Senior Product Manager, Attack Surface Management

Senior Product Manager, Attack Surface Management

About Qualys

Qualys, Inc. (NASDAQ: QLYS) is a cloud security and compliance company with 10,000+ subscription customers worldwide, including many Forbes Global 100 and Fortune 100 organizations. Qualys helps teams consolidate security and compliance workflows on one platform to improve outcomes, increase agility, and reduce cost.

Role overview

This role owns Attack Surface Management as a core pillar of the Qualys TruRisk Platform, built on top of the Unified Inventory layer that powers ETM.

You will drive how Qualys discovers, attributes, correlates, and governs the external attack surface (EASM) & Internal Attack Surface and connects it to the broader enterprise inventory used by ETM across different asset types such as hosts, containers, cloud resources, SaaS services, and identities.

The goal is a single trusted inventory that enables ETM outcomes end-to-end:

build a complete and continuously updated perimeter (internal & external)

link exposures to vulnerabilities, misconfigurations, compliance and identity risk

provide business context for prioritization, reporting, and TruRisk outcomes

uncover and operationalize Shadow IT and unmanaged internet-facing assets

This is a platform-minded PM role combining CAASM-style inventory and EASM-style external discovery: multi-source ingestion, attribution and identity resolution, deduplication and reconciliation, governance workflows, and risk-ready insights.

What you will own

You will lead one or more areas depending on strengths and roadmap priorities.

Unified Inventory for ETM (core platform)

Multi-source ingestion: APIs, webhooks, bulk imports, partner integrations (ServiceNow, Jira, CMDB, CSPM, IdP)

Identity resolution and reconciliation: correlation, dedupe, entity resolution across sources

Normalization and tokenization: standard attributes, tags, metadata enrichment, schema strategy across asset types

Staging and governance workflows: validation, conflict handling, approvals, audit and change history, lifecycle state

Inventory health and coverage: completeness, freshness, confidence scoring, ownership mapping, Shadow IT discovery

Attack Surface Management (EASM) built on Unified Inventory

External discovery: domains, subdomains, DNS, certificates, IPs, cloud services, internet-facing services

Attribution and ownership mapping: link discovered assets to orgs, subsidiaries, brands, apps, teams, environments

Continuous monitoring: change detection, new exposure alerts, drift tracking, asset lifecycle for external perimeter

External enrichment: tech stack, ASN/provider, geo, certificate relationships, exposure context

Third party and shared infrastructure handling: CDNs, shared hosting, vendors, ambiguous ownership workflows

Essential duties and responsibilities

Convert customer and field use cases into product strategy, roadmap themes, epics, user stories, and acceptance criteria

Partner with engineering and architecture on solution design (data model, pipelines, correlation and attribution logic, APIs) and drive delivery from concept through release

Own backlog quality: prioritization, grooming, breaking epics into shippable increments, defining validation and Definition of Done criteria

Drive execution cadence with engineering leadership: sprint readiness, dependencies, tradeoffs, and release planning

Ensure features support real enterprise workflows across SecOps, IT Ops, cloud teams, and GRC, including how teams operationalize EASM findings into ETM outcomes

Define personas and workflows; collaborate with UX on scalable experiences (wireframes, annotations, interaction specifications)

Define and track success metrics: onboarding time, coverage percentage, attribution confidence, dedupe accuracy, reconciliation confidence, alert quality, adoption, and ETM impact

Support POCs and strategic accounts: demos, discovery sessions, feedback loops, outcome-driven iteration

Partner with Product Marketing, Sales, and SE teams for launch readiness, positioning, demo flows, and competitive enablement

Desired skills, experience, and qualifications

5+ years of product management experience in B2B SaaS, cybersecurity & equivalent techno-functional ownership experience (security engineering, solution architecture, platform engineering)

Strong understanding of asset inventory and CAASM concepts: multi-source correlation, trusted inventory, normalization, reconciliation

Strong understanding of Attack Surface Management and EASM: external discovery, attribution, continuous monitoring, Shadow IT and unmanaged asset identification

Proven ability to write crisp requirements: user stories, edge cases, acceptance criteria, workflow definitions; comfortable operating in Agile and Scrum

Platform mindset: data models and schemas, APIs, data quality, scalability and performance tradeoffs

Strong communication skills: align executives and stakeholders; build enablement collateral including presentations, demos, and documentation

Ability to operate effectively with globally distributed teams across time zones