Staff Product Manager, Compliance

Fastly•San Francisco, CA

3d•Hybrid

About The Position

For a growing share of Fastly's customers, compliance is the gate in front of every other decision: where data lives, who can see it, and what they can prove afterward. This role is responsible for defining and driving what Fastly's platform gives customers to get through that gate. As a Staff Product Manager on Fastly's Core Infrastructure Product Management team, you will own compliance as a shared capability of the platform: the controls in the control plane, the residency and sovereignty behavior customers configure, and the evidence and attestation surfaces they use directly to satisfy their own auditors and regulators. You will define these across Fastly’s platform, rather than solving the same problem separately for multiple products. You will determine what Fastly's products must do so customers can meet their obligations, then carry those decisions through engineering, security, legal, and go-to-market. You will translate regulation into requirements and take clear positions on what to build and what not to. This role has broad latitude and real ownership, reporting to the Director of Core Infrastructure Product Management.

Requirements

8+ years in product management or technical product leadership, ideally on infrastructure, platform, or security products, including ambiguous challenges that crossed organizational boundaries.
A working understanding of the regulations that shape enterprise software – data residency and sovereignty, privacy regimes such as GDPR and CCPA, and emerging AI governance – and the ability to turn what a customer must comply with into concrete product requirements.
The ability to take a compliance requirement — a law, a contractual term, an auditor's ask — and pin down exactly what it obligates, then define the narrowest product capability that fully satisfies it. You know the difference between what a rule requires and what people assume it requires, and you don't over- or under-build against it.
Enough command of control planes, configuration models, and how data moves through a platform to set well-grounded requirements and earn engineers' trust.
A proven ability to lead without authority and build the relationships that make cross-functional work move.
A clear, confident communicator who can move between detailed requirements discussions with engineers and crisp strategic framing for executives, customers, and go-to-market partners. You can stand up in front of a room, make a case, and hold it under questioning.

Nice To Haves

Reasoning about data residency in systems that cache, replicate, or fail over by design
Turning an audit requirement into something a customer can pull themselves, such as with tamper-evident logs, immutable configuration history, or machine-readable attestation
Making a product call on a regulatory requirement before the interpretation settles
Regulated verticals such as finance, healthcare, or public sector, and the frameworks their customers are held to, including PCI DSS, HIPAA, FedRAMP, or the sector-specific rules that set the bar

Responsibilities

Own compliance as a platform capability: define the strategy and roadmap for what Fastly must provide so customers can satisfy compliance and regulatory requirements. You will set the multi-year view, prioritize the investments that open regulated segments and unblock opportunities, and synthesize customer needs, regulatory shifts, field input, and market signals into a defensible set of priorities.
Define residency and sovereignty requirements: own what customers need to control about where their data lives and where it moves, and turn that into requirements the platform is built to. Set the standard consistently rather than per product.
Build the evidence customers can pull themselves: define the attestation and evidence surfaces customers use directly to show their auditors and regulators what happened to their data, when, and why. Make proof a product capability rather than a support request.
Specify governance and control in the control plane: define what customers need to control, inspect, and demonstrate about how their configuration is set and changed – the capabilities that let them satisfy their own internal and external oversight, consistently across products.
Get ahead of what's coming: track the regulatory shifts that change what your customers must comply with, including sovereignty regimes, privacy law, and emerging AI governance, and turn them into product requirements before they stall a deal or block adoption.
Align partners and drive decisions: bring engineering, security, legal, and go-to-market to a shared view of what customers require, frame the tradeoffs, and drive decisions to closure. You will bring structure to problems that arrive without it, and connect complex requirements to clear customer outcomes.