Staff Product Manager, Compliance

Fastly provides an edge cloud platform that helps customers create secure, reliable digital experiences by processing applications close to end users. The Staff Product Manager will own compliance as a shared platform capability, defining strategy, requirements, controls, data residency and sovereignty behavior, and customer-facing evidence and attestation capabilities. The role will lead cross-functional decisions across engineering, security, legal, and go-to-market teams.

Responsibilities:

• Own compliance as a platform capability: define the strategy and roadmap for what Fastly must provide so customers can satisfy compliance and regulatory requirements. You will set the multi-year view, prioritize the investments that open regulated segments and unblock opportunities, and synthesize customer needs, regulatory shifts, field input, and market signals into a defensible set of priorities
• Define residency and sovereignty requirements: own what customers need to control about where their data lives and where it moves, and turn that into requirements the platform is built to. Set the standard consistently rather than per product
• Build the evidence customers can pull themselves: define the attestation and evidence surfaces customers use directly to show their auditors and regulators what happened to their data, when, and why. Make proof a product capability rather than a support request
• Specify governance and control in the control plane: define what customers need to control, inspect, and demonstrate about how their configuration is set and changed – the capabilities that let them satisfy their own internal and external oversight, consistently across products
• Get ahead of what's coming: track the regulatory shifts that change what your customers must comply with, including sovereignty regimes, privacy law, and emerging AI governance, and turn them into product requirements before they stall a deal or block adoption
• Align partners and drive decisions: bring engineering, security, legal, and go-to-market to a shared view of what customers require, frame the tradeoffs, and drive decisions to closure. You will bring structure to problems that arrive without it, and connect complex requirements to clear customer outcomes

Requirements:

• 8+ years in product management or technical product leadership, ideally on infrastructure, platform, or security products, including ambiguous challenges that crossed organizational boundaries
• a working understanding of the regulations that shape enterprise software – data residency and sovereignty, privacy regimes such as GDPR and CCPA, and emerging AI governance – and the ability to turn what a customer must comply with into concrete product requirements
• the ability to take a compliance requirement — a law, a contractual term, an auditor's ask — and pin down exactly what it obligates, then define the narrowest product capability that fully satisfies it. You know the difference between what a rule requires and what people assume it requires, and you don't over- or under-build against it
• enough command of control planes, configuration models, and how data moves through a platform to set well-grounded requirements and earn engineers' trust
• a proven ability to lead without authority and build the relationships that make cross-functional work move
• a clear, confident communicator who can move between detailed requirements discussions with engineers and crisp strategic framing for executives, customers, and go-to-market partners. You can stand up in front of a room, make a case, and hold it under questioning
• Reasoning about data residency in systems that cache, replicate, or fail over by design
• Turning an audit requirement into something a customer can pull themselves, such as with tamper-evident logs, immutable configuration history, or machine-readable attestation
• Making a product call on a regulatory requirement before the interpretation settles
• Regulated verticals such as finance, healthcare, or public sector, and the frameworks their customers are held to, including PCI DSS, HIPAA, FedRAMP, or the sector-specific rules that set the bar