Consultant Manager Cyber Operate Third Party Risk Assessor

About Deloitte

Deloitte is one of the largest professional services firms globally, recognized for its impact on clients, people, and society. The firm has received multiple awards, including Best Employer in the Middle East and Best Consulting Firm. Deloitte focuses on delivering innovative insights, solving complex challenges, and fostering sustainable growth while upholding integrity and supporting communities.

The Role: Consultant Manager, Cyber Operate Third Party Risk Assessor

Deloitte is seeking a Consultant Manager, Cyber Operate Third Party Risk Assessor, for a full-time position in Riyadh, Saudi Arabia. This role requires 2-5 years of experience and involves developing and demonstrating capabilities in third-party and supply chain cybersecurity risk management.

Key Responsibilities

• Design and maintain the Third-Party Risk Management (TPRM) framework, including scope, roles, RACI, risk tiering, assessment depth, and risk rating methodology.
• Develop and maintain third-party cybersecurity policies, processes, procedures, and SOPs for each lifecycle stage (intake, tiering, due diligence, contracting, onboarding, monitoring, reassessment, issue management, exceptions, offboarding).
• Build supporting toolkits such as tiered questionnaires, evidence checklists, assessment templates, and standard contract clauses.
• Integrate TPRM steps into procurement and contract management processes to ensure cybersecurity assessments for high-risk suppliers.
• Define and monitor TPRM KPIs and KRIs, regularly updating the framework based on new NCA requirements, incidents, and lessons learned.
• Manage the third-party risk lifecycle, including tiering third parties by inherent risk, conducting due diligence, periodic reassessments, and secure offboarding.
• Assess third parties by reviewing security questionnaires, evidence (*, ISO/IEC 27001, SOC 2 reports, penetration tests), and conducting remote or on-site assessments for high-risk suppliers.
• Assess cloud and SaaS providers against NCA CCC and cloud security best practices, and evaluate contractors with access to IT and OT systems.
• Manage supply chain cybersecurity risk by mapping critical supply chains, setting requirements for secure software and hardware development, and ensuring critical suppliers have tested incident response plans.
• Define standard cybersecurity and data protection clauses with Procurement and Legal, reviewing contracts to ensure risk findings are reflected in conditions.
• Track and monitor supplier remediation actions, continuously monitor critical suppliers for breaches, and maintain the third-party inventory and risk register.
• Report third-party and supply chain risk posture to management and integrate results into the enterprise cyber risk register.

Leadership Capabilities

• Understand Deloitte's purpose and values, exploring opportunities for impact.
• Demonstrate commitment to personal learning and development, acting as a brand ambassador.
• Understand expectations and maintain personal accountability for performance.
• Develop effective communication and relationship-building skills.
• Understand how daily work contributes to team and business priorities.

Work Environment

This is a full-time position based in Riyadh, Saudi Arabia, within a professional services environment. The role involves collaboration across various internal teams and external third parties.

Application Process

Candidates interested in this role are encouraged to apply. Salary details will be discussed during the interview process.