About the role
About XBOW At XBOW, we’re redefining the future of cybersecurity by building the world's first autonomous pentester, powered by AI. Today, the gold standard for securing software systems is human pentesters, but with the rise of artificial intelligence, we’re stepping up to scale offensive security to meet the ever-growing demand. AI is transforming the landscape of both cybersecurity and cyberattacks. While millions of people without security expertise are creating software, bad actors are using AI to launch more effective attacks. XBOW fights back with AI-driven superpowers, enabling security teams to stay one step ahead. Backed by Sequoia Capital and Altimeter, and a team that includes the creators of GitHub Copilot and GitHub Advanced Security, XBOW is not just keeping up with the times—we’re shaping the future of cybersecurity. Our mission is simple: to defeat the bad actors before they strike, using AI to revolutionize how we approach offensive security. We’re building something that must be built, and we’re the team to do it. Join us in shaping the next frontier of autonomous security. About This Role XBOW has a product that customers use in high-stakes security workflows, and we're at the beginning of understanding how. We have the foundation: we're instrumenting frontend events and capturing the basics. What we don't have is someone who owns this end-to-end - from defining what to measure, to building the pipelines that capture it, to surfacing insights that actually change what we build. This role exists to make the product team genuinely data-informed. Right now, key questions - which features drive retention, where users drop off in setup flows, whether a new capability is being adopted - don't have clear answers. You'll change that: not by producing reports nobody reads, but by building the instrumentation, dashboards, and data models that make product usage legible to the people who need it. You'll need to work across the full stack. Some of what matters happens in the browser; a lot of it happens server-side - assessments running, findings generated, integrations triggered. You'll extend our existing frontend instrumentation, build out server-side event tracking, and design the data layer that connects user actions to product outcomes. This means working closely with engineers to get events emitted correctly, and with Product Managers (PMs) to make sure you're measuring things that matter. This is not a "service" role where you wait for requests and produce dashboards, instead you'll be a key member of the product team. You'll need to have opinions about what's worth tracking, push back when someone asks for a vanity metric, and proactively surface patterns the product team hasn't thought to look for. If you want to be the person who makes a product team genuinely data-informed - not just data-adjacent - this is the role. What You'll Do Own product analytics end-to-end - From event taxonomy and instrumentation through to dashboards and insight delivery. You're responsible for the full pipeline, not just one layer of it Build and extend instrumentation - We have frontend event tracking in place. You'll improve it, add server-side event capture, and ensure our event taxonomy is consistent, complete, and actually useful Design dashboards PMs use daily - Build views that answer the questions product managers ask most: feature adoption, user engagement, conversion through key flows, retention signals. Define what we measure and why - Create and maintain our event taxonomy and measurement framework. Decide what's worth tracking, what's noise, and how events map to the outcomes we care about Surface insights proactively - Don't wait for someone to ask. Spot usage patterns, adoption trends, and drop-off points, and bring them to the product team with context Enable self-service analysis - Build data models, saved queries, and documentation so PMs and other stakeholders can explore usage data without filing a request every time Maintain data quality and trust - Instrument tests, monitor event pipelines, and fix issues before anyone notices the numbers are wrong. Analytics that people don't trust are worse than no analytics What You've Done Built product analytics systems from early stage - you've defined event taxonomies, instrumented applications, and created dashboards that product teams relied on for real decisions Worked with event-based analytics platforms like Amplitude, Mixpanel, PostHog, or Heap - not just consumed dashboards, but configured the platform, defined events, and managed the data pipeline Implemented both client-side and server-side event tracking - you understand the difference, the trade-offs, and when each is appropriate Written code to ship instrumentation - whether that's TypeScript on the frontend, Python or Node.js on the backend, or SQL for data modelling. You're not asking engineers to implement your specs; you're committing code yourself Designed metrics and dashboards that changed how a product team operated - you can point to a specific decision that was made differently because of something you built Worked in a startup or high-growth environment where you had to prioritize ruthlessly - you know the difference between "interesting to know" and "need to know to ship" What Sets You Apart You think in user journeys, not isolated events. You don't just count clicks - you understand what sequence of actions leads to a successful outcome and instrument accordingly You have strong opinions about data quality. You'd rather have 10 well-defined, trustworthy events than 200 noisy ones You can work across the stack. You're comfortable reading frontend component code to understand what to track and backend service code to understand what actually happened You know the difference between a metric and an insight. You don't just report that activation dropped 5% - you dig into why and bring a hypothesis You're technical enough to ship code but product-minded enough to know what's worth measuring. You've seen analytics implementations that track everything and answer nothing, and you know how to avoid that You communicate clearly with non-technical stakeholders. Your dashboards have context, your insights have recommendations, and your event names make sense to someone who didn't write them Our Stack (for this role) Event-based analytics platform - you'll help evaluate and own the choice TypeScript / React - frontend application where client-side events are captured Node.js / Fastify - backend services where server-side events need to be added PostgreSQL - primary database GitHub (Issues, Projects, Actions) Gong, Salesforce - customer feedback sources you'll occasionally pull from to correlate usage with sentiment What We Offer: Compensation & Equity : Competitive salary, clear performance-based incentives, and equity package, making you an integral part of XBOW’s growth story. Career Growth : Significant opportunities to progress within the sales organization and shape your career trajectory as we scale. Meaningful Work : You’ll directly impact XBOW’s mission to revolutionize cybersecurity and protect organizations worldwide. What else you should know Location: Remote (all team members are remote but we meet regularly and you’re supported to travel to collaborate with colleagues in person) Contract: Full-time. Hiring Process: 45-min introductory chat with our Head of Talent, Zac Wallis. 45 minutes with the team. Take home assessment. Presentation of take home assessment to product team. 30-min final meeting with our Head of Product, Aqeel Siddiqui. We aren't focused on seniority titles at XBOW - so if you’re worried about “levelling,” don’t be. We care a lot more about mission fit, capability, and impact than what’s on your LinkedIn headline. We believe in people who are driven by curiosity and a willingness to learn. Even if you don't check every box, we encourage you to apply if you're excited about the role and our mission.