Senior Product Manager (Secret Detection and Vulnerability Research)

Join GitLab as a Senior Product Manager, where you will lead the Secret Detection offering and the Vulnerability Research function. You will be responsible for the full lifecycle of secret detection, from prevention to reporting, and will treat detection content as a product. You will work closely with engineering, security research, threat intelligence, and the field teams. This role offers flexibility in schedule, equity compensation, and generous paid time off.

Evidence of using AI as a force multiplier in your own work: research, analysis, data pulls, prototyping, drafting. Consuming a chat assistant occasionally is not the same as restructuring how you work

Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification

Responsibilities

• Own GitLab's Secret Detection offering and the Vulnerability Research function, ensuring high precision in detecting secrets and producing detection content.
• Set the strategy for the full secret lifecycle, including prevention, detection, validation, revocation, and reporting across, Dedicated, and Self-Managed.
• Drive adoption, retention, and revenue targets for Secret Detection and Vulnerability Research, and communicate how your roadmap contributes to these goals.
• Judgment under ambiguity. You bring structured options and a recommendation instead of escalating an open question

Requirements

• Bonus: hands-on background as a developer, security engineer, red teamer, or researcher; experience with credential and token ecosystems; experience commercializing a data or intelligence asset
• Technical credibility sufficient to earn the respect of a security engineering team. You do not need to have written the scanner, but you should be able to reason about detection logic, data pipelines, CI integration, and the tradeoffs between coverage and noise
• Bias for clarity. You can take a noisy, technical, politically contested problem and produce one page that everyone can align on
• Commercial reasoning. You start from revenue mechanics, buyer motion, and competitive displacement, then work inward to product decisions. Candidates who reason only from feature lists outward are not a fit
• Domain depth in application security, vulnerability management, or security research. You have worked on or adjacent to scanners, detection content, threat intelligence, or SDLC security tooling and you know how these products actually get evaluated in a bake-off