Remote opportunity at
ElasticPrincipal Product Manager - Identity Threat Detection & Response
This full-time principal product leadership role is remote and listed for the United States. Its purpose is to chart where identity-threat detection and response goes inside…
Career Tools
About This Role
This full-time principal product leadership role is remote and listed for the United States. Its purpose is to chart where identity-threat detection and response goes inside Elastic Security. The product owner is responsible for how identity-based attacks are detected, investigated and answered, with the company's entity analytics and entity store serving as the base to build on. Non-human identities form a large share of the scope: machine accounts, workloads, credentials…
Job Description
This full-time principal product leadership role is remote and listed for the United States. Its purpose is to chart where identity-threat detection and response goes inside Elastic Security. The product owner is responsible for how identity-based attacks are detected, investigated and answered, with the company's entity analytics and entity store serving as the base to build on.
Non-human identities form a large share of the scope: machine accounts, workloads, credentials and AI agents acting on their own. The posting asks the holder to define how each of these is governed, including expected behavior, who owns it and how it is retired, and to work out how continuously active identities operating at machine speed can be spotted.
Working alongside threat researchers and detection engineers, the role concentrates on credential access, privilege escalation, lateral movement across identities, and misuse of identity providers and tokens. Response and containment are part of the same strategy, implemented through integrations with identity systems and automation. Significant actions still require human oversight. The posting also calls for identity signals to be joined with endpoint, cloud and network inputs in SIEM and XDR products.
The job involves regular contact with large customers, security operations staff, sales, solution architects and designers, and the holder is expected to keep up with identity-security market trends. Public communication through articles, talks and community participation is a stated responsibility. Elastic is described as a search AI company whose platform is used by more than half of the Fortune 500.
Responsibilities
- Define the direction, plan and timing for work on identity-based threats in Elastic Security
- Set governance rules for machine accounts, workloads, credentials and AI agents, covering ownership and lifecycle
- Collaborate with threat researchers and detection engineers on identity-focused threats and real attacker techniques
- Own response and containment strategy, using automation with human approval for key steps
- Understand identity-attack needs from enterprise customers, security operations and sales teams
- Shape investigation and response designs with the design team
- Bring identity telemetry together with endpoint, cloud and network inputs in SIEM and XDR
- Stay current on the identity-security market and publish product insights through talks and articles
Requirements
- Over a decade of experience running product or solution delivery on security tools like SIEM, XDR and EDR, identity products, or detection and response
- Background in guiding complex, data-heavy products from first concept through launch and iteration
- Strong knowledge of identity attacks and surrounding systems: Active Directory, SSO and OAuth, cloud identity providers and privileged access
- Understanding of ITDR and entity behavioral analytics (UEBA)
- Working fluency with non-human identities and AI agents
- Technical depth in AI and ML, including outlier detection, large language models and agent-based systems
- Track record of leading across matrixed teams in a remote-first, fast-moving environment
- Ability to explain complex detection and identity concepts to executives and practitioners
Core Skills
Benefits
- Pay set by the scope of the work rather than past salary
- Medical coverage for staff and their families in many regions
- Choice of location and working hours for many positions
- Generous annual vacation allowance
- Matching for charitable giving and service of up to $2,000 in local currency equivalent, plus up to 40 hours a year for volunteer projects
- Parental leave of at least 16 weeks
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Where is the role based?
The posting lists the location as United States and describes the work as remote.
What is the base salary?
The typical starting base salary range is 84,300 to 109,500 EUR. The posting says there is no variable pay component.
What should applicants have?
Applicants should have ten or more years of security product experience and knowledge of identity security, behavioral analytics and AI agent identities.
How do I apply?
The posting does not describe an application process beyond the listing itself.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.