Security Product Manager

Prowess Consulting is a consulting firm that specializes in helping enterprises in the technology industry. They are seeking a Security Product Manager to define and drive the vision, strategy, roadmap, and adoption of security and compliance capabilities across the Windows ecosystem.

Responsibilities:

• Own the vision, strategy, roadmap, and investment priorities for Windows security compliance and assurance capabilities
• Serve as a Security SME and trusted advisor across platform, services, application, infrastructure, and secure software supply chain security domains
• Identify security and compliance gaps and drive product investments that improve Windows security posture and regulatory readiness
• Drive prioritization and investment decisions across competing security, compliance, customer, and engineering needs, balancing risk, impact, and business value
• Translate complex security, customer, and regulatory requirements into scalable platform capabilities and engineering solutions
• Partner with engineering teams to design and deliver secure-by-design, compliance-by-design, and AI-enabled capabilities that improve security assurance, governance efficiency, and audit readiness
• Influence architecture and engineering decisions across Windows products, services, build infrastructure, release systems, signing systems, and engineering platforms
• Drive security assurance and compliance readiness for Cybersecurity EO, CRA, PQC/CNSA, SDL, SFI, FedRAMP, FIPS, and future regulatory requirements
• Define success metrics and use data-driven insights to drive adoption, prioritization, investment decisions, and continuous improvement in auditability and compliance readiness

Requirements:

• 6+ years of experience in Product Management, Security Engineering, Security Architecture, Technical Program Management, or related fields
• Strong technical expertise in platform, services, application, and infrastructure security, with deep understanding of build infrastructure, CI/CD systems, secure software supply chains, release engineering, signing services, artifact management, and AI/ML development and training environments
• Ability to serve as a trusted Security SME and influence architecture, product strategy, and engineering decisions across complex technical domains
• Experience serving as a technical security leader or SME, influencing architecture, product strategy, and engineering decisions
• Strong knowledge of security architecture, secure development practices, threat modeling, vulnerability management, and security assurance principles
• Experience driving product strategy and execution for security, platform, infrastructure, or developer-focused technologies
• Strong understanding of enterprise/on-prem Windows security fundamentals, such as Active Directory, authentication/authorization concepts, Group Policy, credential hygiene, hardening baselines, and security logging/auditing
• Experience operating vulnerability management and coordinated disclosure processes, including intake/triage, severity scoring (e.g., CVSS), remediation SLAs, exception handling, and reporting/notification obligations
• Software supply chain & secure development knowledge (aligned to NIST SSDF concepts), including build integrity, dependency management, SBOMs (SPDX/CycloneDX), code signing, and release/change control
• Ability to work with compliance tooling and evidence workflows (GRC/control libraries, automated evidence collection, audit trails) and integrate with engineering systems (ADO/Jira, CI/CD, ticketing)
• Data/analytics skills to build continuous monitoring and compliance reporting (Power BI or similar; ability to work with log/metric sources and perform basic querying to validate control health)
• Experience with operating systems, developer platforms, cloud services, or large-scale engineering infrastructure
• Experience working on secure software supply chain, release engineering, code-signing, build systems, or engineering platform security initiatives
• Familiarity with AI/ML security, model development environments, and AI governance considerations