Senior Manager, Product Security

Tines

10d•$250,000 - $275,000•Remote

About The Position

Tines, a company founded in 2018 with co-headquarters in Dublin and Boston, offers an intelligent workflow platform that leverages AI, automation, and integration to drive business results for a diverse customer base, including startups and public companies. Their vendor-agnostic platform integrates with any API-enabled service, enabling customers to achieve their goals faster. Tines is designed with security and privacy in mind, making it a preferred choice for security, IT, engineering, and finance teams. The company values Simplicity, Speed, and Soundness, and is committed to delivering exceptional customer experiences while fostering a culture of curiosity, growth, and integrity. They are seeking a Senior Manager, Product Security to lead and scale their product security program within an AI-forward engineering environment. This role reports to the Head of IT Operations & Information Security and is responsible for setting the direction of product security, developing a high-performing team, and collaborating with engineering and product leaders to ensure security keeps pace with company growth. It's a hands-on leadership position requiring a blend of strategy, people management, and technical execution. The role involves establishing risk-based priorities, creating scalable security processes, and guiding teams in making sound security decisions without adding unnecessary friction. A key aspect of this role is utilizing AI and automation as force multipliers to build a product security program that can match the velocity of AI-assisted development while addressing the unique risks associated with AI-powered products, agentic systems, and evolving engineering practices. This position can be based remotely in the United States.

Requirements

8+ years of experience in application security, product security, or closely related security engineering roles, including experience securing cloud-native SaaS products.
5+ years of people management or technical leadership experience, with a track record of developing engineers and building effective security teams or programs.
Demonstrated ability to define product security strategy, translate strategy into an executable roadmap, and prioritize investments based on business and technical risk.
Strong technical foundation in modern application security, secure architecture, threat modeling, OWASP Top 10, and secure SDLC practices.
Experience partnering with engineering and product leaders to deliver security outcomes without creating unnecessary friction.
Experience using AI and automation to scale security programs, such as LLM-assisted code review, automated vulnerability triage, or agentic security workflows.
Experience securing cloud environments, preferably AWS, and containerized infrastructure using technologies such as Docker and Kubernetes.
Working knowledge of modern programming languages and the ability to evaluate code, architecture, and technical designs. Experience with Ruby, TypeScript, and/or Rust is highly desirable.
Experience with application security testing and vulnerability management technologies, including SAST, DAST, SCA, secrets detection, and CI/CD security integrations.
Strong understanding of DevSecOps practices and experience designing secure-by-default developer workflows.
Experience leading or coordinating the product security aspects of incident response, including technical investigation, stakeholder communication, and post-incident improvement.
Excellent written and verbal communication skills, with the ability to explain technical risk, business impact, priorities, and tradeoffs to audiences ranging from individual engineers to executives.
Experience operating a public vulnerability disclosure or bug bounty program, including triage, researcher communication, remediation, and program measurement.
Strong judgment, analytical thinking, and organizational skills, with the ability to operate effectively amid ambiguity and competing priorities.
A leadership style grounded in trust, clarity, empathy, accountability, and a willingness to remain technically engaged.

Nice To Haves

Experience building a product security team or program during a period of rapid company or product growth.
Experience securing AI/ML systems and LLM-powered features, including prompt injection, model abuse, data leakage, tool-use risks, and agentic system security.
Familiarity with LLM red-teaming, AI threat-modeling frameworks such as MITRE ATLAS and the OWASP Top 10 for LLM Applications, and emerging AI security standards.
Hands-on experience building agentic or automated security workflows using Tines or a similar automation platform.
Experience designing secure-by-default developer platforms, paved roads, golden paths, or reusable security controls.
Deep familiarity with multi-tenant SaaS security, including tenant isolation, authorization models, data segregation, and identity boundaries.
Experience with product security for APIs, integrations, workflow engines, or platforms that execute customer-defined logic.
Experience supporting FedRAMP Moderate or High and/or DoD Impact Level IL4, IL5, or IL6 environments.
Experience supporting enterprise customers and participating in customer-facing security discussions.
Contributions to open-source security tooling or active participation in the security research community through CVEs, conference talks, standards work, or published research.
Prior experience at a high-growth startup launching new products or expanding into new product lines.

Responsibilities

Define and execute the product security strategy, roadmap, operating model, and success metrics in alignment with company objectives and product risk.
Hire, manage, mentor, and develop product security engineers, creating a culture of technical excellence, accountability, curiosity, and sustainable execution.
Build strong relationships with engineering, product, infrastructure, legal, compliance, and executive stakeholders. Influence product and architectural decisions through clear, risk-based guidance.
Establish scalable security practices throughout the software development lifecycle, including security requirements, architecture reviews, threat modeling, testing, and remediation.
Use AI and automation to expand product security coverage and reduce manual toil, including automated review, vulnerability triage, risk identification, and agentic security workflows.
Partner with product and engineering teams to identify and mitigate risks in AI-powered features and systems, including prompt injection, data leakage, model abuse, excessive agency, and insecure tool use.
Guide the design and implementation of secure architectures and platform controls that support a growing portfolio of cloud-native, multi-tenant products.
Develop a consistent framework for identifying, communicating, prioritizing, and accepting product security risks. Ensure engineering effort is focused on the issues that matter most.
Own the product vulnerability management lifecycle, including internal findings, customer reports, penetration tests, vulnerability disclosure, and bug bounty submissions. Drive timely, risk-based remediation.
Build or sponsor secure-by-default tooling, paved roads, and automated controls using Tines, CI/CD integrations, and AI-driven capabilities.
Serve as a product security leader during incidents, coordinate technical investigation and remediation, participate in the on-call program, and ensure lessons learned result in durable improvements.
Develop security champions, training, documentation, and technical guidance that help engineering teams independently make secure decisions, including when using AI-assisted development tools.
Establish meaningful measures of product security effectiveness and communicate risks, investments, progress, and tradeoffs clearly to technical and executive audiences.
Support customer and partner security conversations, coordinate independent security assessments, and represent Tines in relevant security communities where appropriate.