About the role
• As an Associate Product Manager on the VMDR team, you'll help define how security and IT teams discover, assess, prioritize and remediate vulnerabilities across on-prem, cloud, container and remote assets. Success is measured in real risk reduction (TruRisk), not raw finding counts.
• This role is for early-career problem-solvers with hands-on vulnerability management experience who want to grow into a full product manager. You'll own well-scoped features end to end and learn alongside senior PMs, engineering and Threat Research.

Key responsibilities
1. Product definition and roadmap
• Own and evolve well-scoped features in core VMDR modules such as Asset Discovery & Inventory, Vulnerability Detection (Cloud Agent, network scanners, passive sensors), TruRisk Prioritization (QDS, threat intel, CISA KEV, EPSS), Dashboards & Reporting, and Remediation (Patch Management, TruRisk Eliminate).
• Collaborate with engineering to define product requirements and specifications: PRDs, user stories, prioritization logic, workflows, wireframe annotations and acceptance criteria.
• Assist in developing the product roadmap and feature prioritization using frameworks such as RICE or MoSCoW, balancing customer asks, competitive gaps and engineering effort.
• Groom the backlog in Jira, prioritize with engineering, QA and UX, and track delivery against quarterly release plans. 2. Vulnerability assessment and threat analysis
• Perform hands-on vulnerability assessments: run authenticated and agent-based scans, review detections, investigate false positives/negatives and validate detection coverage.
• Conduct threat analysis on high-impact CVEs and zero-days (exploit availability, ransomware and malware association, CISA KEV listing, EPSS trend) with Threat Research, and turn findings into detection and prioritization requirements.
• Translate concepts such as CVSS vs. EPSS vs. QDS, asset criticality, toxic combinations, SLA breaches and MTTR into product features with measurable risk reduction.
• Test and validate features before release: scans, detections, QQL queries, dashboards, reports and APIs. 3. Customer reporting and insight




• Help design and generate vulnerability management reports for customers: executive TruRisk summaries
• Partner with SMEs, SSAs/TAMs, support and customers to refine requirements, triage escalations, validate assumptions and iterate fast.
• Define workflows for integrations with ServiceNow (ITSM/CMDB), Jira, SIEM/SOAR 4. Market research and competitive intelligence
• Assist in market research to identify new opportunities and customer needs in vulnerability and exposure management (CTEM, attack surface management, cloud and container security).
• Run competitive analysis against Tenable, Rapid7, Microsoft Defender Vulnerability Management, CrowdStrike Falcon Spotlight and exposure management platforms; maintain feature comparison matrices.
• Stay current on industry trends and regulatory requirements affecting VM: NIST CSF/SP 800-40, PCI DSS v4.0, ISO 27001, SOC 2, SEC cyber disclosure rules, EU NIS2, DORA, CERT-In and DPDP Act (India). 5. Product collateral and enablement
• Help prepare product collateral: user guides, FAQs, datasheets, release notes, solution briefs and demo scripts.
• Create sales enablement content and support launches, webinars and customer demos. Must-have qualifications Experience
• 2–5 years in product management, product analyst, technical program, solutions/sales engineering, or security engineering/analyst roles.
• At least 1 year working directly on vulnerability management, security operations, or a cybersecurity product (SaaS preferred). Domain knowledge (must be able to explain in an interview)
• Vulnerability management lifecycle: asset discovery and inventory → scanning (authenticated vs unauthenticated, agent vs network) → prioritization → remediation/patching → verification and reporting.
• CVE, CWE, NVD,



CVSS scoring, EPSS, CISA KEV, and the difference between severity and risk.
• Patch management, configuration management and asset management basics across Windows, Linux and cloud workloads.
• Working knowledge of networking (TCP/IP, ports, protocols), OS fundamentals and cloud basics (AWS, Azure or GCP). Tool proficiency Area Tools (hands-on with at least one per row) Vulnerability scanners / VM platforms Qualys, Tenable (Nessus, Tenable.io/SC), Rapid7 InsightVM/Nexpose, Microsoft Defender VM, OpenVAS Security tooling exposure SIEM (Splunk, Microsoft Sentinel), EDR (CrowdStrike, Defender), CSPM/CNAPP (Wiz, Prisma Cloud), ITSM (ServiceNow) Product and delivery Jira, Confluence, Aha or Productboard Data and analytics SQL, Excel/Google Sheets (pivots, lookups), a BI tool (Tableau, Power BI, Looker) or product analytics (Pendo, Mixpanel) Design and docs Figma (reviewing wireframes), Lucidchart/Miro APIs Postman or curl; reading REST API docs and JSON Core skills
• Excellent written and verbal communication: crisp PRDs, user stories and release notes, and confident explanation of technical topics to engineers, customers and executives.
• Strong analytical

skills:
collect, organize and analyze large vulnerability and usage datasets (SQL, Excel pivots/lookups) to reach explicit recommendations; structured prioritization (RICE, MoSCoW or similar).
• Comfortable presenting to customers and engineering teams. Nice to have
• Security certifications: CompTIA Security+, CEH, CySA+, GIAC (GCIH, GEVA), CISSP associate, or Qualys/Tenable vendor certifications.
• Product certifications: CSPO, Pragmatic Institute, or AIPMM.
• Exposure to adjacent areas: patch management, EASM/attack surface management, CTEM/exposure management, container and cloud workload scanning, compliance scanning (CIS benchmarks).
• Scripting in Python or PowerShell for data pulls or API automation.
• Experience with AI/LLM features in security products (e.g. assisted prioritization, natural-language search).
• Prior work at a security vendor, MSSP, or in an enterprise SOC/VM team.

📌 Associate Product Manager (Pune)
🏢 Qualys
📍 Pune