Associate Product Manager

Role & responsibilities

Candidates preferred domain should be Cyber Security

About the role:

• As an Associate Product Manager on the VMDR team, you'll help define how security and IT teams discover, assess, prioritize and remediate vulnerabilities across on-prem, cloud, container and remote assets. Success is measured in real risk reduction (TruRisk), not raw finding counts.
• This role is for early-career problem-solvers with hands-on vulnerability management experience who want to grow into a full product manager. You'll own well-scoped features end to end and learn alongside senior PMs, engineering and Threat Research.

Key responsibilities:

1. Product definition and roadmap

• Own and evolve well-scoped features in core VMDR modules such as Asset Discovery & Inventory, Vulnerability Detection (Cloud Agent, network scanners, passive sensors), TruRisk Prioritization (QDS, threat intel, CISA KEV, EPSS), Dashboards & Reporting, and Remediation (Patch Management, TruRisk Eliminate).
• Collaborate with engineering to define product requirements and specifications: PRDs, user stories, prioritization logic, workflows, wireframe annotations and acceptance criteria.
• Assist in developing the product roadmap and feature prioritization using frameworks such as RICE or MoSCoW, balancing customer asks, competitive gaps and engineering effort.
• Groom the backlog in Jira, prioritize with engineering, QA and UX, and track delivery against quarterly release plans.

2. Vulnerability assessment and threat analysis

• Perform hands-on vulnerability assessments: run authenticated and agent-based scans, review detections, investigate false positives/negatives and validate detection coverage.
• Conduct threat analysis on high-impact CVEs and zero-days (exploit availability, ransomware and malware association, CISA KEV listing, EPSS trend) with Threat Research, and turn findings into detection and prioritization requirements.
• Translate concepts such as CVSS vs. EPSS vs. QDS, asset criticality, toxic combinations, SLA breaches and MTTR into product features with measurable risk reduction.
• Test and validate features before release: scans, detections, QQL queries, dashboards, reports and APIs.

3. Customer reporting and insight

• Help design and generate vulnerability management reports for customers: executive TruRisk summaries
• Partner with SMEs, SSAs/TAMs, support and customers to refine requirements, triage escalations, validate assumptions and iterate fast.
• Define workflows for integrations with ServiceNow (ITSM/CMDB), Jira, SIEM/SOAR

4. Market research and competitive intelligence

• Assist in market research to identify new opportunities and customer needs in vulnerability and exposure management (CTEM, attack surface management, cloud and container security).
• Run competitive analysis against Tenable, Rapid7, Microsoft Defender Vulnerability Management, CrowdStrike Falcon Spotlight and exposure management platforms; maintain feature comparison matrices.
• Stay current on industry trends and regulatory requirements affecting VM: NIST CSF/SP 800-40, PCI DSS v4.0, ISO 27001, SOC 2, SEC cyber disclosure rules, EU NIS2, DORA, CERT-In and DPDP Act (India).

5. Product collateral and enablement

• Help prepare product collateral: user guides, FAQs, datasheets, release notes, solution briefs and demo scripts.
• Create sales enablement content and support launches, webinars and customer demos.

Preferred candidate profile

Must-have qualifications

Experience

• 25 years in product management, product analyst, technical program, solutions/sales engineering, or security engineering/analyst roles.
• At least 1 year working directly on vulnerability management, security operations, or a cybersecurity product (SaaS preferred).

Domain knowledge (must be able to explain in an interview)

• Vulnerability management lifecycle: asset discovery and inventory scanning (authenticated vs unauthenticated, agent vs network) prioritization remediation/patching verification and reporting.
• CVE, CWE, NVD, CVSS scoring, EPSS, CISA KEV, and the difference between severity and risk.
• Patch management, configuration management and asset management basics across Windows, Linux and cloud workloads.
• Working knowledge of networking (TCP/IP, ports, protocols), OS fundamentals and cloud basics (AWS, Azure or GCP).

Tool proficiency

• Area
• Tools (hands-on with at least one per row)
• Vulnerability scanners / VM platforms
• Qualys, Tenable (Nessus, Tenable.io/SC), Rapid7 InsightVM/Nexpose, Microsoft Defender VM, OpenVAS
• Security tooling exposure
• SIEM (Splunk, Microsoft Sentinel), EDR (CrowdStrike, Defender), CSPM/CNAPP (Wiz, Prisma Cloud), ITSM (ServiceNow)
• Product and delivery
• Jira, Confluence, Aha! or Productboard
• Data and analytics
• SQL, Excel/Google Sheets (pivots, lookups), a BI tool (Tableau, Power BI, Looker) or product analytics (Pendo, Mixpanel)
• Design and docs
• Figma (reviewing wireframes), Lucidchart/Miro
• APIs
• Postman or curl; reading REST API docs and JSON

Core skills

• Excellent written and verbal communication: crisp PRDs, user stories and release notes, and confident explanation of technical topics to engineers, customers and executives.
• Strong analytical skills: collect, organize and analyze large vulnerability and usage datasets (SQL, Excel pivots/lookups) to reach clear recommendations; structured prioritization (RICE, MoSCoW or similar).
• Comfortable presenting to customers and engineering teams.

Nice to have

• Security certifications: CompTIA Security+, CEH, CySA+, GIAC (GCIH, GEVA), CISSP associate, or Qualys/Tenable vendor certifications.
• Product certifications: CSPO, Pragmatic Institute, or AIPMM.
• Exposure to adjacent areas: patch management, EASM/attack surface management, CTEM/exposure management, container and cloud workload scanning, compliance scanning (CIS benchmarks).
• Scripting in Python or PowerShell for data pulls or API automation.
• Experience with AI/LLM features in security products (e.g. assisted prioritization, natural-language search).
• Prior work at a security vendor, MSSP, or in an enterprise SOC/VM team.