Senior Product Manager, Public Sector & Security

Overview

Medallia is the pioneer and market leader in Experience Management. Our award-winning SaaS platform, Medallia Experience Cloud, leads the market in the management of experiences, insights, and actions for candidates, customers, employees, patients, and residents alike.

We believe that every experience is a memory that can last a lifetime. Experiences shape the way people feel about a company. And they greatly influence how likely people are to advocate, contribute, and stay. At Medallia, we are committed to creating a world where organizations are loved by their customers and their employees.

We empower exceptional people to create extraordinary experiences together.

Bring your whole self.

The Role and Team Medallia is seeking an experienced Product Manager to own the roadmap that brings the Medallia Experience Cloud — including its growing set of AI-powered capabilities — to our Public Sector customers: federal, defense, state, and local government agencies, along with the regulated industries and partners that sit alongside them. In collaboration with Medallia's Public Sector and Delivery teams you decide what gets built and in what sequence to make our flagship capabilities available in government-authorized environments, and you translate security, compliance, and AI governance requirements into product and engineering work, partnering with Medallia's Security, Compliance, and AI governance teams along the way.

Most of Medallia's recent and future innovation is AI-powered, so fluency in AI product development is central to this role, not incidental to it. As part of a company-wide mandate, you'll also partner with Legal and AI governance on the product's alignment with emerging AI-specific regulation and standards, such as the EU AI Act and ISO 42001, as they evolve. You'll be the product-facing voice for Public Sector customers, resellers, and internal stakeholders on feature availability, security posture, and AI capability, working closely with engineering, legal, and GTM.

• Own the Public Sector and enterprise security product roadmap: decide which flagship capabilities — including AI-powered features and core security capabilities — ship, and in what sequence, balancing business needs, compliance remediation, and AI governance reviews.
• Own the product and business decisions that government authorizations (FedRAMP, IL4/IL5, StateRAMP, CJIS, IRS 1075) and enterprise trust certifications (SOC 2 Type II, ISO 27001, HIPAA, HITRUST) require, translating frameworks like NIST 800-53 into product and engineering work in partnership with Security and Compliance.
• Own core platform security and privacy capabilities as product surfaces: authentication and SSO, provisioning, roles and permissions, session and API access controls, encryption and customer-managed keys, tenant isolation and data residency, retention/deletion/legal hold, customer-facing audit logging and SIEM export, and privacy operations such as DSAR fulfillment, consent, and PII detection/redaction — including in AI-generated output.
• Shape how AI-powered capabilities are made available in government-authorized and enterprise environments, translating AI governance and customer or agency expectations into product requirements in partnership with Medallia's AI governance function, including alignment with emerging regulation and standards such as the EU AI Act and ISO 42001.
• Prioritize and sequence roadmap work generated by security remediation (pen test findings, vulnerability SLAs, review outcomes), compliance remediation, or AI governance reviews — Security and Compliance own findings and severity, this PM owns sequencing — and set the default security posture (secure by default, admin-controlled overrides) for new features.
• Serve as the primary product point of contact for Public Sector and enterprise customers, resellers, and government cloud partners, as well as Sales and Delivery, on feature availability, security posture, AI capability, and certification status, including reducing security questionnaire and RFP burden through self-serve documentation and in-product evidence.
• Support Security and Compliance…