Senior Product Manager
Response Automation (SIEM and SOAR)
Sumo Logic is hiring a Senior Product Manager to own the automation foundations that help security teams and AI agents turn detections into fast, safe, consistent response.
Finding a threat is half the job. Analysts still spend too much time enriching alerts, chasing context, opening tickets, and running containment steps by hand. As AI agents take on more of that work, response automation has to be dependable, auditable, and easy to control. This role owns the playbook, orchestration, and case management capabilities across Cloud SIEM and Cloud SOAR that make that possible.
You will own established automation capabilities while building toward agent-driven response and a tighter SIEM-to-SOAR experience. This is a technically deep role. It requires first-hand experience with security operations, SOAR, or workflow automation products, and the judgment to turn a broad platform vision into capabilities that SOC teams adopt and trust.
What You Will Own
Playbooks and the automation engine. The playbook editor, triggers, actions, execution engine, and the Automation Service. You will own their roadmap, performance, reliability, and competitiveness, balancing power, ease of use, and cost for analysts, detection engineers, and agents.
Cloud SIEM and Cloud SOAR together. Define how insights and signals in Cloud SIEM trigger automations and hand off to Cloud SOAR for incident and case management. Establish where the Automation Service ends and full Cloud SOAR begins, with clear packaging, upgrade paths, and one coherent customer experience.
Integrations, actions, and App Central. Set the strategy for enrichment, notification, containment, user choice, and custom actions. Prioritize integrations across endpoint, identity, cloud, ticketing, threat intelligence, and messaging tools. Own coverage, quality, and lifecycle for out-of-the-box playbooks and integrations.
Agentic and human-in-the-loop response. Define how AI agents discover, invoke, and chain playbooks and actions. Establish the approval steps, scoped permissions, guardrails, and audit trails that let customers decide which responses run automatically and which need an analyst's sign-off.
What You Will Be Doing
- Set the multi-quarter vision and roadmap for response automation, connecting current SOC needs with the requirements of AI-assisted investigation and response.
- Own the health and evolution of shipping playbook, automation, and case management capabilities, using customer feedback and execution data to prioritize improvements.
- Work with engineering and architecture on execution reliability, scalability, error handling, and cost at enterprise scale.
- Define and validate response use cases, such as phishing, compromised identity, and endpoint containment, and turn them into phased capabilities with clear behavior and limits.
- Develop the integration and action strategy, including how actions are named, scoped, versioned, and made safe to run without a person watching.
- Partner with detection, investigation, knowledge, and agent teams to turn their needs into shared automation capabilities and clear interfaces.
- Partner with the product and engineering teams responsible for platform governance to ensure automation respects established access controls, audit requirements, and cost policies.
- Translate strategy into clear proposals, PRDs, user stories, acceptance criteria, and rollout plans.
- Measure playbook success rate, time to respond, analyst time saved, reliability, cost, and adoption, and show how automation improvements lead to better security outcomes.
What You Bring
- 6+ years of product management experience, including direct ownership of security operations, SOAR, SIEM, or workflow automation products. Relevant platform experience is a hard requirement.
- Strong technical understanding of incident response workflows, orchestration engines, event-driven systems, APIs, and the integrations that connect security tools.
- Experience running a live product at scale, balancing customer commitments, reliability, and cost while delivering a longer-term roadmap.
- Experience building shared platform capabilities, APIs, or services used by multiple product teams, partners, or external developers.
- The ability to reason about automation risk, including false positives, partial failures, and the point where a human should approve an action.
- Familiarity with SOC operations and frameworks such as MITRE ATT&CK and the NIST incident response lifecycle. Experience with case management, threat intelligence, or integration marketplaces is valuable.
- An understanding of how AI agents discover tools, take actions, and operate within guardrails, or the ability to ramp quickly. Hands-on SOC or security engineering experience is a plus.
- Strong analytical skills and comfort using SQL, dashboards, and usage data to understand customer behavior and evaluate tradeoffs.
- Clear communication across technical and business audiences, and the ability to write proposals that explain options, dependencies, and recommendations.
Must Have Qualities
- Platform judgment. Finds common needs across teams and turns them into capabilities others can depend on.
- Customer grounding. Connects technical investment to a concrete improvement in response time, analyst workload, or risk reduction.
- Safety and trust. Treats control, auditability, and predictable behavior as product requirements, especially when automation takes action on its own.
- Runs today and builds tomorrow. Keeps current capabilities healthy while delivering the next generation of the platform.
- High ownership. Resolves ambiguity, makes tradeoffs explicit, and drives work through delivery and adoption.
About Us
Sumo Logic, Inc. helps make the digital world secure, fast, and reliable by unifying critical security and operational data through its Intelligent Operations Platform. Built to address the increasing complexity of modern cybersecurity and cloud operations challenges, we empower digital teams to move from reaction to readiness—combining agentic AI-powered SIEM and log analytics into a single platform to detect, investigate, and resolve modern challenges. Customers around the world rely on Sumo Logic for trusted insights to protect against security threats, ensure reliability, and gain powerful insights into their digital environments. For more information, visit www.sumologic.com.
Sumo Logic Privacy Policy. Employees will be responsible for complying with applicable federal privacy laws and regulations, as well as organizational policies related to data protection.
#LI-Hybrid
