Senior Technical Product Manager, API Traffic and Enforcement

Fastly is an edge cloud platform company that helps customers create secure, reliable digital experiences by processing applications close to end users. The Senior Technical Product Manager will own the strategy and roadmap for defining allowed API traffic, API discovery and inventory, schema-based contracts, and request-path enforcement primitives such as ACLs, allowlists, and rate limiting. The role will also define how agents and MCP servers are identified, authorized, and constrained across Fastly's platform.

Responsibilities:

• Own the positive model end to end: drive the strategy and roadmap for defining what traffic is allowed. You will take customers from not knowing what APIs they run, to describing intended behavior precisely, to enforcing it in the request path
• Make API discovery tell customers something they didn't know: own discovery and inventory across the API surfaces customers actually operate. Discovery is where most customers start, and how good it is determines whether they trust anything built on top of it
• Turn schemas into enforceable contracts: own schema definition, generation, and validation. When customers can't hand you an accurate spec for their own APIs, the product has to produce one worth enforcing against, then keep it accurate as their APIs change
• Own enforcement in the request path: ACLs, allowlists, rate limiting, and the controls that turn a declared model into something the platform enforces, along with the gateway that applies them. Build these as primitives other products can adopt, not features scoped to one surface
• Make agents first-class: agents calling APIs are a new kind of client, and MCP servers are a new kind of endpoint. Define how Fastly identifies them, authorizes them, and holds them to allowed behavior
• Take and defend clear positions: bring evidence-based points of view on how traffic should be described and constrained, and drive them to decisions across engineering, product, and partner teams. You will bring structure to ambiguous problems and move decisions forward earlier

Requirements:

• 5+ years in product management or technical product leadership, ideally on API, security, or platform infrastructure products
• you understand how API traffic is described, validated, and constrained — schemas and specs, gateway behavior, and the difference between allowlist models and detection-based ones. You can reason about where each fits and what it costs to run
• a track record of building capabilities that serve more than one product or team. Shared primitives, enforcement points, or controls others build on, rather than features scoped to a single surface
• a demonstrated bias for shipping. You are hands-on and comfortable owning outcomes in ambiguous, fast-moving conditions rather than waiting for perfect clarity
• the ability to form clear, evidence-based positions and defend them across engineering and product partners, including pushing back constructively. You build alignment without relying on authority
• a clear communicator who can move between deep technical discussion with engineers and crisp framing for customers and executives, with genuine curiosity about the "why" behind a customer's problem. You can stand up in front of a room, make a case, and hold it under questioning
• Hands-on work with API gateways and OpenAPI-driven validation: schema generation from live traffic, drift detection as APIs change, and the gap between the spec a team publishes and what their API actually does
• This position will require you to be available during core business hours
• This position is open to Hybrid And Remote Work Locations
• The preferred locations for this position are:
• • San Francisco, CA
• • New York, NY
• • Denver, CO
• There is a strong preference for Hybrid near a local office. However, we may be willing to consider remote candidates within the US
• This position may require travel as required by your role or requested by your manager
• The agentic traffic stack — workload and agent identity (SPIFFE/WIMSE, mTLS), OAuth 2.1 for delegated agent authorization, and agent protocols like MCP and its authorization spec
• Request-path enforcement at scale: WASM filters, eBPF, or policy engines like OPA and Rego
• Startup or 0-to-1 experience building API, security, or infrastructure products in a fast-moving environment