Consultant Manager Cyber Operate Vulnerability Management Specialist

About Deloitte

Deloitte is one of the largest professional services firms globally, recognized for its impact on clients, people, and society. The firm has received awards such as Best Employer in the Middle East and Best Consulting Firm. Deloitte focuses on delivering innovative insights, solving complex challenges, and fostering sustainable growth, guided by shared values that aim to create a positive and enduring impact.

Role Overview

Deloitte is seeking a Consultant Manager, Cyber Operate Vulnerability Management Specialist, to join its team in Riyadh, Saudi Arabia. This full-time role requires 5-10 years of experience and involves demonstrating and developing capabilities in vulnerability management within a professional services environment. The specialist will contribute to building confidence and trust in markets and supporting communities through robust cybersecurity practices.

Key Responsibilities

• Conduct vulnerability assessments across various environments, including corporate, data-center, DMZ, wireless, guest-facing, and partner-connected networks, as well as internal and internet-facing perimeters.
• Assess cloud platforms such as Azure, AWS, and GCP, covering workloads, configuration, and identity settings against CIS benchmarks and NCA CCC, and scan container images and Kubernetes clusters.
• Evaluate Windows and Linux servers, endpoints, databases, virtualization platforms, and network and security devices, including configuration and hardening checks against approved baselines.
• Assess web applications, APIs, and mobile app back-ends using authenticated DAST scanning, collaborating with the Application Security team for in-depth testing.
• Perform assessments on new systems before go-live, after major changes, and conduct targeted assessments upon request.
• Produce clear assessment reports detailing risk-rated findings, evidence, and practical remediation steps for each asset owner.
• Operate and tune scanning platforms (*, Tenable, Qualys, Rapid7), managing scan policies, credentials, schedules, and agents.
• Ensure scan coverage aligns with the asset inventory and CMDB, identifying and addressing blind spots, including new and unmanaged assets.
• Collaborate with the OT team to establish safe and approved methods for assessing industrial and building systems.
• Prioritize vulnerabilities using CVSS, EPSS, CISA KEV, asset criticality, exposure, and threat intelligence to focus remediation efforts on the highest-risk issues.
• Validate critical findings and filter out false positives before they reach IT teams.
• Track emerging threats and zero-days, conducting rapid exposure checks and issuing clear advisories.
• Agree on remediation plans and deadlines with IT, cloud, and application owners, ensuring their completion through persistent follow-up and effective working relationships.
• Verify fixes by rescanning and manage the exception and risk-acceptance process with proper justification and expiry dates.
• Govern patch management in line with NIST SP 800-40, working with infrastructure teams.
• Define vulnerability management policy, procedure, scan schedules, and remediation SLAs in line with NCA ECC.
• Build dashboards and KPIs (SLA compliance, aging, coverage, risk trend), and produce monthly reports for management.
• Automate scanning, ticketing, and reporting where feasible (*, Python, APIs, ServiceNow integration).
• Share findings with the Penetration Testing, SOC, and Risk teams to maintain a current overall risk picture.

Leadership Capabilities

• Develop an understanding of Deloitte's purpose and values, exploring opportunities for impact.
• Demonstrate a strong commitment to personal learning and development, acting as a brand ambassador to attract talent.
• Understand expectations and show personal accountability for maintaining performance.
• Actively focus on developing effective communication and relationship-building skills.
• Understand how daily work contributes to team and business priorities.

Qualifications and Experience

• 5-10 years of relevant professional experience.
• Demonstrated capability in vulnerability assessments across networks, cloud platforms, systems, and applications.
• Experience with scanning platforms such as Tenable, Qualys, or Rapid7.
• Proficiency in prioritizing vulnerabilities using industry standards like CVSS, EPSS, and CISA KEV.
• Experience in driving remediation efforts and governing patch management.
• Ability to define and report on vulnerability management programs, including policy, procedures, and KPIs.

Work Environment

This is a full-time position based in Riyadh, Saudi Arabia, offering an inclusive and collaborative culture within a leading professional services firm.