Consultant Manager Cyber Operate Third Party Risk Assessor

About Deloitte

Deloitte is a global professional services firm recognized for its impact on clients, people, and society. The firm has received awards including Best Employer in the Middle East and Best Consulting Firm. Deloitte focuses on delivering innovative insights, solving complex challenges, and fostering sustainable growth through its talented professionals and a culture of inclusion and collaboration.

The Role: Consultant Manager Cyber Operate Third Party Risk Assessor

Deloitte is seeking a Consultant Manager Cyber Operate Third Party Risk Assessor to join its team in Riyadh, Saudi Arabia. This full-time role requires 2-5 years of experience and involves developing and managing third-party and supply chain cybersecurity risk management frameworks. The successful candidate will contribute to building confidence and trust in markets by upholding organizational integrity and supporting communities.

Key Responsibilities

• Design and maintain the Third-Party Risk Management (TPRM) framework, including scope, roles, RACI, risk tiering, assessment depth, and risk rating methodology.
• Develop and maintain third-party cybersecurity policies, processes, procedures, and SOPs for each lifecycle stage.
• Build supporting toolkits such as tiered questionnaires, evidence checklists, assessment templates, and standard contract clauses.
• Embed TPRM steps into procurement and contract management processes to ensure cybersecurity assessments for high-risk suppliers.
• Define TPRM KPIs and KRIs, and regularly update the framework based on new requirements, incidents, and lessons learned.
• Manage the third-party risk lifecycle, including tiering, due diligence, periodic reassessments, and secure offboarding.
• Assess third parties by reviewing security questionnaires, evidence (*, ISO/IEC 27001, SOC 2 reports), and conducting remote/on-site assessments.
• Manage supply chain cybersecurity risk by mapping critical supply chains, setting requirements for secure development, and ensuring incident response plans.
• Define and review standard cybersecurity and data protection clauses in contracts with Procurement and Legal.
• Track supplier remediation actions, monitor critical suppliers, maintain the third-party inventory and risk register, and report risk posture to management.

Leadership Capabilities

• Demonstrates an understanding of the firm's purpose and values, seeking opportunities for impact.
• Commits to personal learning and development, acting as a brand ambassador.
• Understands expectations and takes accountability for performance.
• Develops effective communication and relationship-building skills.
• Understands how daily work contributes to team and business priorities.

Experience Required

Candidates should possess 2-5 years of relevant experience in cyber security, third-party risk management, or a related field. The role requires a strong understanding of cybersecurity frameworks and practices, particularly in assessing and managing risks associated with third-party vendors and supply chains.

Work Environment

This is a full-time position based in Riyadh, Riyadh, Saudi Arabia. The role involves working within a collaborative culture focused on delivering value to clients and contributing to society.