About the role

- As an Associate Product Manager on the VMDR team, you'll help define how security and IT teams discover, assess, prioritize and remediate vulnerabilities across on-prem, cloud, container and remote assets. Success is measured in real risk reduction (TruRisk), not raw finding counts.
- This role is for early-career problem-solvers with hands-on vulnerability management experience who want to grow into a full product manager. You'll own well-scoped features end to end and learn alongside senior PMs, engineering and Threat Research.

Key responsibilities

1. Product definition and roadmap

- Own and evolve well-scoped features in core VMDR modules such as Asset Discovery & Inventory, Vulnerability Detection (Cloud Agent, network scanners, passive sensors), TruRisk Prioritization (QDS, threat intel, CISA KEV, EPSS), Dashboards & Reporting, and Remediation (Patch Management, TruRisk Eliminate).
- Collaborate with engineering to define product requirements and specifications: PRDs, user stories, prioritization logic, workflows, wireframe annotations and acceptance criteria.
- Assist in developing the product roadmap and feature prioritization using frameworks such as RICE or MoSCoW, balancing customer asks, competitive gaps and engineering effort.
- Groom the backlog in Jira, prioritize with engineering, QA and UX, and track delivery against quarterly release plans.

2. Vulnerability assessment and threat analysis

- Perform hands-on vulnerability assessments: run authenticated and agent-based scans, review detections, investigate false positives/negatives and validate detection coverage.
- Conduct threat analysis on high-impact CVEs and zero-days (exploit availability, ransomware and malware association, CISA KEV listing, EPSS trend) with Threat Research, and turn findings into detection and prioritization requirements.
- Translate concepts such as CVSS vs. EPSS vs. QDS, asset criticality, toxic combinations, SLA breaches and MTTR into product features with measurable risk reduction.
- Test and validate features before release: scans, detections, QQL queries, dashboards, reports and APIs.

3. Customer reporting and insight





- Help design and generate vulnerability management reports for customers: executive TruRisk summaries
- Partner with SMEs, SSAs/TAMs, support and customers to refine requirements, triage escalations, validate assumptions and iterate fast.
- Define workflows for integrations with ServiceNow (ITSM/CMDB), Jira, SIEM/SOAR

4. Market research and competitive intelligence

- Assist in market research to identify new opportunities and customer needs in vulnerability and exposure management (CTEM, attack surface management, cloud and container security).
- Run competitive analysis against Tenable, Rapid7, Microsoft Defender Vulnerability Management, CrowdStrike Falcon Spotlight and exposure management platforms; maintain feature comparison matrices.
- Stay current on industry trends and regulatory requirements affecting VM: NIST CSF/SP 800-40, PCI DSS v4.0, ISO 27001, SOC 2, SEC cyber disclosure rules, EU NIS2, DORA, CERT-In and DPDP Act (India).

5. Product collateral and enablement

- Help prepare product collateral: user guides, FAQs, datasheets, release notes, solution briefs and demo scripts.
- Create sales enablement content and support launches, webinars and customer demos.

Must-have qualifications

Experience

- 2–5 years in product management, product analyst, technical program, solutions/sales engineering, or security engineering/analyst roles.
- At least 1 year working directly on vulnerability management, security operations, or a cybersecurity product (SaaS preferred).

Domain knowledge (must be able to explain in an interview)

- Vulnerability management lifecycle: asset discovery and inventory → scanning (authenticated vs unauthenticated, agent vs network) → prioritization → remediation/patching → verification and reporting.
- CVE, CWE, NVD, CVSS scoring,



EPSS, CISA KEV, and the difference between severity and risk.
- Patch management, configuration management and asset management basics across Windows, Linux and cloud workloads.
- Working knowledge of networking (TCP/IP, ports, protocols), OS fundamentals and cloud basics (AWS, Azure or GCP).

Tool proficiency

Area

Tools (hands-on with at least one per row)

Vulnerability scanners / VM platforms

Qualys, Tenable (Nessus, Tenable.io/SC), Rapid7 InsightVM/Nexpose, Microsoft Defender VM, OpenVAS

Security tooling exposure

SIEM (Splunk, Microsoft Sentinel), EDR (CrowdStrike, Defender), CSPM/CNAPP (Wiz, Prisma Cloud), ITSM (ServiceNow)

Product and delivery

Jira, Confluence, Aha! or Productboard

Data and analytics

SQL, Excel/Google Sheets (pivots, lookups), a BI tool (Tableau, Power BI, Looker) or product analytics (Pendo, Mixpanel)

Design and docs

Figma (reviewing wireframes), Lucidchart/Miro

APIs

Postman or curl; reading REST API docs and JSON

Core skills

- Excellent written and verbal communication: crisp PRDs, user stories and release notes, and confident explanation of technical topics to engineers, customers and executives.
- Robust analytical skills: collect, organize and analyze large vulnerability and usage datasets (SQL, Excel pivots/lookups) to reach clear recommendations; structured prioritization (RICE, MoSCoW or similar).
- Comfortable presenting to customers and engineering teams.

Nice to have

- Security certifications: CompTIA Security+, CEH, CySA+, GIAC (GCIH, GEVA), CISSP associate, or Qualys/Tenable vendor certifications.
- Product certifications: CSPO, Pragmatic Institute, or AIPMM.
- Exposure to adjacent areas: patch management, EASM/attack surface management, CTEM/exposure management, container and cloud workload scanning, compliance scanning (CIS benchmarks).
- Scripting in Python or PowerShell for data pulls or API automation.
- Experience with AI/LLM features in security products (e.g. assisted prioritization, natural-language search).
- Prior work at a security vendor, MSSP, or in an enterprise SOC/VM team.

📌 Associate Product Manager / Project Manager (Pune)
🏢 Qualys
📍 Pune