Consultant Manager Cyber Operate Cybersecurity Risk Specialist

About Deloitte

Deloitte is one of the largest professional services firms globally, recognized for its impact on clients, people, and society. The firm focuses on delivering innovative insights, solving complex challenges, and fostering sustainable growth. Deloitte is committed to an inclusive and collaborative culture, providing an exceptional career experience for its professionals.

The Role of Consultant Manager, Cyber Operate Cybersecurity Risk Specialist

This full-time position is for a Consultant Manager specializing in Cyber Operate Cybersecurity Risk, based in Riyadh, Saudi Arabia. The role involves developing and demonstrating capabilities in cybersecurity risk management, aligning with enterprise risk frameworks and industry standards. Candidates should have 5-10 years of relevant experience.

Key Responsibilities

• Design the cybersecurity risk management framework and methodology, including risk taxonomy, asset and impact criteria, likelihood scales, risk matrix, and scoring rules.
• Define risk appetite and tolerance statements for cyber risk with leadership, ensuring alignment with the enterprise risk management (ERM) framework and ISO 31000.
• Develop risk management policies, procedures, and templates, covering risk acceptance, exceptions, and escalation thresholds.
• Align the framework with NCA ECC risk management requirements, ISO/IEC 27005, and NIST SP 800-30.
• Conduct enterprise-level cyber risk assessments, identifying top risks and scenarios (*, ransomware, data breach, payment fraud, service outage, OT disruption) with business and technology leaders.
• Perform risk assessments for critical systems, new projects, and major changes prior to deployment, and agree on treatment plans with owners.
• Assess the risk of adopting new technologies such as cloud services, AI, and IoT platforms, recommending conditions for safe use.
• Integrate findings from vulnerability management, penetration testing, OT security, third-party risk, and threat intelligence into a unified risk view.
• Facilitate risk workshops to gather input from business owners and challenge risk ratings.
• Maintain the cyber risk register, including owners, ratings, treatment plans, due dates, and status.
• Track treatment plans to completion, reassess residual risk, and escalate overdue or rising risks.
• Manage the risk acceptance and exception process, ensuring justifications, appropriate approval levels, and time limits.
• Define and monitor key risk indicators (KRIs) and thresholds in collaboration with the Performance Management team.
• Produce clear risk reports and heat maps for management and the risk committee, explaining changes, their significance, and required decisions.
• Introduce quantitative risk analysis (*, FAIR) for top risks to express exposure in financial terms.
• Configure and operate risk workflows within GRC platforms (*, Archer, ServiceNow IRM, MetricStream).

Leadership Capabilities

• Develop an understanding of Deloitte's purpose and values, and explore opportunities for impact.
• Demonstrate commitment to personal learning and development, acting as a brand ambassador.
• Understand expectations and take personal accountability for performance.
• Focus on developing effective communication and relationship-building skills.
• Understand how daily work contributes to team and business priorities.

Experience Required

Candidates should possess 5-10 years of experience in a relevant field.

Work Environment

This is a full-time position located in Riyadh, Riyadh.