Senior Product Manager, Secret Detection and Vulnerability Research

GitLab

14d•Remote

About The Position

The Senior Product Manager will own GitLab's Secret Detection offering and the Vulnerability Research function that produces detection content across security products. This outcome-owning role carries adoption, retention, and revenue targets and is responsible for explaining how the roadmap advances those outcomes. The role covers the full secret lifecycle: prevention, detection, validity checking, revocation, and reporting across GitLab.com, Dedicated, and Self-Managed. It also treats detection content—including rules, advisories, and intelligence feeds—as a product, with defined sourcing, validation, versioning, cadence, and measurable quality. The role is expected to improve precision, make quality visible to customers, and connect threat research to shipped detection capabilities. The Senior Product Manager will set product strategy, bring commercial judgment to packaging and pricing, and work closely with engineering, security research, threat intelligence, Field, and GitLab's Security team. The position is part of GitLab's Security product management organization and works asynchronously with distributed engineering, design, research, and Field counterparts. GitLab states that all roles are remote, though some may have location-based eligibility requirements.

Requirements

Domain depth in application security, vulnerability management, or security research.
Experience working on or adjacent to scanners, detection content, threat intelligence, or SDLC security tooling, and familiarity with how these products are evaluated in competitive bake-offs.
Technical credibility to reason about detection logic, data pipelines, CI integration, and tradeoffs between coverage and noise.
Commercial reasoning grounded in revenue mechanics, buyer motion, and competitive displacement, applied to product decisions.
Evidence of using AI as a force multiplier in research, analysis, data pulls, prototyping, or drafting, rather than only occasional use of a chat assistant.
Sound judgment under ambiguity, including presenting structured options and a recommendation.
Ability to clarify noisy, technical, or politically contested problems in concise written material.

Nice To Haves

Hands-on background as a developer, security engineer, red teamer, or researcher.
Experience with credential and token ecosystems.
Experience commercializing a data or intelligence asset.

Responsibilities

Own business outcomes for Secret Detection and Vulnerability Research, including adoption, expansion, competitive win rate, and revenue contribution.
Develop a point of view on packaging and pricing.
Set strategy for the full secret lifecycle—prevention, detection, validation, revocation, and reporting—across GitLab.com, Dedicated, and Self-Managed.
Define how detection rules, advisories, and intelligence feeds are sourced, validated, versioned, and measured; make content quality visible to customers.
Own metrics that demonstrate improving detection precision and address false positives as product defects.
Engage with detection technology, including rule syntax, entropy heuristics, scanner behavior, and coverage-versus-noise tradeoffs; challenge engineering with informed alternatives.
Use AI for research, analysis, data pulls, prototyping, and synthesis, and determine where AI can support triage, rule generation, remediation guidance, and reducing human review per finding.
Partner with engineering, security research, threat intelligence, Field, and GitLab's Security team.
Communicate clearly and asynchronously so distributed teams can act without requiring meetings.