Director, Global Public Sector Product Management

Illumio is hiring a Director of Global Public Sector Product Management to lead the strategy, portfolio, and execution of products for government customers worldwide. The role leads product managers, drives government security and compliance authorizations, and represents the product organization with executives, customers, partners, and assessors.

Responsibilities:

• Define and own the global public sector product strategy, multi-year roadmap, and compliance investment thesis, balancing customer demand, market opportunity, cost, and risk
• Make portfolio-level tradeoffs on which authorizations, certifications, and regions to pursue and in what order, building business cases for executive and board-level review
• Partner with Sales, Marketing, and Finance on go-to-market, pricing, packaging, and contract vehicles for government segments, and share accountability for public sector revenue goals
• Own delivery against U.S. regimes including FedRAMP, CJIS, FIPS 140-2/140-3, and Common Criteria, partnering with Engineering, Security, Legal, and third-party assessors (3PAOs, accredited labs)
• Ensure control requirements (NIST SP 800-53, 800-171, CJIS Security Policy, FIPS validation requirements, Protection Profiles) are translated into prioritized product requirements and engineering commitments across teams
• Drive architecture and deployment decisions that affect compliance, such as dedicated or sovereign environments, data residency, cryptographic module use, personnel and access restrictions, and supply chain requirements
• Lead the expansion of the compliance footprint internationally, sequencing regional frameworks and working with regional leaders and partners to meet them
• Anticipate regulatory change (for example, FedRAMP 20x and evolving cryptographic standards) and adjust strategy ahead of it
• Hire, develop, and lead a team of product managers and program leads, setting a high bar for craft, accountability, and customer focus
• Build repeatable processes that make compliance part of the product development lifecycle rather than a late-stage gate, and establish governance and metrics for the compliance program
• Represent the company with government authorizing officials, agency customers, industry groups, and key partners, and act as an executive sponsor on strategic accounts
• Influence engineering and company-wide priorities through clear communication with senior executives, and report on progress, risk, and investment return

Requirements:

• Must be a US citizen
• 12+ years of product management experience, including 6+ years working on products sold to government or other highly regulated customers
• Hands-on experience delivering products through FedRAMP authorization (agency or JAB/Program Authorization)
• Working knowledge of CJIS Security Policy requirements and how they apply to cloud and software products serving law enforcement and criminal justice agencies
• Experience with FIPS 140-2/140-3 cryptographic validation and the product implications of using validated modules
• Experience with Common Criteria evaluations (NIAP Protection Profiles, CCEVS, or equivalent schemes)
• Familiarity with other applicable U.S. regimes such as NIST 800-53/800-171, StateRAMP/GovRAMP, DoD Impact Levels (SRG), CMMC, and Section 508 accessibility
• Demonstrated ability to translate dense regulatory and technical requirements into actionable product plans and to drive cross-functional organizations to meet them
• Strong technical fluency: comfortable discussing cloud architecture, encryption, identity and access management, logging, and vulnerability management with engineers and customer security teams
• Excellent written and verbal communication, including with government stakeholders, auditors, and C-level executives
• ability to obtain a U.S. government background check, CJIS fingerprint-based screening, or other clearance
• ideally across multiple products or environments
• A track record of successfully shipping products that achieved FedRAMP, CJIS, FIPS, and/or Common Criteria compliance, from initial scoping through certification or authorization
• Experience working directly with 3PAOs, accredited testing laboratories, and government authorizing officials
• Experience building or scaling a public sector product line or government cloud offering, including ownership of business outcomes
• Experience building and managing teams across multiple geographies
• Experience with compliance regimes and requirements outside the U.S., such as:
• IRAP (Australia)
• ISMAP (Japan)
• ISO/IEC 27001, 27017, 27018 and related standards
• UK Cyber Essentials / Cyber Essentials Plus and other UK government requirements
• ENISA guidance and the EUCS cloud certification scheme
• Other regional frameworks such as C5 (Germany), SecNumCloud (France), Canadian Protected B / CCCS, and data sovereignty or residency requirements
• relevant certifications (CISSP, CISM, CISA, CCSP, or equivalent)
• experience with government procurement vehicles (GSA Schedule, G-Cloud, etc.)
• a background in security engineering or compliance