The role

We’re looking for a Security Product Manager to join our team. Security Product Manager is responsible for conveying the company’s security strengths to customers, partners and the market at large. This includes participating in relevant security partnership initiatives, influencing security positioning and branding, and working closely with internal teams to ensure company’s security posture and security products is communicated effectively to all stakeholders. By combining expertise in compliance requirements with a customer-centric approach, Security Product Manager helps position security as a competitive advantage rather than just an internal obligation. 

Your responsibilities will include: 

1. Product Management 

• Define the vision and roadmap for Nebius’ security products. 
• Owning the ideation, postmortem, prioritization, backlog, and customer feedback processes. 
• Guiding new features, systems and services from inception to launch, while keeping customers at the center of everything. 

2. Customer-facing communications 

• Lead public-facing communications around security updates or changes in compliance status. 
• In the event of a security incident, coordinate user messaging (email notifications, press releases, FAQs) with support from the Head of Security Products and CISO. 
• Gather user feedback on user experience and security to guide continuous improvements. 

 3. Competitive analysis and market research 

• Conduct ongoing research on industry benchmarks, emerging security standards and technologies, and competitor certifications. 
• Identify gaps and opportunities in organization’s product security posture; propose strategic initiatives that differentiate the company’s security story in the market. 
• Stay informed about new regulations or frameworks that may influence future product certifications or transparency requirements (e.g., privacy laws, data sovereignty standards). 

 4. Certification and audit support, service ownership 

• Collaborate with the CISO office to gather technical evidence or make necessary product enhancements that satisfy certification requirements. 
• Take ownership of some security-related services of Cloud platform. 
• Track and maintain a certification roadmap (ISO 27001, SOC 2, HIPPA, etc.), working closely with CISO, GRC & Compliance, Corporate Security departments. Communicate timelines, goals and status updates to leadership and sales representatives. 

5. Cross-functional collaboration 

• Coordinate with multiple Product Managers to align security goals with other product roadmaps, ensuring a consistent narrative between product security and external messaging. 
• Work with Platform Security, GRC & Corporate Security and legal teams to gather essential information for security products enhancements (e.g., penetration test summaries, compliance reports). 
• Work with Customer-facing teams to address client inquiries about security posture and guide them on using security features optimally. 

We expect you to have: 

• 3+ years of Product Management or Program Management experience with a focus on security initiatives. 
• Basic knowledge of compliance frameworks (e.g., SOC 2, ISO 27001, GDPR) and familiarity with how they translate into business value. 
• Proven ability to communicate technical concepts in a clear, customer-friendly manner (e.g., writing content, speaking at webinars or conferences). 
• Stakeholder management skills to align with other Product Managers, CISO staff, engineering, marketing, and customer-facing teams. 
• Analytical mindset: comfortable defining success metrics (e.g., security feature adoption, NPS around trust, certification progress) and making data-driven decisions. 
• Project management skills: demonstrated ability to manage inter-team collaboration within company-wide projects, ensuring timely delivery of cross-functional tasks and alignment with compliance goals. 

It will be an added bonus if you have: 

•  Certifications such as CISSP, CISM, or PMP; prior experience in regulated industries; prior experience working for Cloud Service Provider.

About Nebius

Nebius AI is an AI cloud platform with one of the largest GPU capacities in Europe. Launched in November 2023, the Nebius AI platform provides high-end, training-optimized infrastructure for AI practitioners. As an NVIDIA preferred cloud service provider, Nebius AI offers a variety of NVIDIA GPUs for training and inference, as well as a set of tools for efficient multi-node training. 

Nebius AI owns a data center in Finland, built from the ground up by the company’s R&D team and showcasing our commitment to sustainability. The data center is home to ISEG, the most powerful commercially available supercomputer in Europe and the 16th most powerful globally (Top 500 list, November 2023).  

Nebius’s headquarters are in Amsterdam, Netherlands, with teams working out of R&D hubs across Europe and the Middle East. 

Nebius AI is built with the talent of more than 500 highly skilled engineers with a proven track record in developing sophisticated cloud and ML solutions and designing cutting-edge hardware. This allows all the layers of the Nebius AI cloud – from hardware to UI – to be built in-house, distictly differentiating Nebius AI from the majority of specialized clouds: Nebius customers get a true hyperscaler-cloud experience tailored for AI practitioners. We’re growing and expanding our products every day. 

If you’re up to the challenge and are excited about AI and ML as much as we are, join us!

About the Role

As an Application Security Engineer (Offensive Testing), you will lead and perform penetration testing and DAST for Veeam Data Cloud products. You’ll use Burp Suite and modern web/API testing techniques to find real, exploitable issues, help prioritize risk, and work with engineering teams to drive fixes to completion.

You will also improve testing tools and processes, make testing more repeatable, and help teams prevent recurring vulnerabilities—especially around authentication, authorization, session management, and tenant isolation.

What You’ll Do

• Own offensive testing: plan what to test, how deep to go, and how often; create clear, consistent reports and reusable playbooks
• Perform manual pentesting (main focus): test web apps and APIs, especially authentication/authorization, multi-tenant boundaries, and critical workflows; chain issues into realistic attack paths
• Use Burp Suite daily: validate and reproduce findings with advanced Burp features; build and maintain repeatable scopes, macros, and authenticated flows
• Run and improve DAST: execute and tune authenticated scans, reduce false positives, and work with CI/platform teams to scale scanning and manage credentials
• Drive remediation: deliver high-quality write-ups, partner with engineers to fix and retest, and help prevent regressions; ensure findings are tracked with the right severity and SLAs
• Improve security long-term: spot recurring patterns and help teams prevent them through standards, libraries, platform controls, and input to threat modeling/design reviews

What You’ll Bring

• Strong web and API pentesting experience, especially in authorization (IDOR/BOLA, privilege escalation, role/tenant boundaries), authentication/session flows (tokens, identity integrations), and common vulnerabilities (injection, SSRF, deserialization, misconfigurations) with practical exploitation skills
• Advanced Burp Suite skills: manual validation, targeted fuzzing, authenticated testing, and workflow automation (extensions/macros)
• Experience writing Semgrep rules to detect insecure patterns and improve secure-by-default development
• DAST experience at scale: running or supporting authenticated scans, tuning coverage, and reducing false positives
• Clear written communication: concise PoCs and actionable remediation guidance for engineers

Bonus Skills

• SaaS multi-tenant security testing experience; OAuth2/OIDC/SAML depth; bug bounty triage; writing custom tooling or Burp extensions

What You’ll Get 

• 25 vacation days, 4 sick days, 21 paid medical leave days, plus 4 extra global VeeaMe Days for self-care and 24 paid volunteer hours annually through Veeam Cares
• Premium private medical insurance for employees and dependents
• Daily meal vouchers for restaurants and groceries (180 CZK per working day)
• Flexible cafeteria platform with thousands of lifestyle benefit options
• Multisport Card for gym and wellness, with family add-on options
• Annual public transport reimbursement up to a set limit
• Corporate mobile plan with optional family tariff
• Opportunities to learn and grow through on-demand libraries (LinkedIn Learning, O’Reilly), mentoring, workshops and learning events like our annual Global Day of Learning

Please note: If the applicant is permanently present outside of the Czech Republic, Veeam reserves the right to refuse to consider the application for a job. Remote job is only possible in case the employee is located in the Czech Republic.

#LI-GD1
#Hybrid