AI Product Manager: San Diego

Hire an AI product manager in San Diego.

San Diego's two largest software sectors (biotech SaaS and defense tech) share one problem with AI features: the constraints that govern them are written into law before a line of code is written. At Illumina, Benchling customers, and lab informatics startups, adding an AI feature to a regulated product triggers FDA Software as a Medical Device classification questions. At SAIC, Leidos, and defense tech companies, every AI vendor integration decision has FedRAMP and CMMC consequences.

A general-purpose AI PM will not catch these constraints. An engineer who understands the domain will catch them late. A fractional AI PM who has worked in both sectors catches them in the product spec, before engineering starts.

Fixed engagement: 4–8 weeks, defined deliverables.

How we work

Tell us about your biotech or defense AI product challenge.

Who this is for.

Biotech SaaS: VP of Product at a lab informatics company

Your product touches regulated laboratory workflows. A Veeva Systems customer, a Benchling-adjacent startup, or an in-house informatics team at a genomics company. You want to add AI features: auto-suggesting protocol steps, flagging anomalous results, generating analysis narratives. Each of those features requires a product spec that your validation team can trace to a user requirement and your compliance team can map to 21 CFR Part 11.

An AI PM who doesn't know what IQ/OQ/PQ means will write a spec your validation team will reject. We write specs that pass validation review because we understand what audit trails, access controls, and intended-use boundaries need to say.

Defense tech: Product lead at a company building software for government customers

SAIC digital, Leidos software teams, and defense-adjacent startups building products that process government data face a different constraint. Every AI vendor integration decision is a compliance decision. Can this LLM API process CUI? What FedRAMP authorization level does it have? Does CMMC Level 2 or 3 apply to this product?

These are questions the product spec must answer before engineering picks a vendor. If the spec doesn't address them, the engineering team picks the most capable AI vendor without checking compliance status, and then rebuilds after the security review.

FDA SaMD classification in the product spec.

The FDA's Software as a Medical Device framework applies to AI features that inform clinical decisions. Getting the classification wrong costs more than getting it right upfront.

SaMD classification before the feature is built

An AI feature that suggests a downstream lab test based on genomics results may qualify as Class II SaMD. The product spec must capture this determination before engineering starts, because the classification affects the required clinical validation dataset, the audit trail requirements, and the labeling. Illumina's software team carries this determination in their design history file. A spec that skips it creates a retroactive compliance burden.

21 CFR Part 11 audit trail requirements

Any AI feature in an electronic records environment covered by 21 CFR Part 11 requires an audit trail that captures model version, input data, output, user identity, and timestamp. The spec must define the audit trail schema before the engineering team designs the data model. Adding it afterward requires schema migrations and re-validation.

Confidence threshold as a product requirement

A lab informatics AI feature that surfaces a suggestion to a scientist needs a defined confidence threshold: below this score, the suggestion is not displayed. Above it, the suggestion is displayed with the score visible to the user. This threshold belongs in the product spec, not the model training documentation. It is a product decision with compliance implications.

Validation protocol alignment

Software validation protocols for regulated products require that each system behavior map to a user requirement. The AI feature spec must be written in a format the validation team can trace: specific inputs, expected outputs, acceptance criteria. A spec written as a user story without acceptance criteria will not pass IQ/OQ/PQ review at a Benchling customer.

FedRAMP and CMMC constraints in the product spec.

Defense tech companies at the AI-feature stage often discover compliance constraints after vendor selection. An engineering team evaluates GPT-4 for a document extraction feature, builds a prototype, and then learns that the API is not FedRAMP authorized for the data classification they need. The spec should have caught this in week one.

A product spec for a defense tech AI feature includes a data classification section that defines the CUI boundary. Which data flows to the AI vendor? Which stays on-premise? Which is transformed before it leaves the network? These questions have technical answers, but they require a product decision first.

CMMC Level 2 requires that CUI be processed only in environments meeting NIST SP 800-171 controls. For an AI feature that summarizes contract documents at a Leidos subsidiary, the spec must identify whether contract text qualifies as CUI, which vendor has a compliant deployment option, and what the performance trade-off is against non-compliant alternatives.

That trade-off belongs in the product spec, not in an email chain between engineering and security six months later.

How we work.

1
Discovery call (1 hour)
We map the AI feature you're building, the regulatory environment it operates in, and which constraints your engineering team has already encountered. We quote a fixed price at the end of this call.
2
Spec and constraint mapping (weeks 1–3)
We interview your product, engineering, and compliance teams. We write the product spec with the regulatory constraints built in from the start: SaMD classification, audit trail schema, confidence thresholds, data classification boundary, and vendor compliance status.
3
Build support and review (weeks 4–8)
We answer engineering questions, review build progress against the spec, and prepare the validation or compliance documentation your team needs to close the feature. The engagement ends with a deliverable set your team can work from.

Questions from San Diego clients.

What 21 CFR Part 11 requirements need to be in a lab informatics AI product spec. What exactly needs to be in the audit trail?: A 21 CFR Part 11-compliant audit trail for an AI feature in lab informatics software must record: the specific model version that produced each output, the input data the model received, the timestamp of every inference call, the user identity who triggered the call, any modification or override applied to the model output, and whether the record was generated automatically or by a human. The spec must also define the retention period and the access controls that prevent audit trail records from being altered. Benchling and similar platforms expect this level of specificity before a validation protocol review. A vague spec that says "log AI decisions" will not pass IQ/OQ/PQ review.
How do you write a product spec for an AI feature in a way that satisfies a software validation protocol?: A validation-compatible AI product spec has three properties a standard spec does not. First, it defines acceptance criteria in measurable terms: the model must produce output X when given input Y, under condition Z. Second, it identifies the intended use environment: which users, which workflows, which data types the AI feature is designed for, and which it is explicitly not designed for. Third, it maps each AI behavior to a user requirement that traces back to a design input. Illumina's validation team, for example, will reject a spec that states "the AI suggests the next pipeline step" without defining the accuracy requirement, the confidence threshold for display, and the failure mode if the model returns a low-confidence output. The spec must answer those questions before the validation protocol is written, not after.
What FedRAMP authorization level is required for AI features that process controlled government data?: FedRAMP Moderate is the baseline for most AI features that process Controlled Unclassified Information in cloud-hosted defense tech products. FedRAMP High applies when the data includes law enforcement sensitive or health information under specific FISMA categories. The practical implication for product specs is that every AI vendor integration must use a FedRAMP-authorized service, which eliminates most general-purpose LLM APIs unless they have achieved authorization. SAIC and Leidos digital products teams evaluate AI vendor integrations against the FedRAMP marketplace before engineering evaluates technical fit. The product spec must capture the authorization status of each vendor being considered, because it determines what can actually be built.
How does CMMC level affect what AI vendors a defense tech company can use in their product?: CMMC Level 2 requires that Controlled Unclassified Information be processed only in environments that meet NIST SP 800-171 controls. Most commercial AI APIs process data on shared infrastructure that does not meet these controls. CMMC Level 3 requirements are more restrictive. For a defense tech company building AI features into a product that handles CUI, the product spec must define a data classification boundary: which AI processing occurs on CUI, which occurs on non-CUI, and how the boundary is enforced at the API layer. If the AI feature crosses that boundary, the vendor must have a CUI-compliant deployment option. The spec must document this before engineering picks a vendor, because switching vendors after the architecture is built adds months.

Start with the product spec, not the code.

Tell us the AI feature you're building and the regulatory environment it operates in. We'll respond within one business day with a scope and price range.

Hire an AI product manager in San Diego.

Fixed engagement: 4–8 weeks, defined deliverables.

Who this is for.

Biotech SaaS: VP of Product at a lab informatics company

Defense tech: Product lead at a company building software for government customers

FDA SaMD classification in the product spec.

The FDA's Software as a Medical Device framework applies to AI features that inform clinical decisions. Getting the classification wrong costs more than getting it right upfront.

SaMD classification before the feature is built

21 CFR Part 11 audit trail requirements

Confidence threshold as a product requirement

Validation protocol alignment

FedRAMP and CMMC constraints in the product spec.

That trade-off belongs in the product spec, not in an email chain between engineering and security six months later.

How we work.

Discovery call (1 hour)

We map the AI feature you're building, the regulatory environment it operates in, and which constraints your engineering team has already encountered. We quote a fixed price at the end of this call.

Spec and constraint mapping (weeks 1–3)

We interview your product, engineering, and compliance teams. We write the product spec with the regulatory constraints built in from the start: SaMD classification, audit trail schema, confidence thresholds, data classification boundary, and vendor compliance status.

Build support and review (weeks 4–8)

We answer engineering questions, review build progress against the spec, and prepare the validation or compliance documentation your team needs to close the feature. The engagement ends with a deliverable set your team can work from.

Questions from San Diego clients.

What 21 CFR Part 11 requirements need to be in a lab informatics AI product spec. What exactly needs to be in the audit trail?

A 21 CFR Part 11-compliant audit trail for an AI feature in lab informatics software must record: the specific model version that produced each output, the input data the model received, the timestamp of every inference call, the user identity who triggered the call, any modification or override applied to the model output, and whether the record was generated automatically or by a human. The spec must also define the retention period and the access controls that prevent audit trail records from being altered. Benchling and similar platforms expect this level of specificity before a validation protocol review. A vague spec that says "log AI decisions" will not pass IQ/OQ/PQ review.

How do you write a product spec for an AI feature in a way that satisfies a software validation protocol?

A validation-compatible AI product spec has three properties a standard spec does not. First, it defines acceptance criteria in measurable terms: the model must produce output X when given input Y, under condition Z. Second, it identifies the intended use environment: which users, which workflows, which data types the AI feature is designed for, and which it is explicitly not designed for. Third, it maps each AI behavior to a user requirement that traces back to a design input. Illumina's validation team, for example, will reject a spec that states "the AI suggests the next pipeline step" without defining the accuracy requirement, the confidence threshold for display, and the failure mode if the model returns a low-confidence output. The spec must answer those questions before the validation protocol is written, not after.

What FedRAMP authorization level is required for AI features that process controlled government data?

FedRAMP Moderate is the baseline for most AI features that process Controlled Unclassified Information in cloud-hosted defense tech products. FedRAMP High applies when the data includes law enforcement sensitive or health information under specific FISMA categories. The practical implication for product specs is that every AI vendor integration must use a FedRAMP-authorized service, which eliminates most general-purpose LLM APIs unless they have achieved authorization. SAIC and Leidos digital products teams evaluate AI vendor integrations against the FedRAMP marketplace before engineering evaluates technical fit. The product spec must capture the authorization status of each vendor being considered, because it determines what can actually be built.

How does CMMC level affect what AI vendors a defense tech company can use in their product?

CMMC Level 2 requires that Controlled Unclassified Information be processed only in environments that meet NIST SP 800-171 controls. Most commercial AI APIs process data on shared infrastructure that does not meet these controls. CMMC Level 3 requirements are more restrictive. For a defense tech company building AI features into a product that handles CUI, the product spec must define a data classification boundary: which AI processing occurs on CUI, which occurs on non-CUI, and how the boundary is enforced at the API layer. If the AI feature crosses that boundary, the vendor must have a CUI-compliant deployment option. The spec must document this before engineering picks a vendor, because switching vendors after the architecture is built adds months.

Start with the product spec, not the code.

Tell us the AI feature you're building and the regulatory environment it operates in. We'll respond within one business day with a scope and price range.