Description

A focused course, tailored for you

The Security Program Manager's Findings-to-Closure Playbook

Run weekly security program reviews where every open finding has a named owner, a forecast close date, and a defensible audit trail.

Half the rows in the open findings spreadsheet still say "Owner TBD" the morning of the program review.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Security Program Managers in large engineering orgs inherit findings from four or five sources at once: vulnerability scanners, pen test reports, internal audit, red-team exercises, and the privacy and compliance teams. Each source has its own severity language, its own SLA expectation, and its own idea of what "closed" means. The PM is the only role in the org that has to reconcile all of it into one weekly review that engineering directors actually act on. The default failure mode is a spreadsheet where critical findings sit at "in progress" for 60, 90, 120 days, the owner column is half-empty, and nobody can answer "what changed since last week" in the meeting itself. Six months later when the auditor asks for the closure evidence on a specific finding, the trail is incomplete and the PM is the one piecing it together from Slack messages and JIRA history. The skill that closes this gap is not a tool. It is a workflow: a tight intake template, a severity-to-SLA matrix the engineering directors signed off on, a weekly review where the only acceptable answers are a delta, an ETA, or an escalation, and a verification step that captures the closure evidence the moment the finding is shut.

What you walk away with

A weekly program review where every open finding has a named owner, a forecast close date, and a one-line delta since last week.
A severity-to-SLA matrix signed off by engineering leadership so the SLA is not negotiated per finding.
An intake template that rejects any finding without owner, severity, source, and proposed verification evidence.
A closure evidence pack per finding that holds up under internal audit and external attestation review.
A quarterly rollup that translates findings throughput into a board-readable story about security posture trend.

The 12 modules

Module 1. The findings landscape: five intake sources and one queue

Map the five common intake sources a Security PM inherits: vulnerability scanners, pen test reports, internal audit, red-team exercises, compliance findings. Document how each source defines severity, owner, and closure, then design the single unified queue that the weekly review actually operates against. Includes a worked reconciliation matrix and the rule for handling duplicates across sources without losing the original finding's audit trail.

Module 2. Intake template that forces ownership at the door

Build the intake template that no finding gets into the queue without completing: source, raw description, proposed severity, named owner (not a team), proposed SLA from the matrix, and proposed verification evidence. Includes the escalation rule when a finding arrives without an owner and the standing exception list. This module removes the "Owner TBD" failure mode at the structural level rather than fighting it row by row in the review.

Module 3. Severity-to-SLA matrix engineering leadership will sign

Negotiate and publish the severity-to-SLA matrix that ends the per-finding SLA debate. Walks through the three-tier (critical, high, medium) and four-tier (critical, high, medium, low) variants, the exploitability and blast-radius adjusters, the public-internet versus internal-only modifier, and the data-class modifier. Includes the one-page document that goes to the Director or VP for sign-off and the change-control rule for amendments.

Module 4. The weekly review: delta, ETA, or escalation

Design the weekly program review where the only three acceptable answers per finding are a delta since last week, a revised ETA with a reason, or an escalation request. Includes the agenda template, the 90-second per-finding budget rule, the rule for cutting the review at 60 minutes, and the Slack-thread followup pattern that handles the long-tail discussion without occupying the meeting itself. Run-of-show for 200 versus 2,000 active findings.

Module 5. Escalation path that does not burn relationships

Document the escalation path from PM to engineering manager to engineering director to VP, with the trigger criteria, the message template, and the rule about when escalation is automatic versus discretionary. Includes the rule for handling a finding where the named owner has left the org, the rule for cross-org escalation when remediation depends on another team, and the recovery pattern when an escalation lands badly and the relationship needs repair.

Module 6. Verification evidence pack per finding

Define the closure evidence per finding type that the program PM will accept and the auditor will not push back on. Covers vuln management closures (scan diff plus configuration export), pen test followups (retest report or compensating control sign-off), internal audit issues (control-owner attestation plus evidence link), red-team report tracking (specific kill-chain step blocked), and compliance findings (control test pass). Each with the artefact format and the storage location.

Module 7. Vulnerability management findings: the high-volume lane

Handle the highest-volume intake source. The standing rule for auto-closing duplicates against the same asset, the rule for grouping findings by patchable unit, the SLA exception process when a patch is blocked by a vendor dependency, and the monthly rollup that goes to the asset owner Director. Worked example with a 1,500-finding scanner output reduced to a 60-finding review queue without dropping coverage.

Module 8. Pen test and red-team followups: the slow-burn lane

Track pen test and red-team report findings, which arrive in batches every quarter and need a different cadence than the weekly scanner stream. Covers the report-to-queue conversion process, the rule for splitting a single report finding into multiple remediation items, the retest scheduling pattern, and the closure evidence the offensive security team will accept. Includes the standing meeting cadence with the offensive security lead.

Module 9. Internal audit and compliance findings: the audit-trail lane

Handle findings from internal audit and the compliance function, which require the strongest audit trail and the most formal sign-off chain. Covers the control-owner identification process, the management response template, the rule for accepting risk versus remediating, the evidence collection pattern that satisfies internal audit's testing methodology, and the quarterly status update format that internal audit publishes to the audit committee.

Module 10. The standing dashboard: throughput, age, and trend

Build the standing program dashboard with the five charts that drive engineering leadership conversations: opens by severity per week, closures by severity per week, mean age of open findings by severity, oldest 10 findings by severity, and the SLA breach count rolling four weeks. Includes the data source per chart, the refresh cadence, the rule for handling chart anomalies during the weekly review, and the dashboard handoff pattern when the PM is out.

Module 11. Quarterly rollup: from findings data to a leadership story

Translate the quarter's findings throughput into the one-page rollup that the VP forwards to the CISO and that the auditor accepts as program evidence. Covers the three trend narratives that leadership audiences respond to (posture improvement, throughput constraint, risk acceptance volume), the chart selection rule, the comment-per-chart pattern that prevents the document from reading as raw data, and the rule for handling a quarter where the numbers got worse.

Module 12. The handoff pack: program continuity when the PM rotates

Document the program handoff pack so the next Security PM (whether on rotation, leave, or role change) inherits a running program rather than a spreadsheet. Covers the standing-meeting list with stakeholders, the active-escalations register, the severity-matrix change history, the verification-evidence locations, the dashboard data-source documentation, and the 90-day onboarding plan a successor can execute against. Includes the rule for what to delete and what to archive when the PM leaves.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

If the open findings spreadsheet has "Owner TBD" rows on the morning of the program review, modules 2 and 5 fix the intake and escalation gap.

If the SLA gets renegotiated per finding in the weekly review, module 3 produces the signed matrix that ends the debate.

If a six-month-old critical finding is missing closure evidence under internal audit testing, modules 6 and 9 close the evidence-trail gap.

If the quarterly story to the VP reads as raw data rather than a posture narrative, module 11 turns the dashboard into a one-page rollup.

What you get with this course

Twelve written modules in the Art of Service learning environment, each 40-80 minute read with worked examples.
Intake template, severity-to-SLA matrix, weekly review agenda, escalation message templates, and quarterly rollup template as downloadable files.
Verification evidence pack templates for vuln management, pen test, internal audit, red-team, and compliance findings.
Dashboard chart specifications with data source and refresh cadence documentation.
A hand-built implementation playbook tailored to the buyer's current intake sources and backlog shape, delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Week 1: complete modules 1-3 and publish the severity-to-SLA matrix draft to engineering leadership.

Weeks 2-3: complete modules 4-6 and run the first redesigned weekly review.

Weeks 4-6: complete modules 7-9 and roll out the per-intake-lane patterns.

Weeks 7-8: complete modules 10-11 and ship the first quarterly rollup.

Week 9: complete module 12 and produce the handoff pack.

Before and after

Before

Weekly program review opens with "Owner TBD" rows, SLAs renegotiated per finding, and the same six findings discussed every week with no delta. Quarterly rollup to the VP is a screenshot of the dashboard with no narrative. Internal audit testing finds closure-evidence gaps on findings closed months ago.

After

Weekly review runs to a tight agenda where every row has owner, SLA, ETA, and a one-line delta. Severity-to-SLA matrix is signed and referenced rather than debated. Closure evidence is captured at the moment of closure and survives audit testing. Quarterly rollup is a one-page narrative the VP forwards intact.

What happens if you do not address this

The Security PM role is the only role in the security org that owns the workflow from finding to verified closure across every intake source. When that workflow stays informal, the failure modes show up at the worst times: a critical finding that aged past 90 days surfaces in a board pack, an internal audit report calls out closure evidence gaps in management response, or a pen test retest fails because the original closure was never verified. Each instance erodes engineering leadership's trust in the program and adds escalation pressure on the PM personally.

Who it is for

Security Program Managers running a weekly or fortnightly program review across security engineering, infrastructure, product security, or compliance teams. Typically managing 200 to 2,000 open findings at any moment across multiple intake sources. Reports into a Director or VP of Security and is the named point of contact for the internal audit and pen test followup processes.

Who this is NOT for. Not for security engineers who own remediation work directly, not for compliance auditors who write the findings, not for Heads of Security looking for a program-design book. This is for the PM in the middle who has to make all of those parties agree on what "closed" means and prove it.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly 35-45 hours total reading and template work, paced across 8-9 weeks at four to six hours per week. The redesigned weekly review and the severity matrix sign-off both pay back time within the first two weeks.

Why $199 is the right number

Generic security program management books treat findings management as one chapter alongside policy, training, and architecture. Vendor-specific certifications teach the tool, not the workflow. This course covers only the findings-to-closure workflow but covers it end-to-end with templates the PM can deploy on the next weekly review.

FAQ

Is this tied to a specific vulnerability management or GRC tool?

No. The templates and workflow are tool-agnostic. They have been deployed on JIRA, ServiceNow, Vulcan, Snyk, and homegrown spreadsheets. The implementation playbook adapts the templates to your current tool stack.

We use three different scanners and a homegrown intake form. Will the unified queue handle that?

Yes. Module 1 covers the reconciliation pattern for multiple scanner sources plus manual intake. Module 7 handles the high-volume scanner lane specifically.

What if engineering leadership refuses to sign the SLA matrix?

Module 3 covers the negotiation pattern when leadership pushes back, including the version of the matrix that has been accepted at every engineering org the playbook has been deployed at. The implementation playbook walks through the specific objections to handle for your org.

Is this course relevant if my program is under 100 active findings?

Yes, with adjusted cadence. Module 4 covers the run-of-show for both small and large programs. Programs under 100 findings can run the review every two weeks rather than weekly without losing posture control.

Who fulfils the implementation playbook?

Gerard at the Art of Service. The playbook is hand-built per buyer after enrolment based on the current intake sources, backlog size, and engineering org structure. Turnaround is one business day.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.