Remote opportunity at
ElasticPrincipal Product Manager - Identity Threat Detection & Response
This remote, full-time principal product role is open to candidates in the United States. It centers on identity threat detection and response inside Elastic Security, where…
Career Tools
About This Role
This remote, full-time principal product role is open to candidates in the United States. It centers on identity threat detection and response inside Elastic Security, where the product owner decides how attacks aimed at identities are detected, investigated and answered. The posting frames the job as extending existing entity analytics and entity store capabilities into a dependable identity-defense function. A large share of the work concerns identities that are not…
Job Description
This remote, full-time principal product role is open to candidates in the United States. It centers on identity threat detection and response inside Elastic Security, where the product owner decides how attacks aimed at identities are detected, investigated and answered. The posting frames the job as extending existing entity analytics and entity store capabilities into a dependable identity-defense function.
A large share of the work concerns identities that are not human. The role covers machine accounts, workloads, credentials and autonomous AI agents. The goal is to set behavior expectations, ownership and lifecycle rules for each of them, and to spot identities that act continuously and at machine speed.
The person in this position works alongside threat researchers and detection engineers on identity-focused threats, including credential theft, privilege escalation, lateral movement, and misuse of identity providers and tokens. Response and containment are also in scope, using integrations with identity systems and automated actions while people stay in control of significant decisions. Identity context should be joined with telemetry from endpoints, cloud services and networks inside the SIEM and XDR products.
Working relationships extend to large customers, SOC teams, sales staff, solution architects and designers, all of whom help shape investigation and response experiences. The holder is also expected to follow the identity-security market and speak publicly about the product through articles, talks and community activity. Elastic is described as a search AI company whose platform is used by more than half of the Fortune 500.
Responsibilities
- Define the direction, plan and milestones for an identity threat detection and response function built on existing entity analytics
- Decide how non-human identities and AI agents are modeled, governed and monitored in Elastic Security
- Coordinate with threat researchers and detection engineers on attack techniques aimed at identities
- Shape response and containment, with automated actions that still need human approval for important steps
- Collect needs for identity attacks from large customers, SOC staff, sales colleagues and solution architects
- Guide design work on investigation and response experiences centered on identity
- Bring identity telemetry together with endpoint, cloud and network inputs in SIEM and XDR
- Track the identity-security market and represent the product through articles, talks and community engagement
Requirements
- Ten-plus years leading product or solution delivery on security tools such as SIEM, XDR, EDR and identity products, or in detection and response
- Record of carrying data-heavy products from first concept to launch and continued growth
- Working knowledge of how identities get attacked, spanning Active Directory, SSO and OAuth, cloud identity providers and privileged access controls
- Grounding in ITDR practice and in entity behavioral analytics (UEBA)
- Comfort with non-human identities, meaning machine accounts, workloads, credentials and AI agents
- Strong grounding in AI and ML, covering anomaly spotting, large language models and agent-based systems
- Experience leading across a matrixed organization in a remote-first environment
- Clear written and spoken communication for technical staff and executives
Core Skills
Benefits
- Pay set by the scope of the work rather than past salary
- Medical coverage for staff and their families in many regions
- Choice of location and working hours for many positions
- Generous annual vacation allowance
- Matching for charitable giving and service of up to $2,000 in local currency equivalent, plus up to 40 hours a year for volunteer projects
- Parental leave of at least 16 weeks
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this role remote?
The posting lists the location as United States and the work arrangement as remote. It describes a remote-first, distributed team.
What is the salary for this role?
The posting gives a typical starting base salary range of 419,400 to 548,200 PLN. It states there is no variable compensation component.
How much experience does the posting ask for?
The posting asks for 10 or more years of product management or solution delivery experience on security products.
What is the employment type?
The role is full-time.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.