Head of Cyber Defense & Trust

You MUST be located in one of our hub locations (San Francisco, Salt Lake City, Austin, New York City Metro, Chicago) due to our hybrid work model.

This is not a traditional security role.

You won't be inheriting a mature, stable program. You'll be architecting one for an AI-native SaaS company operating at scale, where the threat surface evolves daily and identity is the new perimeter. You will own two of the most consequential security domains in the business: Cyber Defense Engineering (CDE), the fusion of Security Engineering and Security Operations, and Identity and Access Management (IAM). These aren't siloed functions here. They are the foundation of customer trust, product integrity, and competitive advantage.

You'll operate at the intersection of builder and strategist: designing systems with your team, making architectural calls, and partnering at the executive level to ensure security is a force multiplier, not a speed bump.

What You'll Own

Lead Cyber Defense Engineering: Detect, Respond, and Automate at Scale
Design and operate a hyper-automated security operations function for a modern, multi-cloud (AWS, GCP, Azure) SaaS environment. You'll leverage advanced platforms, including Google SecOps, Wiz, Sentinel, and CrowdStrike, to achieve near real-time visibility and response across cloud infrastructure, while minimizing operational noise and maximizing signal fidelity. Your team won't just react to threats; they'll engineer the systems that make reactions near-automatic.

Secure the AI-Native Environment
Gong is an AI company, and that changes everything about your threat model. You'll architect security controls that address the unique risks of large-scale data pipelines, model training environments, and AI-generated intellectual property, domains where conventional frameworks fall short and first-principles thinking is required.

Build a Zero-Trust Identity Ecosystem
Own and execute the enterprise-wide IAM strategy, unifying identity management across all cloud platforms, corporate environments, and the product itself. You'll move beyond legacy controls to define a multi-year roadmap rooted in Zero Trust principles, cloud-native identity platforms, and passwordless authentication. Identity won't be an IT problem here; it will be a security architecture.

Translate Compliance into Security Outcomes
Partner with the broader security organization to ensure the technical foundation of Gong's cloud environment supports enterprise compliance requirements (SOC 2, ISO 27001, PCI, HIPAA, FedRAMP/NIST). You'll make compliance a natural output of strong security architecture, not a parallel workstream.

Build and Develop the Team
Recruit, develop, and lead a high-performing, globally distributed team of security engineers and identity architects. You build cultures where craft matters, feedback flows, and ownership is clear.

What You Bring

• 12–15+ years of progressive security experience, with meaningful leadership in a high-growth SaaS or cloud-native environment.
• Deep CDE expertise: hands-on background in Security Engineering and/or Security Operations, with experience designing detection pipelines, incident response playbooks, and automation frameworks at scale.
• Enterprise IAM mastery: proven track record designing and executing IAM strategies that span cloud platforms, SaaS applications, and corporate infrastructure, including Zero Trust architecture and passwordless or MFA-first approaches.
• Multi-cloud fluency: practical experience securing workloads across AWS, GCP, and/or Azure, and familiarity with modern CSPM, SIEM/SOAR, and endpoint security tooling (e.g., Wiz, Google SecOps, Sentinel, CrowdStrike).
• Compliance and risk fluency: working knowledge of NIST CSF, NIST 800-53, SOC 2, and related frameworks, and the ability to turn them into security architecture decisions, not just documentation.
• Builder mentality with executive presence: you can write a detection rule and present a board-ready risk summary. You don't choose between technical credibility and strategic communication, you bring both.