Senior Consultant Manager Cyber Operate Application Security Specialist

About Deloitte

Deloitte is one of the largest professional services firms globally, recognized for its impact on clients, people, and society. The firm has received multiple awards, including Best Employer in the Middle East and Best Consulting Firm. Deloitte operates with shared values to deliver innovative insights and solve complex challenges for clients, while fostering an inclusive culture for its professionals.

The Role: Senior Consultant Manager, Cyber Operate Application Security Specialist

Deloitte is seeking a Senior Consultant Manager, Cyber Operate Application Security Specialist to join its team in Riyadh. This full-time role involves developing and demonstrating capabilities in application security, focusing on secure development standards, embedding security in CI/CD pipelines, conducting in-depth application assessments, and driving vulnerability remediation. The position requires 5-10 years of relevant experience.

Key Responsibilities

• Define secure SDLC, secure coding standards, and application security requirements, aligning with NCA ECC, OWASP ASVS, and NIST SSDF.
• Establish security requirements and acceptance criteria for in-house and vendor-built applications, including contract clauses and release checks.
• Build and maintain an application inventory with risk ratings for each application.
• Implement and tune SAST, DAST, SCA, and secrets scanning in CI/CD pipelines using tools such as Checkmarx, Fortify, Veracode, SonarQube, Snyk, and Burp Suite.
• Triage tool findings, remove noise, and provide clear, actionable guidance to developers to maintain release velocity.
• Review container, infrastructure-as-code, and cloud-native deployments with DevOps teams.
• Conduct application security assessments of web, mobile, and API applications, including manual testing of authentication, authorization, and business logic.
• Perform secure code reviews for high-risk features and components.
• Lead threat modeling for new applications and major changes, collaborating with architects and development teams.
• Review third-party and SaaS applications prior to adoption.
• Track application vulnerabilities to closure with development teams and vendors, verifying fixes before release.
• Report application risk posture and trends to management.
• Train developers on secure coding, OWASP Top 10, and API Security Top 10, and establish a network of security champions within development teams.

Leadership Capabilities

• Understand Deloitte's purpose and values, exploring opportunities for impact.
• Demonstrate commitment to personal learning and development, acting as a brand ambassador.
• Understand expectations and maintain personal accountability for performance.
• Actively develop effective communication and relationship-building skills.
• Understand how daily work contributes to team and business priorities.

Experience and Work Type

This role requires 5-10 years of experience in a relevant field. It is a full-time position based in Riyadh.

Application Process

Candidates interested in this role are encouraged to apply. Salary details will be discussed during the interview process.