• Übernahme der 360°-Verantwortung für das OT-Security-Produktportfolio über den gesamten Produktlebenszyklus (Launch, Wachstum, Reife, Phase-out) • Entwicklung und Pflege der Produktvision, -strategie und -roadmap für OT-Security-Lösungen • Weiterentwicklung bestehender Produkte sowie Aufbau neuer Lösungen (Greenfield) für kritische Infrastrukturen und weitere Segmente • Strategische Ausrichtung des Portfolios unter Berücksichtigung von Markttrends und regulatorischen Entwicklungen (z. B. NIS2, IEC 62443) • Enge Zusammenarbeit mit Marketing, Sales und Pre-Sales zur Markteinführung und Positionierung • Aufbau und Pflege nachhaltiger Beziehungen zu Partnern und Lieferanten auf CXO-Ebene, inklusive Vertragsverhandlungen • Kontinuierliche Markt-, Wettbewerbs- und Trendanalyse im Bereich OT/ICS-Security • Enge Zusammenarbeit mit Engineering-Teams zur Bewertung technischer Machbarkeit und Innovationspotenzial

Role Description We are seeking a CyberSecurity Transformation Lead (Enterprise Delivery) to join our team. This is an individual contributor (IC) role within the Office of the Chief Information Security Officer (CISO) Transformation Office, focused on programme leadership, execution management, and cross-functional coordination. You will drive complex, multi-workstream cybersecurity initiatives, bringing strong execution discipline, managing dependencies, and ensuring alignment across both technical and business stakeholders. Your ability to drive accountability, maintain momentum, and provide clear, decision-oriented insight to leadership will be key to success in this role. This is an opportunity to operate at the centre of cybersecurity transformation, directly contributing to how large-scale initiatives are delivered across the organization. Key Responsibilities - Program Delivery & Execution - Lead delivery of complex cybersecurity programs across multiple workstreams, ensuring alignment to enterprise priorities. - Develop and manage integrated program plans, including milestones, dependencies, and critical path. - Drive recovery plans ("go-to-green" plans) for at-risk initiatives, ensuring clear timelines and leadership visibility. - Maintain strong execution discipline, ensuring predictable and high-quality delivery. - Enterprise Program Delivery - Lead delivery of strategic cybersecurity initiatives across a range of domains, including enterprise platforms, risk management, and regulatory programs where applicable. - Coordinate implementation of cross-functional initiatives, ensuring alignment across technical and business teams. - Manage program delivery across LRE, GRC, and SOC2 initiatives. - LRE remediation and risk reduction efforts. - GRC programs including policy, control, and risk management processes. - SOC2 audit readiness, control implementation, and remediation activities as part of broader programme delivery. - Contribute to regulatory and audit-related programmes (e.g., SOC 2 – System and Organization Controls 2 compliance) where required within the portfolio. - Execution Management & Coordination - Manage dependencies, risks, and alignment across Cybersecurity, IT, and business stakeholders. - Track and drive accountability across delivery teams and partners. - Ensure clear ownership and alignment across complex, shared initiatives. - Reporting & Governance - Produce concise, decision-oriented updates for senior leadership. - Maintain accurate programme dashboards, including milestones, delivery status, risks, and performance metrics. - Replace internal-only reporting formats with clear, standard executive reporting formats. - Improve transparency and quality of programme reporting. - Risk, Issue & Dependency Management - Implement structured tracking of programme risks, issues, dependencies, and actions (RAID – Risks, Actions, Issues, Dependencies). - Proactively identify and resolve systemic blockers impacting delivery. - Ensure clear ownership and timely resolution of programme risks and issues. - Cross-Functional Leadership - Align Cybersecurity, IT, and business stakeholders on priorities, ownership, and execution approach. - Act as a central coordination point across multi-team, enterprise initiatives. - Build strong working relationships to enable effective collaboration and decision-making. Qualifications - 8+ years of experience in programme or project management within cybersecurity, IT, or enterprise environments. - Proven track record of delivering large-scale, complex programmes end-to-end. - Strong expertise in programme execution, governance, dependency management, and delivery discipline. - Experience producing executive-level reporting and supporting governance forums. - Demonstrated ability to manage complex, cross-functional initiatives in highly matrixed environments. - Strong communication and stakeholder management skills. - Bachelor's degree in any field relating to Information Technology, Business, Program Management, Cybersecurity or related field required. - Experience supporting cybersecurity, risk, or compliance-related programs (e.g., GRC or audit readiness initiatives). - Familiarity with regulatory frameworks such as SOC 2 or similar standards. - Experience working across enterprise risk or third-party environments. - Advanced degree (e.g., MBA, MSc in Cybersecurity or related field). - Programme management certifications (e.g., PMP, PgMP). - Cybersecurity certifications (e.g., Certified Information Security Manager – CISM). - Cloud or identity-related certifications (e.g., Microsoft, AWS, Azure). Benefits - Health & Wellbeing: Comprehensive suite of benefits that supports physical, financial and emotional wellbeing. - Personal & Professional Development: Specific programs catered to helping you reach any career goals you have. - Unconditional Inclusion: We celebrate individual uniqueness and have the flexibility to manage work and personal needs.

• Lead delivery of complex cybersecurity programs across multiple workstreams, ensuring alignment to enterprise priorities. • Develop and manage integrated program plans, including milestones, dependencies, and critical path. • Drive recovery plans ( "go-to-green" plans ) for at-risk initiatives, ensuring clear timelines and leadership visibility. • Maintain strong execution discipline, ensuring predictable and high-quality delivery. • Lead delivery of strategic cybersecurity initiatives across a range of domains, including enterprise platforms, risk management, and regulatory programs where applicable. • Coordinate implementation of cross-functional initiatives, ensuring alignment across technical and business teams. • Manage program delivery across LRE, GRC, and SOC2 initiatives. • Contribute to regulatory and audit-related programmes (e.g., SOC 2 – System and Organization Controls 2 compliance) where required within the portfolio. • Track and drive accountability across delivery teams and partners. • Produce concise, decision-oriented updates for senior leadership. • Maintain accurate programme dashboards, including milestones, delivery status, risks, and performance metrics. • Implement structured tracking of programme risks, issues, dependencies, and actions (RAID – Risks, Actions, Issues, Dependencies).

• Design, implement, and maintain enterprise application allowlisting policies in IT and OT environments • Implement and manage AppLocker policies for Windows environments • Deploy and tune Microsoft Defender Application Control (WDAC / App Control for Business) • Deploy and manage Red Hat fapolicyd for Linux systems • Define trusted sources using publisher, hash, and path rules • Integrate logs into SIEM tools such as Splunk for monitoring and alerting • Develop automation using Group Policy, Intune, and Ansible • Reduce attack surface by enforcing default-deny execution controls • Collaborate with multiply teams to onboard systems and software into allowlisting • Support governance boards (ARB, TRB, CAB) and documentation requirements • Deliverables Allowlisting policy framework and standards AppLocker, WDAC, and fapolicyd configurations Automation scripts and deployment guides Documentation for audits and compliance Metrics and reporting on allowlisting effectiveness Consult with project team and other stakeholders, e.g., IT practitioners, the Cybersecurity and Compliance teams, Enterprise Architecture, Applications, Infrastructure, Network, Database, OCM, etc. during testing and implementation. All changes will follow the Change management policies and procedures.