Senior Manager, Product Security

Responsibilities

• Define and execute the product security strategy, roadmap, operating model, and success metrics.
• Hire, manage, mentor, and develop product security engineers.
• Partner with engineering, product, infrastructure, legal, compliance, and executive stakeholders.
• Establish secure software development lifecycle practices, including security requirements, architecture reviews, threat modeling, testing, and remediation.
• Use AI and automation for security review, vulnerability triage, risk identification, and agentic security workflows.
• Identify and mitigate risks in AI-powered products and systems, including prompt injection, data leakage, model abuse, excessive agency, and insecure tool use.
• Guide secure cloud-native, multi-tenant architectures and platform controls.
• Develop risk management and prioritization frameworks.
• Own vulnerability management, including internal findings, customer reports, penetration tests, vulnerability disclosure, and bug bounty submissions.
• Build secure-by-default tooling, paved roads, CI/CD integrations, and automated controls.
• Lead product security activities during incidents and drive post-incident improvements.
• Develop security champions, training, documentation, and technical guidance.
• Measure and communicate product security effectiveness, risks, investments, and tradeoffs.
• Support customer and partner security conversations and independent security assessments.

Requirements

• 8+ years of experience in application security, product security, or related security engineering roles, including securing cloud-native SaaS products.
• 5+ years of people management or technical leadership experience.
• Experience defining product security strategy and executable roadmaps based on business and technical risk.
• Strong foundation in application security, secure architecture, threat modeling, OWASP Top 10, and secure SDLC practices.
• Experience partnering with engineering and product leaders to deliver security outcomes.
• Experience using AI and automation to scale security programs.
• Experience securing cloud environments, preferably AWS, and containerized infrastructure with Docker and Kubernetes.
• Working knowledge of modern programming languages and the ability to evaluate code, architecture, and technical designs.
• Experience with application security testing and vulnerability management technologies, including SAST, DAST, SCA, secrets detection, and CI/CD security integrations.
• Strong understanding of DevSecOps and secure-by-default developer workflows.
• Experience coordinating product security incident response.
• Excellent written and verbal communication skills.
• Experience operating a vulnerability disclosure or bug bounty program.
• Strong judgment, analytical thinking, organizational skills, and an empathetic, accountable leadership style.

Nice to Haves

• Experience building product security teams or programs during rapid growth.
• Experience securing AI/ML systems and LLM-powered features.
• Familiarity with LLM red-teaming, MITRE ATLAS, and the OWASP Top 10 for LLM Applications.
• Experience building agentic or automated security workflows using Tines or a similar platform.
• Experience with Ruby, TypeScript, and/or Rust.