SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
M-Files is a context-first document management platform that helps organizations secure collaboration, automate processes, and ensure governance. The company serves over 6,000 customers across 100+ countries with a metadata-driven architecture that connects documents to related business context.
The Product Security Manager leads M-Files' Product Security team as the technical security authority for M-Files products and cloud services, including AI-native capabilities. This role combines hands-on technical security work with team leadership and strategy.
Key Responsibilities:
Team Leadership: Lead and prioritize the Product Security team's work, own the product security strategy and roadmap, coach developers and Security Champions to raise the technical security baseline company-wide, and build a strong technically credible team. Drive AI adoption within the team to improve efficiency and security coverage.
Secure Development Lifecycle: Embed secure development practices across the product organization through threat modeling, security assessments, and secure coding guidance. Lead AI-assisted and manual code reviews on higher-risk changes. Ensure security testing tools (SAST, DAST, SCA, container scanning) are integrated into CI/CD pipelines. Own software supply chain security including SBOM generation and dependency monitoring. Maintain security policies and guidelines aligned with ISO/IEC 27001, ISAE 3000/SOC 2, and ISO 9001 certifications.
Vulnerability Management: Lead the design and implementation of the vulnerability advisory process, establish vulnerability disclosure policies, coordinate responsible disclosure programs, and support incident response for product security vulnerabilities. Develop metrics and reporting frameworks for vulnerability management effectiveness. Run the external penetration testing program end to end.
Cloud Security: Participate in cloud security planning across M-Files. Own cloud security posture management, driving Microsoft Defender for Cloud recommendations to closure across the Azure environment. Contribute to cloud security monitoring and incident response using the Microsoft security stack (Defender, Sentinel).
Customer & Compliance: Support customer-facing security work and collaborate with Legal, Privacy, and Compliance on regulatory and certification matters including GDPR, SOC 2, and ISO/IEC 27001.
Requirements:
- Bachelor's or Master's degree in Computer Science, Information Security, or related technical field
- 5+ years of hands-on experience in product security or application security with a track record of implementing security programs at enterprise scale and readiness to lead or mentor a technical team
- Strong understanding of cloud-native architectures including AKS/Kubernetes, container security, and cloud security posture management
- Deep knowledge of secure development lifecycle: threat modeling, security architecture review, secure coding standards (OWASP ASVS/Top 10), SAST/DAST/SCA tooling, and interpreting penetration testing findings
- Practical experience with vulnerability management, CVSS scoring, prioritization across multiple product lines, and driving remediation through engineering teams
- Experience or strong interest in using AI tools to make security work more efficient (AI-assisted code review, threat modeling, reporting)
- Working knowledge of security and compliance frameworks and regulations (SOC 2, ISO/IEC 27001, GDPR, NIS 2, CRA)
- Excellent written and verbal communication skills with ability to translate technical security concepts for non-technical and executive audiences
- Relevant security certifications appreciated (Microsoft security certifications SC-100/AZ-500, OSCP, CSSLP)
- Must have valid residency and work authorization in Finland; no relocation support or visa sponsorship offered
