Staff Manager, Product Security Response (Cybersecurity)

Location: Remote, United States

Base salary: USD $144,600–$383,500 per year

Company

hirify.global is an AI-powered developer platform used by developers and organizations to build, scale, and deliver secure software.

What you will do

• Lead an eight-person Product Security Incident Response Team responsible for first-party vulnerability triage, remediation coordination, CVE/CNA operations, and external researcher engagement through HackerOne.
• Establish the PSIRT charter, staffing model, accountabilities, and on-call rotation to support sustainable incident response.
• Lead vulnerability disclosure response, including technical assessment, engineering remediation coordination, containment, and time-sensitive incident management.
• Drive the CVE/CNA program, including expansion to cloud products, and maintain hirify.global's relationship with the external security researcher community.
• Define KPIs covering triage-to-handoff time, backlog aging, containment speed, and bug bounty resolution SLAs.
• Partner with Legal/CELA, Security Communications, and Microsoft's MSRC on regulatory notifications, coordinated disclosure, customer communications, and scope boundaries.

Requirements

• 10+ years of experience in security analysis, security research, cybersecurity, security engineering, or a relevant area; equivalent education and experience combinations are accepted, including Associate's Degree plus 9+ years, Bachelor's Degree plus 8+ years, Master's Degree plus 6+ years, or Doctorate plus 4+ years.
• 2+ years of people management experience.
• 2+ years of direct experience in product security incident response or vulnerability management, including coordinating remediation across engineering teams under time pressure.
• 2+ years of experience with CVE/CNA operations and direct engagement with the external security researcher community.

Nice to have

• 2+ years leading a PSIRT, CSIRT, SOC, or comparable vulnerability-management function.
• 2+ years leading multidisciplinary teams across engineering, legal, and communications.
• Experience with regulatory notification requirements such as FedRAMP and disclosure obligations with Legal/CELA.
• CISSP, GCIH, or another relevant certification.
• 1+ year of experience working with hirify.global and/or open-source software.
• Familiarity with hirify.global products, the platform, and the developer ecosystem.

Culture & Benefits

• Remote-first work model within the United States.
• Full-time employment with benefits and potential annual bonus, stock, and other rewards depending on role and impact.
• Competitive pay, learning and growth opportunities, and benefits supporting flexible work.
• Values include customer focus, ownership, growth mindset, collaboration, clarity, coaching, and inclusive teamwork.