E

Elastic

Searches enterprise data and monitors systems

Principal Product Manager - Identity Threat Detection & Response

Full-Time
No salary listed
Expert
Remote in USA+3 moreMore locations: Remote in Canada | Remote in Ireland | Remote in Spain
Remote
ProductTechnical Product Management

About the job

Requirements
  • 10+ years of experience in product management or solution delivery for security products such as SIEM, XDR, EDR, identity security, or detection and response.
  • A consistent record of leading sophisticated, data-intensive products from inception through launch and iterative growth.
  • Solid knowledge of identity-based attack techniques and the identity fabric, including Active Directory, cloud identity providers, single sign-on, OAuth, and privileged access.
  • Knowledge of identity threats in both on-premises and cloud environments, ITDR as a discipline, and entity behavioral analytics (UEBA).
  • Fluency in non-human identities, including service accounts, workloads, secrets, and AI agents, and understanding of why traditional human-identity rules do not apply to continuously operating autonomous identities.
  • Deep technical comprehension of the artificial intelligence and machine learning landscape, including behavioral analytics, anomaly detection, large language models, and agentic systems.
  • Ability to work closely with data scientists and engineers and use AI agents both as a subject to be secured and as a tool that consumes identity context.
  • Ability to advance quickly, learn from experiments and tests, utilize AI tools to accelerate processes, and bring clarity to decisions.
  • Demonstrated ability to lead across a matrixed organization, align multiple stakeholders toward a common vision, and drive execution in a dynamic, remote-first environment.
  • Autonomy and judgment expected of a principal-level product leader.
  • Outstanding spoken and written communication skills, including the ability to distill complex detection engineering and identity concepts for technical and non-technical audiences, including executive leadership.
  • Interest in industry trends and commitment to solving real-world customer problems.
  • Advocacy for security analysts and detection engineers and focus on building products that help defenders stay ahead of identity-based threats.
Responsibilities
  • Define and own the vision, strategy, and roadmap for a credible Identity Threat Detection and Response function within Elastic Security, evolving the Entity Analytics and Entity Store foundation from behavioral analytics into an identity-defense outcome.
  • Manage the plan for non-human and AI agent identities in Elastic Security, including modeling service accounts, workloads, secrets, and self-directed agents as important identities with behavior standards, ownership, and lifecycles.
  • Establish how to detect identities that operate continuously and at machine scale.
  • Work with threat research and detection engineering on identity-specific threats, including credential access, privilege escalation, identity-based lateral movement, and abuse of identity providers and tokens, ensuring alignment with real-world adversary tactics.
  • Drive the response and containment strategy by turning detections into action through identity-system integrations and automated responses while maintaining human oversight for important actions.
  • Collaborate with enterprise customers, security operations teams, sales, and solution architects to understand requirements for identity attacks, discuss priorities, and clarify product needs.
  • Work with the design team to develop investigation and response experiences that emphasize identity in the analyst workflow.
  • Integrate identity signals with endpoint, cloud, and network data in the security information and event management (SIEM) and extended detection and response (XDR) functions of the security operations platform.
  • Develop deep knowledge of the identity-security market, its major trends, and the changing threat landscape to create a differentiated strategy and engage with analysts.
  • Serve as the product expert and evangelize Elastic's identity capabilities through blog posts, talks, and open community interaction.

About the company

Elastic builds search, observability and security software for developers, IT operations teams and security analysts. Elasticsearch indexes enterprise data so applications can retrieve records, while Kibana gives teams dashboards for exploring results and investigating system activity. Customers use the tools to search business information, monitor applications and infrastructure, and investigate threats across their data. Elastic sells managed cloud services and self-managed subscriptions, with resource-based hosted pricing, usage-based serverless pricing and licenses tied to nodes and memory. Founded in 2012, Elastic lists San Francisco, California, as its headquarters.

Company Size

1,001-5,000

Company Stage

IPO

Headquarters

San Francisco, California

Founded

2012

Get referred to Elastic

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • Home office setup receives support: Elastic advertises workspace reimbursement, with regional benefit differences.
  • Volunteering receives time: Elastic advertises 40 annual volunteer hours, with benefits varying by region.
  • Demand expanded in August 2026 reporting: quarterly revenue reached $478 million, up 15% annually.

What critics are saying

  • Employee continuity weakened in June 2026: Elastic announced a workforce reduction of approximately 7%.
  • Coordination spans time zones: Elastic encourages cross-team collaboration across employees working in more than 40 countries.
  • Profitability remains unfinished in August 2026 reporting: Elastic recorded a $24 million quarterly GAAP operating loss.

What makes Elastic unique

  • Cross-project queries respect access: Serverless searches linked projects while enforcing each user's permissions.
  • Cluster tuning is guided: AutoOps surfaces performance recommendations, resource utilization and cost insights.
  • Developer licensing is flexible: free Elasticsearch and Kibana source portions include an AGPLv3 option.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Fully paid health coverage for you and your family
  • Flexible location and schedule for most roles.
  • Generous number of vacation days each year
  • 20+ additional shut it down days
  • Minimum of 16 weeks of parental leave, plus generous family formation benefits.
  • 40 hours each year to use toward volunteering
  • Double your charitable giving

Growth & Insights and Company News

6 month growth

0%

1 year growth

0%

2 year growth

0%
MarketScreener
Oct 22nd, 2026
Elastic announces multi-year partnership with Audi Revolut F1 team, expanding search and Observability collaboration.

Elastic announces multi-year partnership with Audi Revolut F1 team, expanding search and Observability collaboration. Published on 10/22/2026 at 04:09 pm EDT S&P Capital IQ Elastic was named Official Race Partner for the 2026 United States Grand Prix and Official Search and Observability Supplier from 2027 under a multi-year agreement. Audi Revolut F1(R) Team already uses Elastic to centralize and investigate technology software logs across connected engineering applications, including select trackside systems. The partnership creates opportunities to extend search and observability across additional engineering applications. The team already uses Elastic technology as the foundation of its central software logging platform; Logstash collects and processes application logs, Elasticsearch makes those logs searchable, and Kibana provides dashboards and analysis. Together, these capabilities help engineers investigate software issues across connected applications. The team also uses Elastic on trackside to investigate logs from wheel-set management software. Unlike a new sponsorship-only relationship, the partnership builds on technology already in use. The current deployment gives engineers a central place to search application logs, examine patterns and investigate software faster. Building on that foundation, the partnership provides opportunities to explore additional engineering use cases over time. The partnership will be activated at the 2026 United States Grand Prix in Austin, Texas, October 23?25, with Elastic branding on the Audi R26 halo and headrest. (C) S&P Capital IQ - 2026

Yahoo Finance
Oct 14th, 2026
GitLab is a software stock to watch, while Elastic and Wix underwhelm

SaaS stocks have gained 56.3% over the past six months, outpacing the S&P 500's 12% rise. Still, StockStory says AI is eating into the profits of software firms with low switching costs, so only the strongest will last. It favours GitLab (NASDAQ:GTLB), valued at $8.66 billion. Revenue grew 25.9% a year over two years, annual recurring revenue rose 23.3% in the last year, and gross margin is 85.9%. The stock trades at $50.42, or 7.8x forward price-to-sales. It is wary of two others. Elastic (NYSE:ESTC), worth $9.90 billion, posted billings growth of 14% and flat operating margin. Wix (NASDAQ:WIX), worth $3.00 billion, saw billings growth of 13.9% and a 17.5 percentage point drop in operating margin.

ITWeb
Oct 13th, 2026
QBS Software Africa expands security portfolio with Elastic partnership.

QBS Software Africa expands security portfolio with Elastic partnership. New partnership brings Elastic's security, search and observability capabilities to partners and organisations across Africa. Johannesburg, 12 Oct 2026 QBS Software Africa today announced the addition of Elastic to its growing portfolio of cyber security and enterprise technology solutions, strengthening its offering to partners across South Africa and the wider African market. As organisations face increasingly complex IT environments, growing volumes of data and a rapidly evolving cyber threat landscape, security and technology teams need greater visibility across their environments and the ability to turn vast amounts of data into actionable insight. Through the new partnership, QBS Software Africa will enable its channel partners to access Elastic's platform, helping organisations detect, investigate and respond to threats while gaining deeper visibility across their security, cloud and IT environments. Elastic brings together powerful search, security and observability capabilities on a unified platform. Elastic Security combines SIEM, XDR, endpoint security and cloud security to help security teams identify threats, investigate incidents and respond more efficiently. Its AI-powered capabilities are designed to accelerate security operations by assisting with alert triage, threat investigation, threat hunting and incident response. The partnership comes at a time when security teams are under increasing pressure to manage growing data volumes while responding to increasingly sophisticated threats. Traditional security environments can leave organisations working across multiple disconnected tools, making it difficult to correlate information and establish a complete picture of an attack. Elastic takes a data-centric approach, enabling organisations to bring security data together and apply analytics, automation and AI across the security operations life cycle. For QBS Software Africa, the addition of Elastic further strengthens its commitment to providing partners with technologies that address the evolving needs of modern security and IT environments. "Elastic is a strong addition to our portfolio because it brings together visibility, analytics, security and AI in a way that can help organisations tackle some of the most pressing challenges facing security and technology teams today," said Sanjay Mithal, Head of Strategic Alliance at QBS Software Africa. "Our partnership with Elastic will give our channel partners access to a powerful platform while providing the local expertise, enablement and go-to-market support needed to identify opportunities and deliver value to customers across the region." Elastic's security platform provides capabilities across the full security operations life cycle, from prevention and detection through investigation and response. Organisations can use Elastic to ingest and analyse data from across endpoints, cloud environments, networks and other sources, while AI-powered capabilities can help security teams prioritise attacks, accelerate investigations and automate response workflows. Beyond security, Elastic's broader platform supports observability and search use cases, giving organisations the ability to work with large volumes of data across applications, infrastructure and business environments. This provides partners with opportunities to address multiple technology requirements through a platform rather than approaching security, observability and data analytics as completely separate disciplines. The partnership will initially focus on building awareness, partner enablement and market development across South Africa, with opportunities to expand into additional African markets through QBS Software Africa's regional channel network. As organisations continue to navigate the convergence of cyber security, cloud, data and AI, QBS Software Africa and Elastic aim to help partners deliver technology solutions that provide greater visibility, stronger security and more actionable intelligence. QBS Software Africa, formerly Maxtec, combines the strength of a trusted value-added distributor with the scale of a global software delivery platform. As part of the QBS Technology Group, QBS Software Africa connects vendors, partners and end users across Africa, helping technology providers expand into new markets and enabling partners to source, deliver and scale the solutions their customers need.

Yahoo Finance
Oct 8th, 2026
Elastic launches nightshift AI SRE to investigate incidents with full stack context

Elastic has launched a private preview of Elastic nightshift AI SRE, an AI agent built into Elastic Observability that investigates system issues and provides evidence-backed answers. The tool continuously detects and investigates problems across entire technology stacks, surfacing issues that rule-based alerts miss. According to a NeuBird AI study from April 2026, 78% of organisations experienced at least one incident in the past year where no alert fired and customers discovered the problem first. Elastic nightshift AI SRE addresses this by evaluating all telemetry and correlating alerts, SLOs, and anomalies. The system connects telemetry data to source code from GitHub repositories and learns from resolved incidents to improve future investigations. Engineers can inspect investigation steps, including queries and underlying data. The service is available free to existing Elastic customers during early access on Elastic Observability Serverless, with broader technical preview planned later this year.

Associated Press
Oct 8th, 2026
Elastic launches AlertZero, AI agents to automate security alert triage and investigation

Elastic has launched AlertZero, an AI-powered system built into Elastic Security that uses specialised agents to handle security operations tasks. The system manages alert triage, investigation, threat hunting, detection tuning, and forensic analysis, aiming to reduce thousands of raw alerts to a short queue of recommended actions. AlertZero operates through "Watches" — named groups of agents with specific responsibilities that run on triggers and schedules. These include Triage Watch for alert management, Hunt Watch for continuous threat hunting, Detection Watch for rule tuning, and Forensics Watch for specialist analysis. The system works with any AI model across Elastic Cloud, self-managed, or air-gapped deployments. Security teams retain control over which actions are automated and which require human judgment. AlertZero is available as a technical preview to Elastic Security customers. Mike Nichols, general manager of Security at Elastic, said the platform provides teams with visibility and control to deploy agentic automation at scale.