Technical Product Manager

Title: Technical Product Manager – CyberGRC Job Location: - Bengaluru We are looking for an experienced and driven Technical Product Manager – CyberGRC to lead the evolution of MetricStream's AI-powered Cyber Risk and Compliance product suite. This role sits at the intersection of deep cybersecurity domain expertise and modern product innovation. The ideal candidate will have hands-on experience delivering or using cyber GRC platforms — and will bring a sharp understanding of the space. You will shape the product roadmap to advance MetricStream's capabilities across continuous compliance automation, AI-driven risk management and real-time cyber risk visibility — driving MetricStream's transition to a continuous and autonomous compliance and risk platform. You will own the product strategy and execution for capabilities spanning the full CyberGRC lifecycle, including: IT and Cyber Risk management - Risk assessment workflows with pre-packaged and customizable risk libraries, scoring algorithms, and treatment plans - Vulnerability management integration: ingesting signals from vulnerability scanners, ITSM platforms, EDR tools, and cloud security posture tools to surface and prioritize risk findings - Exposure management capabilities linking technical findings (vulnerabilities, misconfigurations) to quantified business impact - Threat intelligence integration feeding real-time context into risk registers and dashboards - Continuous cyber risk quantification (CRQ) using FAIR-based financial models, enabling CISOs to express risk in business terms for board and regulatory reporting - AI agents that autonomously assess, prioritize, and summarize risk exposure across the IT and cyber landscape - Predictive risk scoring and heat maps with automated, real-time updates — moving beyond static, point-in-time assessments Compliance Automation & Framework Management - Continuous controls monitoring and automated evidence collection across major frameworks: ISO 27001, NIST CSF, NIST SP 800-53, SOC 2, PCI DSS, HIPAA, GDPR, DORA, and the NIST AI RMF - Cross-framework control mapping so customers satisfy multiple requirements without duplicate effort - Agentic policy management: AI-driven policy generation, version control, change summaries, and automated approval workflows - Audit-readiness workflows with continuously collected auditor-facing evidence packages Reporting, Dashboards & Stakeholder Communication - Executive and board-level dashboards that translate cyber risk posture into financial and business terms - Regulator-ready reports for SEC, NYDFS, DORA, and other mandated disclosures - Trust center capabilities allowing customers to share real-time compliance posture with auditors and enterprise customers AI & Emerging Risk Domains - Governance capabilities for GenAI risk, including prompt injection, model abuse, training data risks, and LLM-specific attack vectors - AI Security Assessments aligned to ISO 42001, NIST AI RMF, and the EU AI Act Explainable AI features that surface rationale behind automated risk scores and recommendations Key Responsibilities - Product Roadmap & Execution: Own the CyberGRC product vision and multi-quarter roadmap, making strategic prioritization decisions informed by competitive intelligence, customer research, and MetricStream's ConnectedGRC platform strategy. - Competitive Product Strategy: Maintain deep awareness of how MetricStream's CyberGRC competes with competitors — and identify features that close gaps or establish differentiated leadership. - Customer & CISO Engagement: Lead discovery sessions, design sprints, and advisory conversations with CISOs, cyber risk managers, compliance officers, and security teams to uncover unmet needs and validate product direction. - Requirements Management: Translate complex cybersecurity workflows and regulatory requirements into crisp product requirements, user stories, and acceptance criteria grounded in real-world risk scenarios. - Cross-Functional Collaboration: Partner closely with engineering, data science, UX, and QA to ship secure, scalable, and high-quality product capabilities on time. - AI Feature Development: Define use cases and requirements for AI-powered features including agentic workflows, automated evidence collection, risk summarization, and predictive scoring — ensuring explainability and trust. - Backlog Prioritization: Continuously manage and prioritize the product backlog, balancing new capabilities, platform debt, integration depth, and regulatory coverage. - Go-to-Market Partnership: Work with sales, customer success, and marketing to prepare compelling product narratives, enable field teams, and integrate customer feedback loops into the development cycle. - Metrics & Adoption: Define and monitor KPIs for CyberGRC product adoption, feature utilization, and customer outcomes — using data to iterate and improve. - Product Evangelism: Represent MetricStream CyberGRC in customer engagements, analyst briefings, and industry forums, clearly articulating product value for cyber risk and compliance stakeholders Skills and Experience - Experience: 6–10 years in Cyber Risk Management, IT GRC, Compliance, or Security Product roles, ideally within enterprise SaaS, regulated industries, or GRC platform environments. - Domain Expertise: Deep understanding of cyber risk frameworks and methodologies — threat modeling, vulnerability management, control assessment, risk treatment, and financial risk quantification (FAIR). - Competitive Awareness: Familiarity with the modern cyber GRC and compliance automation landscape, including platforms such as Vanta, Drata, SAFE Security, ServiceNow IRM, or OneTrust. - Compliance Frameworks: Working proficiency across key standards including ISO 27001, NIST CSF, NIST SP 800-53, SOC 2, PCI DSS, GDPR, HIPAA, DORA, and the NIST AI RMF. - Technical Acumen: Comfort with AI/ML concepts in cybersecurity (anomaly detection, agentic workflows, risk scoring models), API integrations, and cloud security architecture. - Product Mindset: Demonstrated experience with modern product development practices — design thinking, agile delivery, user story writing, and data-informed iteration. - Stakeholder Communication: Ability to translate technical risk concepts into board-level and business language, and to influence cross-functional teams without direct authority. - Certifications (Preferred): CISSP, CRISC, CISM, CISA, or CEH Education Bachelor's or Master's degree in Cybersecurity, Information Technology, Risk Management, Computer Science, or a related discipline.