Senior Product Manager, Security Operations (SecOps)

Equinix•Toronto, ON

4d•$136,000 - $204,000

About The Position

Equinix is seeking a Product Manager, SecOps to lead the strategy, roadmap, and adoption of security capabilities within our engineering ecosystem. This role is focused on making security scalable, automated, developer-friendly, and measurable, rather than policy-writing or governance. The Product Manager will act as a single product owner for the boundary between teams that build and manage security capabilities and those that use them to detect and respond to threats, ensuring that detections, automation, telemetry onboarding, and platform changes are production-ready, governed, measurable, and adopted by analysts and responders.

Requirements

Experience as a Product Manager owning cross-functional delivery in a complex technical environment.
Strong understanding of Security Operations concepts, including SIEM, detection engineering, incident response, case management, and security automation.
Experience prioritizing roadmaps and backlogs across multiple stakeholder groups with competing demands.
Ability to translate technical platform work into clear user value, measurable outcomes, and release criteria.
Strong written and verbal communication skills, including the ability to work effectively with engineers, analysts, managers, and executives.
Experience building processes, KPIs, and operating cadences in environments where teams depend on one another for outcomes.
Comfort working with ambiguity and turning loosely defined needs into clear plans and decisions.
Experience supporting or partnering closely with Security Operations Center, incident response, or threat detection teams.
Familiarity with security telemetry pipelines, data normalization, and log onboarding workflows.
Experience with SIEM and SOAR platforms such as Google SecOps, Chronicle, Splunk, Microsoft Sentinel, Palo Alto XSIAM, or similar technologies.
Exposure to detection engineering practices such as rule testing, content lifecycle management, and detection-as-code.
Understanding of response automation design, control frameworks, and approval models for high-impact actions.
Experience using data to evaluate false positives, alert quality, operational throughput, and workflow adoption.
Knowledge of common security frameworks and operating models such as NIST incident response guidance.

Responsibilities

End-to-end detection lifecycle: Drive the process from threat-informed idea generation through rule development, testing, deployment, tuning, analyst adoption, and retirement.
SecOps backlog prioritization: Maintain and prioritize a shared roadmap across telemetry onboarding, detection content, SOAR playbooks, analyst workflows, and platform enhancements.
Operational readiness: Ensure new capabilities launch with runbooks, ownership, success criteria, training, support processes, documentation, and release criteria.
Cross-team process improvement: Identify and reduce friction in handoffs between engineering and operations, resolving delivery blockers and unclear ownership.
Platform value realization: Translate security platform capabilities into measurable outcomes, including improved alert quality, faster response, broader telemetry coverage, and higher automation effectiveness.
Stakeholder alignment: Create clear decision-making forums and communication rhythms across security engineering, monitoring and response, incident management, and threat intelligence.
Detection and rule lifecycle: Own the product process for how detections move from concept to value, including intake, prioritization, test standards, analyst validation, tuning, coverage review, readiness criteria, handoff quality, false-positive trends, alert fidelity, and lifecycle decisions.
Telemetry and log onboarding strategy: Prioritize log sources, parser improvements, and schema normalization based on risk, coverage gaps, investigative value, analyst needs, concrete use cases, dependencies, sequencing, and effort tradeoffs.
SOAR and automation governance: Scale automation safely by improving how ideas are submitted, reviewed, built, tested, approved, and adopted; clarify ownership, controls, approvals, adoption measures, success rates, analyst time savings, and failure patterns.
Platform roadmap and feature adoption: Partner with technical leaders to shape adoption of SIEM, SOAR, and AI-assisted operational capabilities, including rollout plans, operational testing, enablement, success metrics, detection-as-code, composite detections, and standardized content management.
Metrics, reporting, and operating cadence: Define KPIs, health dashboards, and recurring reviews for detection quality, onboarding throughput, automation effectiveness, operational readiness, roadmap priorities, launch readiness, and post-launch performance.
Own and maintain the SecOps product roadmap across shared engineering and operations priorities.
Partner with leaders in detection engineering, monitoring and response, incident management, and threat intelligence to define quarterly objectives.
Facilitate prioritization decisions for detections, log sources, automations, integrations, and workflow improvements.
Define launch criteria for new security content and capabilities, including documentation, training, support model, and success measures.
Run structured intake and triage for stakeholder requests and convert them into a clear, ranked backlog.
Lead cross-functional reviews to resolve delivery blockers, unclear ownership, and handoff gaps.
Develop metrics that show whether new capabilities are improving response speed, alert quality, coverage, and analyst efficiency.
Document requirements, business value, user workflows, acceptance criteria, and rollout plans.
Represent operational needs in platform discussions and represent engineering realities in operational planning.
Drive continuous improvement based on analyst feedback, incident learnings, and evolving threat priorities.