TL;DR

- ? Qalea: agentic cybersecurity and compliance for the regulated mid-market
- ? Backed by Google for Startups, ex-cybersecurity founders and traditional VC (€1.5M raised)
- ? The job: own what we build and what "done" means. Today nobody owns product, definition is split between engineering, customer experience and me, and work starts before anyone has agreed what finished looks like. You close that, then decide where the product goes
- ? Where it goes: this is the first product hire and it grows into Head of Product
- ? You should: be technical enough to argue with an engineering lead, close enough to clients to bring back real requirements, and comfortable deciding rather than facilitating

Already in? APPLY HERE - [https://tally.so/r/lbG7ZX]

Hi there ?

I'm Olmo, CEO of Qalea. We have around 80 clients, an engineering team, and no product function. Definition is split between engineering, customer success and me, so work starts without agreed acceptance criteria and gets called done without anyone verifying it. That is why this role exists.

The other half is even more interesting. We operate the security programme for the client, we don't hand them a dashboard. So product's job is margin and scale: how much security per client without adding a person. And somebody has to decide what makes this different from Vanta plus an EDR. That is you.

You report to me, own product end to end, and grow into Head of Product.

About Qalea

We've raised €1.5M and are backed by top-tier investors, from cybersecurity founders to leading VC firms. We're part of the Google for Startups AI-Cybersecurity program. We sell to regulated mid-market companies in Spain and the EU: certification (ISO 27001, ENS, NIS2, DORA, AI Act) combined with managed protection (EDR, SIEM, attack surface, application security, cloud posture, device management). We move fast, stay close to the product and care about what we build.

What You'll Do

Primary, this is where your first 90 days go:

- Own the definition. You write acceptance criteria, you get them agreed, and at the end you are the one who says whether it is done.
- Make the roadmap happen, on time. You are in engineering planning, you know what is being worked on practically every day. When the quarter gets tight you decide what drops. This is the hardest part of the job,



and your performance bonus is tied to the percentage of the roadmap that actually ships.
- Turn input into decisions. We are not short on input: there is a live client request system, customer experience sees every account, and sales hears every objection. What is missing is the person who reads all of it, decides what we build and what we do not, and tells everyone why. That is you.
- Stay close to clients. Not to gather requirements from zero, we have those, but to check that what we defined is what they actually needed. Named clients you talk to regularly.
- Raise how many clients one security program manager can carry. Onboarding still costs 4 to 8 hours of setup per client, integrations fail and get retried, and too many steps are still manual. Every hour the product takes out of that is worth more to us than a new feature.

Secondary, grows as the primary lands:

- Put AI into the product properly. Not a chatbot bolted on the side: triage, evidence gathering, document generation, security questionnaires. Today an analyst can spend an hour on a single incident and our automated output is still too noisy to hand to a client. That is your playground.
- Decide what makes us different. Compliance automation is commoditising and managed security is crowded. The interesting product question at Qalea is what sits between the two, and you own it.
- Design partners, not personas. Named clients you talk to regularly and build with.

You'll Excel If You Have

Must-haves:

- You have owned a technical B2B product end to end and were the person who decided what shipped. The title matters far less than the ownership
- Technical enough to hold a real conversation with an engineering lead about development (and timings), architecture, integrations, cloud and endpoints, and to push back when something does not add up
- Cybersecurity / compliance fluency, or a track record of getting deep in a technical domain fast. You will be defining EDR,



SIEM, device management, attack surface, cloud posture and certification scope, so a generalist product profile with no appetite for the domain will not work here
- Real enthusiasm for AI, and evidence that you already build with it. We are not asking for years of AI product experience. We are asking for somebody who wants to bet the next few years on cybersecurity plus AI and is already playing with the tools
- Fluent Spanish and English

Nice-to-haves:

- Time inside or next to a security team (SOC, MDR, MSSP or GRC)
- Prototyping, whether Figma or the AI coding tools, so you can show instead of describe
- Customer discovery in regulated industries
- First product hire somewhere before, in a company with no product function

Cultural Fit

- Decide, don't facilitate: a meeting that ends without a decision and an owner is a meeting that failed
- Go and get it: if the requirement is missing you go and find it, you do not wait for a brief
- Clarity: you write clearly, give context and flag problems early
- Curiosity: always testing and adopting new tools, AI included

What's in it for you

- ? Build the product function from zero, next to the CEO, no legacy, no politics
- ? Grows into Head of Product as we scale
- ? A domain where AI changes the product itself, not a slide about it
- ? Performance bonuses
- ? 26 days off (23 + birthday + Dec 24 and 31)
- ? Remote in summer and Christmas
- ?️ Office in Poblenou, Barcelona
- ?️ Gympass/Wellhub, unlimited specialty coffee (Syra), free fruit and Nora discounts
- ? Off-sites, team lunches, we enjoy building together

Recruitment Process (max. 2 weeks)

- Stage 1, phone screen (15 min): fit, location, salary
- Stage 2, product deep dive (45 min): walk us through something you owned end to end. How it got defined, what you cut, and how you knew it was finished
- Stage 3, challenge at the office (2 hours, 15 min chat before, 45 min after): four short tasks on real situations from our current quarter: unblock a decision, write acceptance criteria, cut the cost of delivery, one AI move. Afterwards we show you what we actually did and you tell us what is wrong with it
- Stage 4 (conditional): culture and first-90-days plan with Olmo

? APPLY HERE - [https://tally.so/r/lbG7ZX]

📌 Product Lead (Barcelona)
🏢 Qalea
📍 Barcelona