Are there any specific KPIs or metrics that you use to measure the effectiveness of your security programs?

KPI of security depends on the business line. In my eyes I would look at : 
Compliance results ( mainly certificate audits)
Penetration results
Use of security tools to make users "life" easier
Employee education program

The training scores of security engineers, vulnerability assessment scores, Audit report analysis and quality assurance, Assessment time and response time.

Vulnerabilities per line of code written. In the development team

Also trend lines on vulnerabilities, incidents, suspicious activities

Nist tier rank (capability)
Training scores (people)
Simulated Phishing scores (people)
External risk assessment and penetration testing results tied to NIST (snapshots)
Incident response readiness (more qualitative)
Recovery time objectives and recovery point objective (measured in hours and minutes)
Third party risk scores (nist based)