What you'll own
Fig's product does the work a SecOps engineer does: it investigates coverage gaps against live enterprise security data, authors and tests detection logic, and tunes noisy alerting. That means product decisions here are SecOps engineering decisions, and they need someone who has actually done the job. You'll join Fig's product team and own the detection engineering surface of the product - what good coverage analysis looks like, what correct detection content looks like, what a security team should be able to trust the product to do on its own. Fig is defining a category around Security Operations Resilience, and the fastest way to get that right is to be genuinely credible with the SecOps engineers we're building for.
What you'll do
Drive the detection product domain: Bring deep expertise in SecOps engineering across SIEM, data pipelines, and SOAR, and help the product team define where the product should excel. Develop a strong understanding of the day-to-day work of SecOps engineers and the challenges they face.
Turn expertise into product insight: Conduct deep, hands-on research across real security environments, SecOps engineering practices, data, and tooling. Combine customer feedback with your own experience and the knowledge of the broader team to identify meaningful problems, opportunities, and product directions.
Shape and execute the roadmap: Translate product insights into a focused roadmap aligned with company strategy and customer needs. Partner with the product and engineering teams to prioritize initiatives, make tradeoffs, define outcomes, and drive execution from discovery through delivery.
Turn problems into product direction: Translate ambiguous problems into clear product requirements and actionable plans. Work closely with engineering, design, and security experts to ensure complex technical problems are translated into products that are useful, intuitive, and technically sound.
Shape and evaluate AI agent capabilities: Define what Fig’s AI agent should be capable of doing as a SecOps engineer, what good looks like, and where it must be trusted or constrained. Develop evaluation frameworks, scenarios, and ground truth to measure and continuously improve agent performance.
Own product quality and outcomes: Maintain a deep understanding of how the product is used in real-world security operations. Validate assumptions, identify gaps, and use customer feedback, product data, and operational experience to continuously improve the product and its direction.
Requirements
What you'll bring
Detection engineering depth: 5+ years in detection engineering or security engineering, with detections you personally wrote, tested, tuned, and maintained in production.
SecOps stack fluency: Hands-on experience with SIEM, SOAR, security data pipelines, or security data lakes, including the query languages and data source configuration work that comes with them.
Content and automation experience: Comfortable building detection content, wiring up data sources, and building automated response workflows - and opinionated about where each one breaks.
Product instinct: You can get from "this is broken" to a clear, buildable spec without being handed a template. Prior Product Manager or Technical Product Manager experience is a strong plus.
Curiosity about AI in the loop: Interested in how AI and ML change detection and monitoring, and willing to reason carefully about what an agent should and shouldn't be trusted to do inside a customer's security environment.
0-to-1 judgment: Comfortable in an early-stage environment with an emerging category, limited existing structure, and a high bar for ownership.
Nice to have
Communication that lands both ways: You can hold a deeply technical conversation with a SecOps engineer and a clear one with a security leader. Experience working directly with customers or external security teams is a strong