Consultant - Manager | Cyber Operate | Third-Party Risk Assessor | KSA

About Deloitte: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.

Our Purpose

Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.

Our shared values guide the way we behave to make a positive, enduring impact:

During your tenure as a Consultant Manager, you will demonstrate and develop your capabilities in the following areas

Design the third-party and supply chain cybersecurity risk management framework: scope, roles and RACI across Cybersecurity, Procurement, Legal and business owners, risk tiering model, assessment depth per tier, and risk rating methodology

Write and maintain the third-party cybersecurity policy, processes, procedures and SOPs for each lifecycle stage: intake, tiering, due diligence, contracting, onboarding, monitoring, reassessment, issue management, exceptions and offboarding

Build the supporting toolkit: tiered questionnaires, evidence checklists, assessment and report templates, standard contract clauses and supplier security requirements schedules

Embed TPRM steps into procurement and contract management processes, so no high-risk supplier is onboarded without a cybersecurity assessment

Define TPRM KPIs and KRIs (coverage, overdue assessments, open high-risk findings), and review and update the framework regularly to reflect new NCA requirements, incidents and lessons learned

Tier third parties by inherent risk, based on the data they handle, the systems they access, the service's criticality and their location

Run due diligence before onboarding and before contract renewal, scaled to the tier

Run periodic reassessments and manage secure offboarding, including access removal and return or deletion of data

Issue and review security questionnaires (e.g. SIG, CAIQ), and judge answers against evidence rather than accepting them at face value

Review evidence such as ISO/IEC 27001 certificates and scope, SOC 2 reports, penetration test summaries, policies and incident history, and spot gaps, exclusions and out-of-date documents

Carry out remote and on-site assessments of high-risk suppliers, including technical checks of how they protect the organisation's data and access

Assess cloud and SaaS providers against NCA CCC and cloud security good practice, including data residency, encryption, access control and shared-responsibility gaps

Assess contractors and integrators with remote or on-site access to IT and OT systems, working with the OT Security team

Review suppliers' external attack surface and security ratings (e.g. SecurityScorecard, BitSight) as additional evidence

Map critical supply chains, including the sub-contractors and fourth parties that critical suppliers rely on, and identify single points of failure and concentration risk (e.g. many services depending on one cloud provider or integrator)

Software supply chain: set requirements for secure development, software bills of materials (SBOM), open-source component risk, code signing and integrity of updates and patches, working with the Application Security team

Hardware and device supply chain: set requirements for the provenance, firmware integrity and secure configuration of IT, OT and IoT equipment delivered by vendors and integrators

Make sure critical suppliers have tested incident response, business continuity and exit plans, and agree how they will notify and work with the organisation during an incident

Coordinate the organisation's response to supplier breaches and supply-chain vulnerabilities: assess exposure quickly, contain access and track supplier actions

Apply NIST SP 800-161 and ISO/IEC 27036 good practice to supply chain risk management

Define standard cybersecurity and data protection clauses with Procurement and Legal: security requirements, right to audit, breach notification, sub-contractor controls, data location and PDPL obligations

Review contracts and statements of work for high-risk suppliers, and make sure risk findings are reflected in contract conditions

Track supplier remediation actions to closure, and escalate suppliers who don't act

Monitor critical suppliers continuously for breaches, rating drops and changes in their service

Maintain the third-party inventory and risk register in the TPRM platform (e.g. OneTrust, ProcessUnity, Archer, ServiceNow VRM)

Report third-party and supply chain risk posture, overdue assessments and high-risk suppliers to management, and feed results into the enterprise cyber risk register

Leadership Capabilities:

• Builds own understanding of our purpose and values; explores opportunities for impact.
• Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.
• Understands expectations and demonstrates personal accountability for keeping performance on track.
• Actively focuses on developing effective communication and relationship-building skills.
• Understands how their daily work contributes to the priorities of the team and the business.

Desired Candidate Profile

Qualifications:

Years of experience: 2- 8 years

Bachelor's in IT, cybersecurity or a related field

Hands-on experience assessing vendors' cybersecurity against ISO/IEC 27001, NIST or NCA requirements

Has designed or updated a TPRM framework, policy, procedures or SOPs (Senior); has contributed to them (Mid)

Able to read and challenge SOC 2 reports, ISO certificates and security evidence

Understanding of supply chain risks: fourth parties, concentration, and software and hardware supply chain threats

Enough technical understanding to judge cloud, access and data protection controls credibly

Working knowledge of NCA ECC third-party and cloud requirements, and PDPL.

Clear written English for reports, procedures and supplier communications

Experience with a TPRM platform (OneTrust, ProcessUnity, Archer, ServiceNow VRM or similar)

Experience with security rating services (SecurityScorecard, BitSight, UpGuard)

Experience with software supply chain controls (SBOM, SCA, code signing) or hardware and firmware assurance

Background in IT audit or procurement risk

Experience assessing construction, facilities or OT contractors

Arabic language is a plus

At least one preferred: CTPRP, CISA, ISO/IEC 27001 Lead Auditor. Also valued: CTPRA, CRISC, CCSK, CDPSE.

NCA ECC-2:2024 (third-party and cloud cybersecurity) NCA CCC ISO/IEC 27036 (parts 1 4) NIST SP 800-161 Rev 1 NIST SP 800-204B (SSDF) NIST CSF 2.0 (Govern Supply Chain) PDPL Shared Assessments SIG CSA CAIQ