Senior Product Manager, Application Security role responsible for owning Zeta's Application Security product and program end-to-end. Set strategy, prioritize roadmap, and drive delivery of enterprise-grade AppSec capabilities protecting platform, data, and customers. Responsibilities include product strategy, building AI-powered threat modeling and code evaluation tools, prioritizing risk surfaces, defining requirements and success metrics, executing with engineering and security teams, establishing governance frameworks, leading tool procurement, using data to measure posture, aligning initiatives with company objectives, mitigating risks, mentoring teams, and integrating AI defensively. Requires 4-6+ years product management experience in enterprise Application Security or related domains, deep knowledge of AppSec tooling and practices, strong technical background, experience with developer-facing security products, and excellent communication skills. Benefits include unlimited PTO, medical/dental/vision coverage, employee equity, discounts, wellness classes, and pet insurance. Salary range $170,000 - $185,000. Remote position based in the United States.
What you'll do
Similar jobs
More roles worth a look
Related opportunities based on specialty and working model so candidates can keep momentum.
Own the Application Security product strategy and multi-quarter roadmap including visibility, tooling inventory, architecture and risk-surface mapping, tool procurement and upgrades, CI/CD enforcement, proactive threat reduction, and scaled institutionalization
Build and ship core AppSec product surfaces such as AI-powered threat modeling and code evaluation, and a unified security risk, signal, and remediation platform
Prioritize critical risk surfaces across the Zeta platform
Define clear requirements, user stories, success metrics, and acceptance criteria for AppSec capabilities
Drive day-to-day execution with Application Security engineering, platform/DevOps, Architecture, InfoSec, and product engineering teams
Establish and evolve governance including severity and SLA frameworks, incident intake and escalation, secure coding standards, third-party application integration guardrails, and architecture security review for high-risk changes
Lead tool strategy and procurement decisions with risk justification, coverage gap analysis, budget tradeoffs, and integration into developer workflows
Use data and KPIs to measure security posture and inform prioritization
Align AppSec initiatives with company objectives and communicate risk, progress, and requests to engineering and executive stakeholders
Identify and mitigate delivery and security risks; run post-incident learning loops to convert findings into product and process improvements
Mentor and elevate AppSec and adjacent product/engineering partners; help scale a Security Champions program
Use AI tools as part of everyday product work and productize AI defensively for threat modeling, triage, code review, and remediation guidance with human oversight
Requirements
4-6+ years of product management experience with enterprise Application Security, platform security, DevSecOps, or adjacent security-product domains in SaaS/B2B environments
Deep working knowledge of modern AppSec practices and tooling including SAST, DAST, SCA, container/IaC/secrets scanning, vulnerability management, threat modeling, API security, and secure SDLC
Proven ability to drive enterprise-tier security programs including risk-based prioritization, remediation SLAs, cross-org governance, and executive risk communication
Strong technical background (Computer Science or related field preferred)
Credible with security engineers, architects, and engineering leaders on topics such as authentication/authorization, multi-tenancy, cryptography boundaries, supply chain, and AI/LLM security risks
Experience shipping developer-facing security products or workflows such as CI/CD gates, IDE/MR integrations, security dashboards, or remediation orchestration
Excellent communication and stakeholder influence skills across Engineering, InfoSec, DevOps/Infrastructure, Architecture, and leadership
Ability to work independently in ambiguity while building durable process, metrics, and operating cadence
