with SLAs12- Coordinate **researcher** communication, extensions, and safe harbor questions13- Track **remediation** milestones across product and platform teams14- Manage **embargo**, coordinated disclosure date, and publication checklist15- Operate **bug bounty** scope, rewards, and platform workflows16- Produce **program status**, RAID, and steering updates for security leadership17- Plan **advisory/CVE** release with legal and communications1819## When NOT to Use2021- Execute authorized exploitation or write PoCs → `offensive-security-analyst`22- Triage SOC alerts or tune detections → `defensive-security-analyst`23- Implement scanner gates, SBOM, pipeline fixes → `devsecops`24- Remediate findings in code (own the fix) → `information-security-engineer`, `senior-software-engineer`25- Enterprise security architecture or GRC strategy → `cybersecurity`, `compliance-engineer`26- Generic multi-team delivery (non-security) → `technical-program-manager`27- Customer contract security exhibits → `commercial-counsel`28- Public crisis comms narrative (non-advisory) → `communication-lead`2930## Related skills3132| Need | Skill |33|---|---|34| Generic TPM patterns (charter, RAID, status) | `technical-program-manager` |35| Security strategy and vuln management program | `cybersecurity` |36| Fix implementation and validation in infra | `information-security-engineer` |37| Pipeline scanning and CI evidence | `devsecops` |38| Pentest / offensive validation | `offensive-security-analyst` |39| Legal terms for bounty / safe harbor | `commercial-counsel` |40| Public messaging for security incidents | `communication-lead` |41| Audit evidence for vuln SLAs | `compliance-engineer` |42| AI-specific red team findings | `ai-redteam` |4344## Core Workflows4546### 1. CVD program charter4748Policy scope, channels, SLAs, roles, escalation.4950**See `references/program_charter_cvd.md`.**5152### 2. Intake and triage5354Receive report, dedupe, severity, assign DRI, researcher ack.5556**See `references/intake_triage.md`.**5758### 3. Remediation and validation tracking5960Fix milestones, retest, waiver/exception path.6162**See `references/remediation_tracking.md`.**6364### 4. Coordinated disclosure timeline6566Embargo, extensions, publication date, multi-party coordination.6768**See `references/disclosure_timeline.md`.**6970### 5. Advisory and publication7172CVE, advisory draft, legal/comms gates, customer notification.7374**See `references/advisory_publication.md`.**7576### 6. Bug bounty operations7778Scope, rewards, platform hygiene, researcher relations.7980**See `references/bug_bounty_operations.md`.**8182## Outputs8384Prefer structured artifacts:8586- **Intake record** — reporter, asset, severity, status, DRI, dates87- **Disclosure tracker** — embargo end, parties, blockers, go/no-go88- **Weekly program status** — inflow, SLA breaches, aging criticals, upcoming publications89- **RAID** — risks (premature leak, incomplete fix), actions, decisions (severity disputes)90- **Publication checklist** — signed advisory, CVE, comms, support/KB, bounty payout9192## Principles9394- **Coordinated disclosure by default** — align publication with fix readiness unless active exploitation forces earlier notice95- **Single intake DRI** — one queue owner; engineering DRIs per product/component96- **Document researcher comms** — timestamps, promises, extension rationale97- **No legal advice** — route safe harbor, bounty terms, and advisory language to qualified counsel98- **Separate incident response** — active exploitation in production may parallel IR (`incident-management-engineer`) while CVD track continues
daemon-blockint-tech