Principal Product Manager - Identity Threat Detection and Response
About the job
- At least 10 years of experience in product management or solution delivery for security products such as SIEM, XDR, EDR, identity security, or detection and response, with a consistent record of leading sophisticated, data-intensive products from inception through launch and iterative growth.
- Solid knowledge of identity-based attack techniques and the identity fabric, including Active Directory, cloud identity providers, single sign-on, OAuth, and privileged access, and understanding of identity threats in on-premises and cloud environments, ITDR, and entity behavioral analytics (UEBA).
- Fluency with non-human identities, including service accounts, workloads, secrets, and AI agents, and understanding why traditional human-identity rules do not apply to identities that act independently and continuously.
- Deep technical comprehension of artificial intelligence and machine learning, including behavioral analytics, anomaly detection, large language models, and agentic systems, and ability to work closely with data scientists and engineers and treat AI agents both as a subject to secure and as a tool that consumes identity context.
- Ability to advance quickly, learn from experiments and tests, and use AI tools to accelerate processes and bring clarity to decisions.
- Demonstrated ability to lead across a matrixed organization, align multiple stakeholders toward a common vision, and drive execution in a dynamic, remote-first environment, with the autonomy and judgment expected of a principal-level product leader.
- Ability to distill complex detection engineering and identity concepts into compelling narratives for technical and non-technical audiences, including executive leadership.
- Interest in industry trends and commitment to solving real-world customer problems, advocating for security analysts and detection engineers, and building products that help defenders stay ahead of identity-based threats.
- Define and own the vision, strategy, and roadmap for an ITDR function within Elastic Security, evolving the Entity Analytics and Entity Store foundation from behavioral analytics into an identity-defense outcome.
- Manage the plan for non-human and AI agent identities in Elastic Security by modeling service accounts, workloads, secrets, and self-directed agents as important identities, defining behavior standards, ownership, and lifecycle for each, and establishing how to detect identities operating continuously and at machine scale.
- Work with threat research and detection engineering on identity-specific threats, including credential access, privilege escalation, identity-based lateral movement, and abuse of identity providers and tokens, ensuring the threats relate to real-world adversary tactics.
- Drive the response and containment strategy by turning detections into action through identity-system integrations and automated responses, with human oversight for important actions.
- Work closely with enterprise customers, security operations teams, sales, and solution architects to understand identity-attack requirements, discuss priorities, and clarify product needs.
- Work with the design team to develop investigation and response experiences that emphasize identity in the analyst workflow and integrate identity signals with endpoint, cloud, and network data in the SIEM and XDR functions of the security operations platform.
- Develop deep knowledge of the identity-security market, its major trends, and the changing threat landscape, and use this information to develop a unique strategy and engage with analysts.
- Serve as the product expert and evangelize Elastic's identity capabilities through blog posts, talks, and open community interaction.
About the company
Elastic builds search, observability and security software for developers, IT operations teams and security analysts. Elasticsearch indexes enterprise data so applications can retrieve records, while Kibana gives teams dashboards for exploring results and investigating system activity. Customers use the tools to search business information, monitor applications and infrastructure, and investigate threats across their data. Elastic sells managed cloud services and self-managed subscriptions, with resource-based hosted pricing, usage-based serverless pricing and licenses tied to nodes and memory. Founded in 2012, Elastic lists San Francisco, California, as its headquarters.
Company Size
1,001-5,000
Company Stage
IPO
Headquarters
San Francisco, California
Founded
2012
Get referred to Elastic
See people who can refer or advise you
Simplify's Take
What believers are saying
- Home office setup receives support: Elastic advertises workspace reimbursement, with regional benefit differences.
- Volunteering receives time: Elastic advertises 40 annual volunteer hours, with benefits varying by region.
- Demand expanded in August 2026 reporting: quarterly revenue reached $478 million, up 15% annually.
What critics are saying
- Employee continuity weakened in June 2026: Elastic announced a workforce reduction of approximately 7%.
- Coordination spans time zones: Elastic encourages cross-team collaboration across employees working in more than 40 countries.
- Profitability remains unfinished in August 2026 reporting: Elastic recorded a $24 million quarterly GAAP operating loss.
What makes Elastic unique
- Cross-project queries respect access: Serverless searches linked projects while enforcing each user's permissions.
- Cluster tuning is guided: AutoOps surfaces performance recommendations, resource utilization and cost insights.
- Developer licensing is flexible: free Elasticsearch and Kibana source portions include an AGPLv3 option.
Help us improve and share your feedback! Did you find this helpful?
Benefits
Fully paid health coverage for you and your family
Flexible location and schedule for most roles.
Generous number of vacation days each year
20+ additional shut it down days
Minimum of 16 weeks of parental leave, plus generous family formation benefits.
40 hours each year to use toward volunteering
Double your charitable giving
Growth & Insights and Company News
6 month growth
1%1 year growth
1%2 year growth
0%SaaS stocks have gained 56.3% over the past six months, outpacing the S&P 500's 12% rise. Still, StockStory says AI is eating into the profits of software firms with low switching costs, so only the strongest will last. It favours GitLab (NASDAQ:GTLB), valued at $8.66 billion. Revenue grew 25.9% a year over two years, annual recurring revenue rose 23.3% in the last year, and gross margin is 85.9%. The stock trades at $50.42, or 7.8x forward price-to-sales. It is wary of two others. Elastic (NYSE:ESTC), worth $9.90 billion, posted billings growth of 14% and flat operating margin. Wix (NASDAQ:WIX), worth $3.00 billion, saw billings growth of 13.9% and a 17.5 percentage point drop in operating margin.
Elastic has launched a private preview of Elastic nightshift AI SRE, an AI agent built into Elastic Observability that investigates system issues and provides evidence-backed answers. The tool continuously detects and investigates problems across entire technology stacks, surfacing issues that rule-based alerts miss. According to a NeuBird AI study from April 2026, 78% of organisations experienced at least one incident in the past year where no alert fired and customers discovered the problem first. Elastic nightshift AI SRE addresses this by evaluating all telemetry and correlating alerts, SLOs, and anomalies. The system connects telemetry data to source code from GitHub repositories and learns from resolved incidents to improve future investigations. Engineers can inspect investigation steps, including queries and underlying data. The service is available free to existing Elastic customers during early access on Elastic Observability Serverless, with broader technical preview planned later this year.
Elastic has launched AlertZero, an AI-powered system built into Elastic Security that uses specialised agents to handle security operations tasks. The system manages alert triage, investigation, threat hunting, detection tuning, and forensic analysis, aiming to reduce thousands of raw alerts to a short queue of recommended actions. AlertZero operates through "Watches" — named groups of agents with specific responsibilities that run on triggers and schedules. These include Triage Watch for alert management, Hunt Watch for continuous threat hunting, Detection Watch for rule tuning, and Forensics Watch for specialist analysis. The system works with any AI model across Elastic Cloud, self-managed, or air-gapped deployments. Security teams retain control over which actions are automated and which require human judgment. AlertZero is available as a technical preview to Elastic Security customers. Mike Nichols, general manager of Security at Elastic, said the platform provides teams with visibility and control to deploy agentic automation at scale.
Elastic introduces Elastic nightshift AI SRE to investigate with the full context others can't afford to keep. October 8, 2026 The AI SRE uses complete context from across the entire stack to continuously detect issues and learn from every incident, delivering evidence-backed answers engineers can trust SAN FRANCISCO-(BUSINESS WIRE)- Elastic (NYSE: ESTC) today announced the private preview of Elastic(R) nightshift AI SRE, an AI agent built into Elastic Observability that investigates like an engineer and shows its work. It continuously detects and investigates issues across the entire stack with full context, including surfacing unknowns that rule-based alerts miss. Elastic nightshift AI SRE tests multiple root-cause hypotheses in parallel against telemetry and other relevant context to deliver evidence-backed answers with its reasoning visible at every step. Cloud-native systems now produce more telemetry than any team can review manually, and agentic development has made the problem worse: code that writes code can fail in ways that don't trip a clean error code or fire an alert. In the past year, 78% of organizations had at least one incident where no alert fired and customers found the problem first, according to a NeuBird AI study from April 2026. Once an incident surfaces, investigation depends on context that is usually incomplete: telemetry dropped to control cost, knowledge scattered across code, runbooks and Slack, and lessons from past incidents lost. Observability agents only see what alerts catch, while standalone AI SREs reason over data they don't own. Elastic nightshift AI SRE brings detection, investigation, context and remediation together in a single AI SRE built into Elastic Observability. Transparent Investigation Elastic nightshift AI SRE investigates like an SRE would: ruling out dead ends, following connected signals and converging on root cause with transparent reasoning. Once an investigation identifies the likely root cause, Elastic nightshift AI SRE recommends a fix. It can select an existing workflow or pre-configured action and fill in the incident parameters or provide commands for an engineer to run. Engineers can inspect the investigation steps, including the queries the agent ran and the underlying data. Complete Context Each investigation draws on full context based on cost-efficient telemetry storage, so customers can keep what the AI needs instead of sampling it away. A knowledge graph connects that telemetry to source code from GitHub repositories, so Elastic nightshift AI SRE can point to the commit that likely caused an exception instead of leaving engineers to guess what changed. Investigation memory compounds over time, so every resolved incident makes the next investigation faster to resolve. Detects Unknowns Elastic nightshift AI SRE does not wait for a rule to fire. It continuously evaluates the environment and all telemetry for what needs attention, correlating alerts, SLOs and anomalies into findings an engineer should actually see, including issues that preconfigured alerts are blind to. "Named role agents, including AI SRE, are the first step to AI-fueled operations," said Shannon Kalvar, IDC Senior Research Director. "These agents need access to a broader context, particularly heterogeneous estates, along with the ability to both learn from their own action and reflect on those actions after the fact to begin to create the human-directed operating model of the future." "Most Observability agents only get smarter by scraping more data. Elastic nightshift AI SRE gets smarter by paying attention to how engineers work through investigations, and by checking its own homework once an incident is closed," said Baha Azarmi, general manager, Observability, Elastic. "That is how it keeps up with production without running up a token bill nobody wants to see." Availability Elastic nightshift AI SRE is available today in private preview on Elastic Observability Serverless, free for existing Elastic customers during the early access period. Elastic plans to bring it to technical preview later this year with broader support for third-party tools and data stores. Teams can join the waitlist at: elastic.co/observability/ai-sre/signup Additional Materials About Elastic Elastic (NYSE: ESTC) integrates its deep expertise in search technology with artificial intelligence to help everyone transform all of their data into answers, actions, and outcomes. Elasticsearch, which is the foundation for its search, observability, and security solutions, is used by thousands of companies, including more than 75% of the Fortune 100. Learn more at elastic.co. Elastic and associated marks are trademarks or registered trademarks of elasticsearch B.V. and its subsidiaries. All other company and product names may be trademarks of their respective owners.
Elastic launched a metrics platform within Elasticsearch, combining a columnar store with existing log, trace and vector data capabilities. The company claims the solution is 30 times faster than Prometheus and Mimir and eight times faster than ClickHouse, with significant storage efficiency gains, though benchmarks were not independently verified. The product targets AI-driven telemetry growth and high-cardinality workloads. Baha Azarmi, Elastic's General Manager of Observability, said AI deployments create rising data volumes, including monitoring of large language model calls and graphics-processing-unit activity. The platform offers PromQL compatibility and migration tools for existing Prometheus users. Elastic expects adoption to build gradually due to longer sales cycles in observability deals. The product launched in June at the start of Elastic's fiscal year.