Associate Product Manager

Role & responsibilities

Candidates preferred domain should be Cyber Security

About the role:

As an Associate Product Manager on the VMDR team, you'll help define how security and IT teams discover, assess, prioritize and remediate vulnerabilities across on-prem, cloud, container and remote assets. Success is measured in real risk reduction (TruRisk), not raw finding counts.

This role is for early-career problem-solvers with hands-on vulnerability management experience who want to grow into a full product manager. You'll own well-scoped features end to end and learn alongside senior PMs, engineering and Threat Research.

Key responsibilities:

1. Product definition and roadmap

Own and evolve well-scoped features in core VMDR modules such as Asset Discovery & Inventory, Vulnerability Detection (Cloud Agent, network scanners, passive sensors), TruRisk Prioritization (QDS, threat intel, CISA KEV, EPSS), Dashboards & Reporting, and Remediation (Patch Management, TruRisk Eliminate).

Collaborate with engineering to define product requirements and specifications: PRDs, user stories, prioritization logic, workflows, wireframe annotations and acceptance criteria.

Assist in developing the product roadmap and feature prioritization using frameworks such as RICE or MoSCoW, balancing customer asks, competitive gaps and engineering effort.

Groom the backlog in Jira, prioritize with engineering, QA and UX, and track delivery against quarterly release plans.

2. Vulnerability assessment and threat analysis

Perform hands-on vulnerability assessments: run authenticated and agent-based scans, review detections, investigate false positives/negatives and validate detection coverage.

Conduct threat analysis on high-impact CVEs and zero-days (exploit availability, ransomware and malware association, CISA KEV listing, EPSS trend) with Threat Research, and turn findings into detection and prioritization requirements.

Translate concepts such as CVSS vs. EPSS vs. QDS, asset criticality, toxic combinations, SLA breaches and MTTR into product features with measurable risk reduction.

Test and validate features before release: scans, detections, QQL queries, dashboards, reports and APIs.

3. Customer reporting and insight

Help design and generate vulnerability management reports for customers: executive TruRisk summaries

Partner with SMEs, SSAs/TAMs, support and customers to refine requirements, triage escalations, validate assumptions and iterate fast.

Define workflows for integrations with ServiceNow (ITSM/CMDB), Jira, SIEM/SOAR

4. Market research and competitive intelligence

Assist in market research to identify new opportunities and customer needs in vulnerability and exposure management (CTEM, attack surface management, cloud and container security).

Run competitive analysis against Tenable, Rapid7, Microsoft Defender Vulnerability Management, CrowdStrike Falcon Spotlight and exposure management platforms; maintain feature comparison matrices.

Stay current on industry trends and regulatory requirements affecting VM: NIST CSF/SP 800-40, PCI DSS v4.0, ISO 27001, SOC 2, SEC cyber disclosure rules, EU NIS2, DORA, CERT-In and DPDP Act (India).

5. Product collateral and enablement

Help prepare product collateral: user guides, FAQs, datasheets, release notes, solution briefs and demo scripts.

Create sales enablement content and support launches, webinars and customer demos.

Preferred candidate profile

Must-have qualifications

Experience

25 years in product management, product analyst, technical program, solutions/sales engineering, or security engineering/analyst roles.

At least 1 year working directly on vulnerability management, security operations, or a cybersecurity product (SaaS preferred).

Domain knowledge (must be able to explain in an interview)

Vulnerability management lifecycle: asset discovery and inventory scanning (authenticated vs unauthenticated, agent vs network) prioritization remediation/patching verification and reporting.

CVE, CWE, NVD, CVSS scoring, EPSS, CISA KEV, and the difference between severity and risk.

Patch management, configuration management and asset management basics across Windows, Linux and cloud workloads.

Working knowledge of networking (TCP/IP, ports, protocols), OS fundamentals and cloud basics (AWS, Azure or GCP).

Tool proficiency

Area

Tools (hands-on with at least one per row)

Vulnerability scanners / VM platforms

Qualys, Tenable (Nessus, Tenable.io/SC), Rapid7 InsightVM/Nexpose, Microsoft Defender VM, OpenVAS

Security tooling exposure

SIEM (Splunk, Microsoft Sentinel), EDR (CrowdStrike, Defender), CSPM/CNAPP (Wiz, Prisma Cloud), ITSM (ServiceNow)

Product and delivery

Jira, Confluence, Aha! or Productboard

Data and analytics

SQL, Excel/Google Sheets (pivots, lookups), a BI tool (Tableau, Power BI, Looker) or product analytics (Pendo, Mixpanel)

Design and docs

Figma (reviewing wireframes), Lucidchart/Miro

APIs

Postman or curl; reading REST API docs and JSON

Core skills

Excellent written and verbal communication: crisp PRDs, user stories and release notes, and confident explanation of technical topics to engineers, customers and executives.

Strong analytical skills: collect, organize and analyze large vulnerability and usage datasets (SQL, Excel pivots/lookups) to reach clear recommendations; structured prioritization (RICE, MoSCoW or similar).

Comfortable presenting to customers and engineering teams.

Nice to have

Security certifications: CompTIA Security+, CEH, CySA+, GIAC (GCIH, GEVA), CISSP associate, or Qualys/Tenable vendor certifications.

Product certifications: CSPO, Pragmatic Institute, or AIPMM.

Exposure to adjacent areas: patch management, EASM/attack surface management, CTEM/exposure management, container and cloud workload scanning, compliance scanning (CIS benchmarks).

Scripting in Python or PowerShell for data pulls or API automation.

Experience with AI/LLM features in security products (e.g. assisted prioritization, natural-language search).

Prior work at a security vendor, MSSP, or in an enterprise SOC/VM team.