Senior Product Manager

Job Description

Code Insights is BlueOptima's application security product — helping engineering and security teams ship secure code faster by catching exposed secrets, static analysis (SAST) vulnerabilities, and risky open-source dependencies (SCA) before they reach production. We're hiring a Senior Product Manager to own this product end to end: its roadmap, its narrative, and its commercial outcome.

This is a high-agency role. You will set the AppSec point of view for Code Insights, defend it under pressure from CISOs and security architects in customer meetings, and hold your own presenting strategy, trade-offs, and results to BlueOptima's exec and C-suite team. This isn't a seat where someone else makes the calls and you execute tickets — you're expected to have a point of view, in the room, internally and externally, and defend it.

Alongside the core mandate, you'll have room to shape how Code Insights grows through product-led channels — using its shift-left, developer-first design (CLI, pre-commit hooks, CI/CD scanning) as a wedge for organic adoption. This is a growth opportunity for the right person to build.

What Impact Looks Like:

We want whoever takes this role to know, concretely, what “doing this job well” means — outcomes we'll hold you to, not just activities:

• Roadmap & delivery — Code Insights ships against a roadmap you've defined with key stakeholders across Product, Engineering, Data and Revenue teams, and can defend, grounded in AppSec domain reality (SAST/SCA, secrets detection, OWASP alignment), not just inbound requests.
• Customer-facing conversion — You're a credible voice in front of CISOs, SecOps leads, and security architects; customer pilots you own convert to paid, renewed, and expanded accounts.
• Retention & commercial outcome — Success is tied directly to retention goals, so you're accountable for customers staying and growing, alongside deals closing.
• Organic growth — if you lean into the PLG opportunity, you'll have room to build and own a self-serve growth motion — upside on top of the core mandate.

Key Responsibilities

1. Own Direction and Roadmap (Core Mandate)

• Set and defend the product roadmap for Code Insights — secrets detection, SAST, SCA/dependency risk — rooted in real AppSec domain expertise, not secondhand requirements.
• Partner with engineering to ship high-quality, well-scoped releases; own the trade-off calls when scope, timeline, and security depth conflict.
• Report product health, risk, and roadmap progress directly to senior leadership — including exec/C-suite settings — with the judgment to say what leadership needs to hear, not just what's easy to report.

2. Be the External and Internal Face of the Product

• Pitch Code Insights directly to CISOs, SecOps leads, and security architects; be comfortable being challenged on technical depth and defending the product's position against competing SAST, SCA, and secrets-detection tools.
• Own customer pilots end to end, from technical validation through commercial conversion — you carry the pilot, not just support it.
• Close the loop from field to roadmap: translate customer and prospect input into product decisions, and be willing to say no to requests that don't fit the strategy.
• Represent the product internally to sales, marketing, and execs as the person who can explain not just what Code Insights does, but why it wins and where it's still catching up.

3. Grow the Product-Led Opportunity (Growth Track)

• Use Code Insights' shift-left, developer-first design (CLI, pre-commit hooks, CI/CD integration) as a foundation to build organic, self-serve adoption.
• Partner with Design and Marketing to test and refine the self-serve journey — from first scan to habitual use to internal champion.
• Treated as a strategic opportunity to grow into, not a prerequisite — we'll support you in building this muscle if it's new to you.

What We're Looking For:

We're looking for technical judgment and business fluency in the same person:

• Seniority — 6–7+ years in product management or a customer-facing technical role, with real ownership of roadmap decisions, not just execution.
• Security domain grounding — working knowledge of application security concepts (SAST, SCA, secrets detection, or software supply chain security) sufficient to hold your own with security practitioners. Deep AppSec expertise is a strong plus; a fast learner with adjacent technical credibility can also thrive here.
• Business and interpersonal range — we're actively looking for candidates with an MBA or equivalent business training who pair that with technical depth — people who can move fluently between an engineering standup, a CISO pitch, and an exec update in the same week. Strong written and verbal communication, executive presence, and the judgment to know when to push back matter as much as domain knowledge.
• Commercial instinct — comfortable owning outcomes tied to revenue and retention, not just shipped features; you think in terms of business impact, not just backlog throughput.
• PM fundamentals — track record managing roadmaps, backlog hygiene (Jira or equivalent), and clear stakeholder reporting.
• Nice to have, not required — prior exposure to PLG or self-serve growth motions. We see this as an opportunity for you to grow into, not a filter we're screening for.

This role has a direct line of visibility to the exec/C-suite team on Code Insights strategy and results — you'll be expected to present, and defend, your own work in that setting.