Fig Security

Description What you’ll own You’ll own the AI at the core of Fig's product, which keeps SOC detection and response in sync with constant change. You’ll decide what it does, how security teams work with it, how we know it’s getting better, and how we grow it. What you'll be doing • Define the strategy and roadmap for Fig's agentic capabilities • Work with engineering to execute on it while constantly evolving it with latest tech developments. • Implement agentic product methodologies for building, evaluating and shipping AI based products • Work with SecOps teams to evolve the roadmap and build capabilities that solve their hardest problems • Identify product evolution opportunities from market and technology signals, and strategize product development accordingly • Enable sales and marketing teams to meet the market pain use cases in XL scale Requirements You’ll fit if • You have 5+ years in product management, including at least 1 year as a PM on an AI product • Big bonus for background in building in the security operations space • You’ve shipped LLM-based features to real users, and you know how work and where they fail • You've worked with big enterprise clients, understand how they operate, what drives business decisions and how it translates to great products • You're a persons' person, hungry for winning and cut-to-the-chase. • You have strong English communication skills.

Description What you'll own Fig's product is built around an AI agent that security analysts and detection engineers work with directly. It investigates coverage questions against live enterprise security data, authors and tests detection logic, and tunes noisy alerting. That agent is already in production with enterprise design partners. Now we need to make it dependable and scalable enough for GA. You will own that evolution: the agent architecture, its evaluation and quality system, and the production engineering around it. This is a hands-on senior IC role with real architectural authority - you set the technical direction and you write the code. The agent operates inside customer security environments, where a wrong action can become a customer incident. Correctness, isolation, observability, and evaluation are not polish. They are the product. What you'll be doing • Agent architecture: Design the evolution from today's production single-agent system to a multi-agent one: orchestration, task decomposition, runtime and framework choices, and a migration path that does not break what design partners already rely on. • Agent capability: Own the prompts, context, skills, and tool design that make the agent genuinely good at detection engineering across multiple security platforms, not just plausible-sounding. • Evaluation platform: Build the harnesses, judges, and golden datasets that turn "the agent feels better" into a number, plus the CI gates that keep regressions from shipping. • Reliability and safety: Keep long-running agentic sessions healthy in production, and build the isolation and guardrails required of an agent working inside enterprise security environments. • Production debugging: Work real failures from production traces, and turn each one into an eval case that can never regress silently. • Technical direction: Make the calls on architecture, sequencing, and quality bar and be accountable for the outcome, including raising how AI-natively the whole team builds. • Cross-team partnership: Partner with product and customer-facing teams on what the agent should do, and with platform teams on the data and integrations it depends on. Requirements What you'll need • Senior engineering depth: You have 6+ years of experience building and operating production software, with strong backend and distributed-systems fundamentals and experience designing APIs and services. • Shipped agents, not demos: You have taken an LLM agent system with tool use, multi-turn interaction, and planning to real users, and you can talk concretely about how it failed and what you did about it. • Architectural judgment: Informed opinions on single-agent vs. multi-agent design, orchestration patterns, and the current framework and SDK landscape, with the pragmatism to pick the boring option when boring wins. • Eval discipline: You have built or owned evaluation for an LLM system, including golden datasets, LLM-as-judge with calibration, and regression gates in CI, and you can quote the metrics you moved. • Tool design instincts: You know when a deterministic tool beats a model call, how to design tool contracts an LLM will not misuse, and how to keep cost and latency under control. • Distributed systems fluency: Streaming, stateful services, and the operational instincts to keep long-running agent sessions alive in production. • Ownership in ambiguity: You can lead an area as a hands-on IC in an early-stage environment with little existing structure. Security domain experience such as SIEM platforms, SOC workflows, detection engineering, or security query languages, and experience with modern agent SDKs and protocols such as MCP, are strong advantages.

Description What you'll own Fig's product does the work a SecOps engineer does: it investigates coverage gaps against live enterprise security data, authors and tests detection logic, and tunes noisy alerting. That means product decisions here are SecOps engineering decisions, and they need someone who has actually done the job. You'll join Fig's product team and own the detection engineering surface of the product - what good coverage analysis looks like, what correct detection content looks like, what a security team should be able to trust the product to do on its own. Fig is defining a category around Security Operations Resilience, and the fastest way to get that right is to be genuinely credible with the SecOps engineers we're building for. What you'll be doing • Drive the detection product domain: Bring deep expertise in SecOps engineering across SIEM, data pipelines, and SOAR, and help the product team define where the product should excel. Develop a strong understanding of the day-to-day work of SecOps engineers and the challenges they face. • Turn expertise into product insight: Conduct deep, hands-on research across real security environments, SecOps engineering practices, data, and tooling. Combine customer feedback with your own experience and the knowledge of the broader team to identify meaningful problems, opportunities, and product directions. • Shape and execute the roadmap: Translate product insights into a focused roadmap aligned with company strategy and customer needs. Partner with the product and engineering teams to prioritize initiatives, make tradeoffs, define outcomes, and drive execution from discovery through delivery. • Turn problems into product direction: Translate ambiguous problems into clear product requirements and actionable plans. Work closely with engineering, design, and security experts to ensure complex technical problems are translated into products that are useful, intuitive, and technically sound. • Shape and evaluate AI agent capabilities: Define what Fig’s AI agent should be capable of doing as a SecOps engineer, what good looks like, and where it must be trusted or constrained. Develop evaluation frameworks, scenarios, and ground truth to measure and continuously improve agent performance. • Own product quality and outcomes: Maintain a deep understanding of how the product is used in real-world security operations. Validate assumptions, identify gaps, and use customer feedback, product data, and operational experience to continuously improve the product and its direction. Requirements What you'll bring • Detection engineering depth: 5+ years in detection engineering or security engineering, with detections you personally wrote, tested, tuned, and maintained in production. • SecOps stack fluency: Hands-on experience with SIEM, SOAR, security data pipelines, or security data lakes, including the query languages and data source configuration work that comes with them. • Content and automation experience: Comfortable building detection content, wiring up data sources, and building automated response workflows - and opinionated about where each one breaks. • Product instinct, not necessarily a product title: You can get from "this is broken" to a clear, buildable spec without being handed a template. Prior Product Manager or Technical Product Manager experience is a strong plus. • Communication that lands both ways: You can hold a deeply technical conversation with a SecOps engineer and a clear one with a security leader. Experience working directly with customers or external security teams is a strong advantage. • Curiosity about AI in the loop: Interested in how AI and ML change detection and monitoring, and willing to reason carefully about what an agent should and shouldn't be trusted to do inside a customer's security environment. • 0-to-1 judgment: Comfortable in an early-stage environment with an emerging category, limited existing structure, and a high bar for ownership.