VP, Information Security Program Manager

Role Summary / Purpose

Help Synchrony build one of the most resilient information security programs in financial services. As the Program Manager for Project Meridian, you will be the operational engine behind a high-priority, enterprise-wide security program — turning strategy into disciplined, on‑time delivery across many concurrent work streams.

Reporting directly to the Chief Information Security Officer, you will own the day‑to‑day orchestration of the program: maintaining the integrated roadmap, clearing the path for delivery teams, managing a dedicated team of specialist consultants, and giving leadership a single, trusted view of progress, risk, and outcomes. This is a highly visible role with direct CISO sponsorship — you will have the executive air cover to drive alignment and resolve conflict across the enterprise.

You are an experienced program manager who communicates with clarity at every level, navigates competing priorities with structure and calm, and is at your best coordinating complex work across many teams. Experience delivering in a regulated financial services environment is essential.

• First 90 days — an integrated roadmap, milestone plan, and RAID log are established and adopted across all work streams, with a single, trusted status‑reporting cadence in place.
• 6 months — delivery teams experience measurably lower coordination burden; blockers are resolved quickly through a clear escalation path; consultant statements of work are tracking to scope, schedule, and budget.
• 12 months — program milestones are met with audit‑ready evidence, and leadership — and, as appropriate, regulators and the Board — have confidence in an accurate, defensible view of program progress and risk.

• Run Project Meridian day‑to‑day — orchestrate execution across all work streams, keeping milestones, deliverables, and dependencies tracked, sequenced, and on course.
• Make delivery teams more effective: proactively remove impediments, broker realistic commitments built from team capacity and change calendars, and minimize coordination overhead so teams report status once. Success is measured by blocker resolution and reduced delivery friction — not status decks alone.
• Establish and run the program operating model — decision rights (RACI) across workstream owners and partner teams, a defined escalation ladder with target resolution times, and a single source of truth for status.
• Build and maintain the integrated roadmap, milestone plan, and RAID log (risks, actions, issues, decisions/dependencies), with a consistent, right‑sized reporting cadence (async‑first; every recurring meeting justified).
• Manage a dedicated team of specialist consultants — define scope, deliverables, and timelines; own SOWs in partnership with Sourcing/Vendor Management; hold partners accountable to quality, schedule, and budget; and ensure the consultant layer reduces, not adds, load on delivery teams.
• Facilitate prioritization of shared consultant capacity across work streams; reallocating capacity already committed to a workstream requires that owner’s concurrence, with unresolved contention escalated to the CISO.
• Aggregate, track, and report KPIs and program metrics — defined together with workstream owners — providing timely, accurate reporting on progress, risk, cost, and escalations to the CISO and senior leadership.
• Protect the integrity and audit‑readiness of the program record: status reflects validated reality, and no milestone is reported complete without owner‑validated supporting evidence.
• Develop and execute a proactive communication strategy for Information Security leadership, cross‑functional stakeholders, and the Executive Leadership Team.
• Coordinate program financials in partnership with Finance — tracking spend against plan and supporting forecasting and reconciliation.
• Prepare and deliver program reporting and briefings for executive leadership and, in partnership with the CISO, for Federal Regulators and the Board of Directors — presenting program status, milestones, and delivery outcomes. (Characterization of security risk posture and any risk‑acceptance decisions remain…