Product Manager - Cybersecurity

Required Qualifications

The ideal candidate should have:

• Product ownership experience, including product strategy and roadmap ownership.
• Strong knowledge and experience in cryptography, Hardware Security Modules (HSMs), and key management, particularly payment key management.
• A background that combines hands-on technical experience with the ability to transition into a product ownership role.

Target candidate profiles:

• Cryptography or security engineers who have moved into functional/product ownership roles.
• Architects with relevant HSM and key management experience who are interested in transitioning into product ownership.
• Candidates with HSM experience and relevant adjacent expertise, even if their previous job title was not Product Owner.

Important distinctions:

• Direct hands-on engineering in the current role is not required, but technical knowledge and practical experience in the relevant domains are critical.
• Experience with Public Key Infrastructure (PKI) is relevant but is not necessarily equivalent to the specific cryptography, HSM, and key management experience required.
• Experience with a particular HSM vendor or platform is not required. Candidates should understand HSM management and the broader technical environment.

Team & Product Scope

The product owner will oversee three small teams:

1. Global HSM Management.
2. Payment Key Management.
3. Development team responsible for utility applications and APIs that leverage HSMs and key management.

Interview Process

1. Initial interview: Approximately 30 minutes with John.
2. Technical interview: Follow-up interview with John's team leads to assess technical knowledge and relevant experience.

Job Description:

Core Responsibilities

Cryptographic Product Strategy

• Define the product direction for HSM services, key-management capabilities, encryption services, and supporting developer tools.
• Identify customer and application needs related to cryptographic operations, key custody, secure integration, automation, and service accessibility.
• Develop roadmaps that address platform modernization, HSM lifecycle management, capacity, resilience, crypto-agility, and regulatory requirements.
• Establish standardized cryptographic services and integration patterns that can be reused across application teams.
• Evaluate new HSM, key-management, cloud cryptography, automation, and related technologies for practical enterprise adoption.

Key Management and HSM Delivery

• Define product requirements for key generation, import, export, distribution, rotation, backup, recovery, revocation, archival, and destruction.
• Guide capabilities involving HSM partitions, security domains, access controls, quorum processes, administrative roles, audit logging, and operational monitoring.
• Ensure requirements account for secure key custody, separation of duties, least privilege, traceability, and recoverability.
• Partner with infrastructure and engineering teams on HSM deployment, configuration, migration, expansion, upgrade, and decommissioning initiatives.
• Prioritize lifecycle and operational work alongside new product capabilities.

Developer Experience and Programming

• Define APIs, SDK requirements, code samples, onboarding documentation, test utilities, and integration guidance for cryptographic-service consumers.
• Collaborate with engineers to validate that user stories accurately describe expected cryptographic behavior, error handling, access controls, and nonfunctional requirements.
• Apply working programming knowledge to review implementation examples, analyze defects, support proof-of-concept activities, and clarify integration requirements.
• Promote automated testing for cryptographic workflows, including positive tests, negative tests, failure handling, performance testing, and recovery scenarios.
• Improve the developer experience for teams integrating applications with HSMs and key-management services.
• Support secure software-development practices for applications that generate, store, retrieve, or use cryptographic keys.
• Evaluate appropriate uses of AI-assisted tools for documentation, requirements analysis, test design, and engineering productivity.
• Ensure AI-generated content or code receives appropriate technical and security review.

Execution and Stakeholder Leadership

• Own and prioritize a technically detailed backlog with measurable business, security, engineering, and operational outcomes.
• Lead refinement sessions that include sufficient technical depth to identify dependencies, assumptions, security implications, and acceptance criteria.
• Coordinate across cryptographic engineering, application development, architecture, infrastructure, risk, compliance, and operations.
• Clearly communicate technical risks, lifecycle concerns, design trade offs, and investment needs
• Measure platform adoption, integration lead time, automation coverage, service reliability, incident trends and customer satisfaction
• Use AI-enabled tools where appropriate to improve product management and software delivery processes