Role Description We are seeking a CyberSecurity Transformation Lead (Enterprise Delivery) to join our team. This is an individual contributor (IC) role within the Office of the Chief Information Security Officer (CISO) Transformation Office, focused on programme leadership, execution management, and cross-functional coordination. You will drive complex, multi-workstream cybersecurity initiatives, bringing strong execution discipline, managing dependencies, and ensuring alignment across both technical and business stakeholders. Your ability to drive accountability, maintain momentum, and provide clear, decision-oriented insight to leadership will be key to success in this role. This is an opportunity to operate at the centre of cybersecurity transformation, directly contributing to how large-scale initiatives are delivered across the organization. Key Responsibilities - Program Delivery & Execution - Lead delivery of complex cybersecurity programs across multiple workstreams, ensuring alignment to enterprise priorities. - Develop and manage integrated program plans, including milestones, dependencies, and critical path. - Drive recovery plans ("go-to-green" plans) for at-risk initiatives, ensuring clear timelines and leadership visibility. - Maintain strong execution discipline, ensuring predictable and high-quality delivery. - Enterprise Program Delivery - Lead delivery of strategic cybersecurity initiatives across a range of domains, including enterprise platforms, risk management, and regulatory programs where applicable. - Coordinate implementation of cross-functional initiatives, ensuring alignment across technical and business teams. - Manage program delivery across LRE, GRC, and SOC2 initiatives. - LRE remediation and risk reduction efforts. - GRC programs including policy, control, and risk management processes. - SOC2 audit readiness, control implementation, and remediation activities as part of broader programme delivery. - Contribute to regulatory and audit-related programmes (e.g., SOC 2 – System and Organization Controls 2 compliance) where required within the portfolio. - Execution Management & Coordination - Manage dependencies, risks, and alignment across Cybersecurity, IT, and business stakeholders. - Track and drive accountability across delivery teams and partners. - Ensure clear ownership and alignment across complex, shared initiatives. - Reporting & Governance - Produce concise, decision-oriented updates for senior leadership. - Maintain accurate programme dashboards, including milestones, delivery status, risks, and performance metrics. - Replace internal-only reporting formats with clear, standard executive reporting formats. - Improve transparency and quality of programme reporting. - Risk, Issue & Dependency Management - Implement structured tracking of programme risks, issues, dependencies, and actions (RAID – Risks, Actions, Issues, Dependencies). - Proactively identify and resolve systemic blockers impacting delivery. - Ensure clear ownership and timely resolution of programme risks and issues. - Cross-Functional Leadership - Align Cybersecurity, IT, and business stakeholders on priorities, ownership, and execution approach. - Act as a central coordination point across multi-team, enterprise initiatives. - Build strong working relationships to enable effective collaboration and decision-making. Qualifications - 8+ years of experience in programme or project management within cybersecurity, IT, or enterprise environments. - Proven track record of delivering large-scale, complex programmes end-to-end. - Strong expertise in programme execution, governance, dependency management, and delivery discipline. - Experience producing executive-level reporting and supporting governance forums. - Demonstrated ability to manage complex, cross-functional initiatives in highly matrixed environments. - Strong communication and stakeholder management skills. - Bachelor's degree in any field relating to Information Technology, Business, Program Management, Cybersecurity or related field required. - Experience supporting cybersecurity, risk, or compliance-related programs (e.g., GRC or audit readiness initiatives). - Familiarity with regulatory frameworks such as SOC 2 or similar standards. - Experience working across enterprise risk or third-party environments. - Advanced degree (e.g., MBA, MSc in Cybersecurity or related field). - Programme management certifications (e.g., PMP, PgMP). - Cybersecurity certifications (e.g., Certified Information Security Manager – CISM). - Cloud or identity-related certifications (e.g., Microsoft, AWS, Azure). Benefits - Health & Wellbeing: Comprehensive suite of benefits that supports physical, financial and emotional wellbeing. - Personal & Professional Development: Specific programs catered to helping you reach any career goals you have. - Unconditional Inclusion: We celebrate individual uniqueness and have the flexibility to manage work and personal needs.

• Lead delivery of complex cybersecurity programs across multiple workstreams, ensuring alignment to enterprise priorities. • Develop and manage integrated program plans, including milestones, dependencies, and critical path. • Drive recovery plans ( "go-to-green" plans ) for at-risk initiatives, ensuring clear timelines and leadership visibility. • Maintain strong execution discipline, ensuring predictable and high-quality delivery. • Lead delivery of strategic cybersecurity initiatives across a range of domains, including enterprise platforms, risk management, and regulatory programs where applicable. • Coordinate implementation of cross-functional initiatives, ensuring alignment across technical and business teams. • Manage program delivery across LRE, GRC, and SOC2 initiatives. • Contribute to regulatory and audit-related programmes (e.g., SOC 2 – System and Organization Controls 2 compliance) where required within the portfolio. • Track and drive accountability across delivery teams and partners. • Produce concise, decision-oriented updates for senior leadership. • Maintain accurate programme dashboards, including milestones, delivery status, risks, and performance metrics. • Implement structured tracking of programme risks, issues, dependencies, and actions (RAID – Risks, Actions, Issues, Dependencies).

• Design, implement, and maintain enterprise application allowlisting policies in IT and OT environments • Implement and manage AppLocker policies for Windows environments • Deploy and tune Microsoft Defender Application Control (WDAC / App Control for Business) • Deploy and manage Red Hat fapolicyd for Linux systems • Define trusted sources using publisher, hash, and path rules • Integrate logs into SIEM tools such as Splunk for monitoring and alerting • Develop automation using Group Policy, Intune, and Ansible • Reduce attack surface by enforcing default-deny execution controls • Collaborate with multiply teams to onboard systems and software into allowlisting • Support governance boards (ARB, TRB, CAB) and documentation requirements • Deliverables Allowlisting policy framework and standards AppLocker, WDAC, and fapolicyd configurations Automation scripts and deployment guides Documentation for audits and compliance Metrics and reporting on allowlisting effectiveness Consult with project team and other stakeholders, e.g., IT practitioners, the Cybersecurity and Compliance teams, Enterprise Architecture, Applications, Infrastructure, Network, Database, OCM, etc. during testing and implementation. All changes will follow the Change management policies and procedures.

Role Description We’re looking for a full-time Manager, Offensive Security to join our team reporting to the Chief Security Officer. This role is a remote role based in the United States. In this role, you’ll play a key role by performing Red and Purple Team assessments, including: - Adversarial emulation of cyber attacks against customer organizations - External pen testing - Web application, mobile, and wireless security testing You will expand the team’s capabilities through: - Tool creation - Research on offensive techniques - Incorporation of threat actor intelligence - Internal presentations - Knowledge sharing This is a great opportunity for someone who thrives in a high performing growth environment and enjoys working cross-functionally with teams like engineering, IT, legal, and product. What You'll Do - Perform red and purple team assessments, assumed breach assessments, ransomware readiness reviews, threat analysis, and social engineering assessments. - Conduct external and internal wireless assessments, web and mobile applications testing, and embedded system assessments. - Recognize and safely utilize attacker tools, tactics, and procedures. - Develop comprehensive and accurate reports and presentations for both technical and executive audiences. - Perform offensive technical cyber security engagements of a varied nature. - This role may require occasional travel (up to 10%) for team meetings, training, or company events. - This is not a complete list of responsibilities, and the scope of the role may evolve with the needs of the team and business. Qualifications - 5-7 years of relevant experience (or equivalent combination of education and experience), including recent management experience required. - 5 years of experience with pen testing and red teaming functions, including network, web application, mobile, cloud, social engineering, scripting, or tool development. - Experience with tools used for wireless, web application, and network security testing. Nice-to-have Skills - Certifications related to offensive security including OSCE, OSEP, OSEE, OSCP, CCSAS, CCT, INF, or relevant SANS courses. - Experience implementing or assessing information security implementation or assessment of security controls. Benefits - The starting base salary range for this role is $145,000 - $165,000 USD annually. - This role is also eligible for commission based on performance and participation in Gainsight’s equity program. - Comprehensive benefits package including fully covered medical premiums (employee-only), flexible PTO, 401(k) plan, dental and vision coverage, and remote work options. - Additional benefits include a $10,000 lifetime fertility stipend and access to coworking spaces around the globe. - Dedicated Recharge Holidays - one long weekend each quarter to relax and reset. Company Description Gainsight is the AI-powered retention engine behind the world’s most customer-centric companies. The Gainsight CustomerOS platform orchestrates the customer journey from onboarding to outcomes to advocacy. More than 2,000 companies trust Gainsight’s applications and AI agents to drive learning, adoption, community connection, and success for their customers.