Senior Product Manager, Public Sector & Security

Overview

Medallia is the pioneer and market leader in Experience Management. Our award-winning SaaS platform, Medallia Experience Cloud, leads the market in the management of experiences, insights, and actions for candidates, customers, employees, patients, and residents alike.

We believe that every experience is a memory that can last a lifetime. Experiences shape the way people feel about a company. And they greatly influence how likely people are to advocate, contribute, and stay. At Medallia, we are committed to creating a world where organizations are loved by their customers and their employees.

We empower exceptional people to create extraordinary experiences together.

Bring your whole self.

The Role and Team
Medallia is seeking an experienced Product Manager to own the roadmap that brings the Medallia Experience Cloud — including its growing set of AI-powered capabilities — to our Public Sector customers: federal, defense, state, and local government agencies, along with the regulated industries and partners that sit alongside them. In collaboration with Medallia's Public Sector and Delivery teams you decide what gets built and in what sequence to make our flagship capabilities available in government-authorized environments, and you translate security, compliance, and AI governance requirements into product and engineering work, partnering with Medallia's Security, Compliance, and AI governance teams along the way.

Most of Medallia's recent and future innovation is AI-powered, so fluency in AI product development is central to this role, not incidental to it. As part of a company-wide mandate, you'll also partner with Legal and AI governance on the product's alignment with emerging AI-specific regulation and standards, such as the EU AI Act and ISO 42001, as they evolve. You'll be the product-facing voice for Public Sector customers, resellers, and internal stakeholders on feature availability, security posture, and AI capability, working closely with engineering, legal, and GTM.

Responsibilities

• Own the Public Sector and enterprise security product roadmap: decide which flagship capabilities — including AI-powered features and core security capabilities — ship, and in what sequence, balancing business needs, compliance remediation, and AI governance reviews.
• Own the product and business decisions that government authorizations (FedRAMP, IL4/IL5, StateRAMP, CJIS, IRS 1075) and enterprise trust certifications (SOC 2 Type II, ISO 27001, HIPAA, HITRUST) require, translating frameworks like NIST 800-53 into product and engineering work in partnership with Security and Compliance.
• Own core platform security and privacy capabilities as product surfaces: authentication and SSO, provisioning, roles and permissions, session and API access controls, encryption and customer-managed keys, tenant isolation and data residency, retention/deletion/legal hold, customer-facing audit logging and SIEM export, and privacy operations such as DSAR fulfillment, consent, and PII detection/redaction — including in AI-generated output.
• Shape how AI-powered capabilities are made available in government-authorized and enterprise environments, translating AI governance and customer or agency expectations into product requirements in partnership with Medallia's AI governance function, including alignment with emerging regulation and standards such as the EU AI Act and ISO 42001.
• Prioritize and sequence roadmap work generated by security remediation (pen test findings, vulnerability SLAs, review outcomes), compliance remediation, or AI governance reviews — Security and Compliance own findings and severity, this PM owns sequencing — and set the default security posture (secure by default, admin-controlled overrides) for new features.
• Serve as the primary product point of contact for Public Sector and enterprise customers, resellers, and government cloud partners, as well as Sales and Delivery, on feature availability, security posture, AI capability, and certification status, including reducing security questionnaire and RFP burden through self-serve documentation and in-product evidence.
• Support Security and Compliance during assessments and audits with product context and evidence as needed.
• Partner with Security, Compliance, AI governance, Legal, and GTM to evaluate new market entry — new frameworks, agencies, or AI capabilities — and define the product work it would take to support them.
• Report on public sector and security roadmap progress, AI capability rollout, and certification status to leadership on a recurring cadence.
• Set and hold reliability, availability, and support expectations specific to government SLAs where they differ from commercial terms.

Candidates based in the Tysons vicinity will be prioritized as this role is Hybrid, 3 days per week onsite.

Qualifications

Minimum Qualifications

• Bachelor's degree in a science, engineering, business, or related field, or equivalent experience.
• 6+ years of product management experience in enterprise SaaS, including experience delivering products in public sector, government, or high regulated markets.
• Experience defining and executing the roadmap for AI-powered features in an enterprise SaaS product.
• Experience launching a product through a FedRAMP, StateRAMP, CJIS, IRS 1075, or comparable authorization, and translating compliance frameworks (e.g. NIST 800-53) into product and engineering requirements.
• Experience leading cross-functional stakeholder alignment, spanning engineering, security, compliance, legal, and go-to-market teams.
• Track record of driving product initiatives from strategy through operationalization, in an environment where compliance and AI governance requirements must be balanced against product priorities and core feature development.

Preferred Qualifications

• Experience with government cloud environments such as AWS GovCloud, Azure Government, or Google Public Sector.
• Experience shipping AI or generative AI features into a regulated industry or government-authorized environment.
• Familiarity with defense Impact Levels (IL4/IL5), ITAR, or other defense-adjacent compliance regimes.
• Prior experience at a company selling directly into federal, defense, state, or local government.
• Security or compliance certification such as CISSP, CISA, or CGRC, in addition to product management experience.
• Experience with a Customer Experience Management platform.
• Experience in an agile development environment and familiarity with tools such as Productboard and JIRA.

Medallia is committed to equal pay and transparency. The annual base salary range for this position is $170,500 - $235,000. Please note that the salary range information provided is a general guideline and combines all of the distinct labor markets within the US. It is uncommon for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on a variety of factors. Medallia considers factors such as (but not limited to) scope and responsibilities of the position, candidate’s work experience, candidate’s work location, education/training, key skills, internal peer equity, external market data, as well as, market and business considerations when making compensation decisions.

Medallia also offers competitive health and wellness benefits, including but not limited to medical, dental, vision, 401(k), short-term and long-term disability, life and AD&D insurance, statutory leaves, paid parental leave, and paid holidays. Benefits and eligibility may vary by location and role.

At Medallia, we celebrate diversity and recognize the value it brings to our customers and employees. Medallia is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age (40 and over), disability, genetic information, veteran status or military service, or any other status protected by state or local law. Individuals with a disability who need an accommodation to apply please contact us at [email protected]. For information regarding how Medallia collects and uses personal information, please review our Privacy Policies. Applications will be accepted for 30 days from the date this role was posted or until the role has been filled.