Trust Product Manager

**Who we are** Getting benefits shouldn't feel like a part-time job. For too many families, it does: a stack of forms, a wall of deadlines, and one missing document standing between them and help they already qualify for. [Mirza](https://www.heymirza.com) is changing that. We build public benefits infrastructure that matches people to the programs they're eligible for, helps them apply once across programs, and keeps them covered as the rules shift. That's 200+ programs across all 50 states, including Medicaid, SNAP, WIC, and childcare subsidies. Government agencies, health plans, health systems, employers, community colleges, and unions use Mirza to reach the people they serve. Unfortunately, the stakes are about to get higher. New federal Medicaid requirements take effect January 1, 2027, affecting roughly 20 million adults, and states need a better way to make sure eligible people don't lose coverage over paperwork. We're building exactly that and we would love for you to join us. **About the role** The Trust Product Manager owns Mirza's Trust layer: the platform capabilities that make security, privacy, compliance, governance, and auditability enforceable parts of our software. You'll set the product strategy and requirements for those capabilities while also running Mirza's trust and compliance program hands-on. As we deepen our work with state and federal agencies, Medicaid organizations, and health plans, you'll lead a company-wide shift toward making the compliant path the default path. Success isn't just passing audits. It's a trust operating model that scales with increasingly sophisticated regulated customers. **What you’ll do** * Lead Mirza's trust transformation across Product, Engineering, Customer Delivery, and company operations, so new requirements become how we work, not one-time compliance exercises. * Translate regulatory, customer, security, and privacy requirements into clear product, technical, and operational requirements. * Own the Trust layer roadmap with the Trust engineering lead, covering identity and least-privilege access, tenant and environment isolation, data classification and consent, audit logging, retention, secure releases, and continuous control monitoring. * Move controls out of manual processes and into reusable, software-enforced capabilities wherever it makes sense. * Set durable approaches to production access, data handling, environment separation, release governance, customer support, and evidence collection. * Run Mirza's compliance program in Vanta, including policies, controls, evidence, and control owners across the company. You own the program; Engineering shares responsibility for building technical controls, and each team runs the controls in its area. * Keep a clear view of material risks, control gaps, and upcoming obligations, and manage risk acceptance, exceptions, compensating controls, and remediation. * Keep SOC 2 continuously audit-ready and coordinate external audits, assessments, penetration testing, and vendor risk reviews, driving findings through to closure. * Kick off Mirza's NIST 800-series alignment program and help chart the path toward stricter government requirements, including FedRAMP-aligned practices where appropriate. * Make sure Mirza has clear governance, responsibilities, and customer obligations in place for security and privacy incidents. * Be the primary contact for customer and partner security, privacy, compliance, and AI-governance requirements, leading security questionnaires, privacy and AI-use assessments, and procurement diligence. * Represent Mirza credibly with security, legal, and procurement teams at government agencies, Medicaid organizations, and health plans, and turn recurring asks into reusable controls instead of one-off answers. * Give leadership clear recommendations when trust requirements create real business or product tradeoffs. **What we’re looking for** * Significant hands-on experience owning security, privacy, trust, risk, or compliance programs at a software or technology company. * Experience in regulated environments like government, public-sector technology, healthcare, Medicaid, or health plans. * Working knowledge of SOC 2, NIST 800-series controls, HIPAA, and government security standards. * Experience leading audits, assessments, security questionnaires, penetration-testing programs, and remediation. * A track record of turning compliance requirements into operational processes, technical requirements, or software capabilities. * Strong product management skills, including problem definition, requirements, prioritization, roadmap ownership, and cross-functional delivery. * Enough technical fluency to go deep with senior engineers on architecture, access models, system boundaries, data flows, and implementation tradeoffs. * The communication skills and credibility to hold your own with sophisticated customer security and compliance teams. * Comfort working autonomously while both the function and the product capabilities are still being built. * A degree or background in computer science, information systems, security, or a related technical field. *We aren't expecting you to be an expert in everything described above. If you check most of the boxes, and are ready to roll up your sleeves and learn, we’d love to hear from you.* **What We Offer** * $140,000-$160,000 base salary * Stock options * Healthcare, Dental, Vision, Life * 401k with company contribution * 16 weeks of fully paid parental leave for birthing and non-birthing + optional 8 week ramp-up period at 80% pay * Fully remote and flexible hours * Plus more! **To Apply** If you’re passionate about joining a mission-driven company, email careers@heymirza.com with: * A short explanation about why you want to join Mirza * Your CV * Interview availability in the next 7 days We’ll be in touch to schedule an interview! *Please note, applicants must be located in the United States and be authorized to work for any employer in the United States. Unfortunately, we are unable to sponsor or take over sponsorship at this time.*