Senior Product Manager

Response Automation (SIEM and SOAR)

Sumo Logic is hiring a Senior Product Manager to own the automation foundations that help security teams and AI agents turn detections into fast, safe, consistent response.

Finding a threat is half the job. Analysts still spend too much time enriching alerts, chasing context, opening tickets, and running containment steps by hand. As AI agents take on more of that work, response automation has to be dependable, auditable, and easy to control. This role owns the playbook, orchestration, and case management capabilities across Cloud SIEM and Cloud SOAR that make that possible.

You will own established automation capabilities while building toward agent-driven response and a tighter SIEM-to-SOAR experience. This is a technically deep role. It requires first-hand experience with security operations, SOAR, or workflow automation products, and the judgment to turn a broad platform vision into capabilities that SOC teams adopt and trust.

What You Will Own

Playbooks and the automation engine. The playbook editor, triggers, actions, execution engine, and the Automation Service. You will own their roadmap, performance, reliability, and competitiveness, balancing power, ease of use, and cost for analysts, detection engineers, and agents.

Cloud SIEM and Cloud SOAR together. Define how insights and signals in Cloud SIEM trigger automations and hand off to Cloud SOAR for incident and case management. Establish where the Automation Service ends and full Cloud SOAR begins, with clear packaging, upgrade paths, and one coherent customer experience.

Integrations, actions, and App Central. Set the strategy for enrichment, notification, containment, user choice, and custom actions. Prioritize integrations across endpoint, identity, cloud, ticketing, threat intelligence, and messaging tools. Own coverage, quality, and lifecycle for out-of-the-box playbooks and integrations.

Agentic and human-in-the-loop response. Define how AI agents discover, invoke, and chain playbooks and actions. Establish the approval steps, scoped permissions, guardrails, and audit trails that let customers decide which responses run automatically and which need an analyst's sign-off.

What You Will Be Doing

Set the multi-quarter vision and roadmap for response automation, connecting current SOC needs with the requirements of AI-assisted investigation and response.
Own the health and evolution of shipping playbook, automation, and case management capabilities, using customer feedback and execution data to prioritize improvements.
Work with engineering and architecture on execution reliability, scalability, error handling, and cost at enterprise scale.
Define and validate response use cases, such as phishing, compromised identity, and endpoint containment, and turn them into phased capabilities with clear behavior and limits.
Develop the integration and action strategy, including how actions are named, scoped, versioned, and made safe to run without a person watching.
Partner with detection, investigation, knowledge, and agent teams to turn their needs into shared automation capabilities and clear interfaces.
Partner with the product and engineering teams responsible for platform governance to ensure automation respects established access controls, audit requirements, and cost policies.
Translate strategy into clear proposals, PRDs, user stories, acceptance criteria, and rollout plans.
Measure playbook success rate, time to respond, analyst time saved, reliability, cost, and adoption, and show how automation improvements lead to better security outcomes.

What You Bring

6+ years of product management experience, including direct ownership of security operations, SOAR, SIEM, or workflow automation products. Relevant platform experience is a hard requirement.
Strong technical understanding of incident response workflows, orchestration engines, event-driven systems, APIs, and the integrations that connect security tools.
Experience running a live product at scale, balancing customer commitments, reliability, and cost while delivering a longer-term roadmap.