Principal Security Product Manager

Upstart is hiring a Principal Security Product Manager to define the vision and roadmap for security capabilities spanning AI-powered security, vulnerability management, automation, and risk visibility. The role translates user, security, business, and regulatory needs into adopted products and measurable reductions in security risk.

Responsibilities:

• Define the product vision, strategy, and roadmap for critical security capabilities, prioritizing investments based on user needs, risk impact, business value, and regulatory requirements
• Partner with security engineers and engineering teams to translate pain points into clear requirements, scope MVPs, sequence releases, and make thoughtful build, buy, and retire decisions
• Drive adoption of security products and workflows that fit naturally into how engineering teams work, using feedback, usage, accuracy, and risk-reduction metrics to measure success
• Shape a connected AI-powered security platform spanning capabilities such as security reviews, continuous testing, vulnerability remediation, risk scoring, and reporting
• Build regulatory and audit requirements into product design, including evidence, audit trails, metrics, and controls that support ongoing readiness
• Communicate product strategy, investment tradeoffs, adoption, and measurable security outcomes to Information Security leadership and senior stakeholders

Requirements:

• Bachelor's degree in Computer Science, Engineering, Mathematics, Statistics, or a related field, or equivalent practical experience, plus 7 years of product management experience, including at least 3 years owning security, risk, developer-facing, or platform products
• Experience owning complex technical products from product vision and roadmap development through requirements, launch, adoption, measurement, and continuous improvement
• Experience partnering with engineering teams to define technical requirements, scope MVPs, prioritize roadmaps, and make build-versus-buy decisions
• Experience with security domains such as vulnerability management, application security, cloud security, security automation, or remediation workflows
• Experience defining and measuring product success using adoption, usage, quality, risk, or other quantitative product metrics
• Experience building AI-powered products, AI-enabled developer tools, or products involving AI governance and model evaluation
• Experience with developer tools, security platforms, or internal platform products used by engineering teams
• Experience building products in banking, financial services, or another regulated environment, including support for regulatory examinations or audits
• Knowledge of security and compliance frameworks such as NIST CSF, SOC 2, or PCI DSS
• Familiarity with security tooling such as ArmorCode, Wiz, Semgrep, SIEM platforms, or similar technologies