Deloitte jobs
90 Jobs Found
Alfaisal Career Day 2024 | Audit & Assurance (External Audit, IT Audit, Assurance) | All Levels
Accounting, Finance & Banking
Saudi - Riyadh
When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. Looking for a rewarding career? Take a closer look at Deloitte & Touche ME. You'll understand that Deloitte is a Tier 1 Tax advisor in the GCC region since 2010 (according to the International Tax Review World Tax Rankings). It has received numerous awards in the last few years which include Best Employer in the Middle East, best consulting firm, and the Middle East Training & Development Excellence Award by the Institute of Chartered Accountants in England and Wales (ICAEW).<br><br>A career in Audit at Deloitte & Touche Middle East is a key link in the financial reporting chain, putting you in the position of trusted advisor to businesses across the region. Your people skills will be required for the latter, while your analytical mind will be another integral requirement for success. You will need the flexibility to implement our international audit approach while bringing to the fore your understanding of the complexities and unique circumstances of our clients and the business landscape across our diverse region. All this while adhering to the highest standards of independence, professional objectivity, and technical excellence.<br><br>Our Purpose<br><br>Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges, and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations, and supporting our communities.<br><br>Our shared values guide the way we behave to make a positive, enduring impact:<br><br><ul><li> Lead the way</li><li> Serve with integrity</li><li> Take care of each other</li><li> Foster inclusion</li><li> Collaborate for measurable impact<br><br></li></ul>Scan the QR code or click on the below link to complete your assessment and then click on apply!<br><br>Link: Bryq assessment
Saudi - Riyadh
About Deloitte: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.<br><br><strong>Our Purpose<br><br></strong>Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.<br><br>Our shared values guide the way we behave to make a positive, enduring impact:<br><br><ul><li> Lead the way</li><li> Serve with integrity</li><li> Take care of each other</li><li> Foster inclusion</li><li> Collaborate for measurable impact<br><br></li></ul>During Your Tenure As a Senior In The Telecommunication Sector, You Will Demonstrate And Develop Your Capabilities In The Following Areas<br><br><ul><li> Builds trust and credibility with stakeholders by seeking to understand their service levels expectations and what matters to them individually.</li><li> Delivers high quality services by demonstrating a practical awareness of the impact of regulation and risk management on business processes and controls.</li><li> Takes responsibility for understanding key statistics and industry matters about entity before engagement begins.</li><li> Adapts template referral instructions to clearly outline the scope of procedures to be performed, including the areas of audit focus.</li><li> Understand the structure of the group audit and for whom the referral instructions are intended</li><li> Liaises effectively with onshore and offshore Centers of Excellence in the delivery of relevant tasks, understanding the scope of work delegated to them and the importance of providing accurate and complete information to them.</li><li> Assists in tracking deliverables from component auditors and seeks to understand the relevance and importance of these.</li><li> Appropriately links risks, controls, procedures and findings from allocated sections across the EMS file on a timely basis.</li><li> Can articulate the audit quality milestones, the ways in which teams demonstrate completeness of milestones, and how the audit quality milestones contribute to audit quality.</li><li> Understand the rationale behind the timings of the audit plan and is prepared to offer challenge around whether work can be performed earlier in the audit cycle.</li><li> Prepares documentation by anticipating questions that reviewers may ask and distinguishes accounting judgements and conclusions from auditing judgements and conclusions.</li><li> Understands that it is important to develop relationships beyond the finance function in order to better understand the entity's business and apply professional skepticism.</li><li> Has a practical awareness of the risks around the engagement lifecycle and regulatory environment, and relevant practice protection policies.</li><li> Demonstrates ability to apply AI in an audit context to improve efficiency and quality (e.g., relevant use cases), including prompt engineering fundamentals and structured problem-solving.</li><li> Exercises professional scepticism when using AI-generated outputs—validates accuracy, completeness, and appropriateness before use in audit documentation/workpapers.</li><li> Understands responsible AI expectations in professional services, including governance/risk considerations, confidentiality and data integrity, and use of firm-approved AI tools (including<br><br></li></ul>Deloitte-specific tools where applicable).<br><br><strong>Leadership Capabilities<br><br></strong><ul><li> Builds own understanding of our purpose and values; explores opportunities for impact.</li><li> Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.</li><li> Understands expectations and demonstrates personal accountability for keeping performance on track.</li><li> Actively focuses on developing effective communication and relationship-building skills.</li><li> Understands how their daily work contributes to the priorities of the team and the business.</li><li> Supervise staff, inspect client financial records, compile and analyze data, prepare detailed audit reports, and resolve accounting research issues.</li><li> Demonstrate ability to plan and manage engagements and people, along with ensuring deliverables meet work plan specifications and deadlines.<br><br></li></ul><strong>Qualifications<br><br></strong><ul><li> Degree in Accounting or related field.</li><li> 4+ years of experience in public auditing and accounting, preferably with Big Audit Firms.</li><li> An international accounting qualification is desired: SOCPA, CA, ACCA, or CPA.</li><li> Fluent in English (Reading, Speaking, and Writing). Preference will be given to Bilingual candidates (Arabic/English).<br><br></li></ul>
Saudi - Riyadh
About Deloitte: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.<br><br><strong>Our Purpose<br><br></strong>Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.<br><br>Our shared values guide the way we behave to make a positive, enduring impact:<br><br>Lead the way<br><br>Serve with integrity<br><br>Take care of each other<br><br>Foster inclusion<br><br>Collaborate for measurable impact<br><br>During Your Tenure As An Assistant Manager In The Financial Services Sector, You Will Demonstrate And Develop Your Capabilities In The Following Areas<br><br><ul><li>Takes responsibility for understanding key statistics and industry matters about the entity before engagement begins, for example, by asking other team members and reading the prior year's financial statements (including the enhanced audit report) or audit documentation.</li><li> Understand the allocation of responsibilities between the engagement team and experts or specialists, including timescales and how the work of experts and specialists will contribute to the objectives of the audit.</li><li> Coordinates with management and experts/specialists for the key engagement or project deliverables and due dates.</li><li> Track the findings of work performed and follow up on the impact of work to be performed by other members of the engagement team.</li><li> Applies guidance material in relevant guides, practice aids, and tools so that an appropriate level of professional skepticism is reflected in procedures performed, evidence obtained, and conclusions reached.</li><li> Signs off appropriately on work performed and reviewed. Takes responsibility for meaningful completion of all necessary checklists, and procedures, and tailoring and concluding questions prior to signing-off. </li><li>Proactively checks whether others have signed off appropriately and follows up where necessary.</li><li> Contributes to the development of a comprehensive project plan, using prior year knowledge to help identify audit priorities that can be performed earlier in the audit cycle.</li><li> Seeks awareness of contingency plans if the entity's management team fails to meet their deadlines.</li><li> Prepares and reviews documentation by anticipating questions that reviewers may ask, including not just the conclusion but the relevant facts, analysis, reference to authoritative literature, and professional judgments made in reaching it.</li><li> Encourages wider team to adopt an attitude of professional skepticism, to have a questioning mindset, and to further investigate as and when appropriate. Can identify the key questions to be answered.</li><li> Document objectivity, independence, and continuance decisions, checking that sufficient inquiries have been made and that all information has been captured.</li><li>Check that staff on the engagement have adequate technical knowledge, including industry knowledge, for the areas in which they are working.</li><li>Provides briefings as required.</li><li>Demonstrates ability to apply AI in an audit context to improve efficiency and quality (e.g., relevant use cases), including prompt engineering fundamentals and structured problem-solving.</li><li>Exercises professional scepticism when using AI-generated outputs—validates accuracy, completeness, and appropriateness before use in audit documentation/workpapers.</li><li>Understands responsible AI expectations in professional services, including governance/risk considerations, confidentiality and data integrity, and use of firm-approved AI tools (including Deloitte-specific tools where applicable).<br><br></li></ul><strong>Leadership Capabilities<br><br></strong><ul><li>Builds own understanding of our purpose and values; explores opportunities for impact.</li><li>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.</li><li> Understands expectations and demonstrates personal accountability for keeping performance on track.</li><li> Actively focuses on developing effective communication and relationship-building skills.</li><li> Understands how their daily work contributes to the priorities of the team and the business.<br><br></li></ul><strong>Qualifications<br><br></strong><ul><li> 5+ years of experience in auditing, with leading professional services firms or large multinational organizations.</li><li> Insurance background.</li><li> Degree in Accounting, or related field.</li><li> Successful record of engagement management.</li><li> Fluent in English (Reading, Speaking, and Writing).</li><li> Arabic is a plus.</li><li>CPA, SOCPA or equivalent.<br><br></li></ul>
Saudi - Medina
<p>Design and maintain the governance framework Design the cybersecurity governance framework: governance structure, decision rights, roles and RACI across the CISO office, IT, OT, risk, legal, procurement and business units Write and maintain the cybersecurity policy framework: top-level policy, domain policies, standards, processes, procedures and SOPs, mapped to NCA ECC-2:2024 and other applicable NCA controls Run the document lifecycle: drafting, stakeholder review, approval, publication, communication, periodic review and version control Maintain the ISMS governance components (scope, context, roles, management review) toward ISO/IEC 27001:2022 Define the cybersecurity roles and responsibilities matrix required by NCA ECC, and keep it current as the organisation grows Run governance bodies Set up and run the cybersecurity steering committee and working groups: charters, membership, meeting calendar, agendas, decision packs, minutes and action tracking Prepare clear, decision-focused papers for executives, and follow up on decisions and actions until they are closed Run the programme management office Build and maintain the integrated programme plan across all domains, with milestones, dependencies and critical path (e.g. MS Project, Primavera, Smartsheet) Run the RAID log (risks, assumptions, issues, dependencies), and escalate blockers early with options, not just problems Manage change control for scope, schedule and resources Track resourcing, onboarding, timesheets and budget against plan for the programme team Run the programme's weekly and monthly status reporting, and produce dashboards and executive summaries for leadership Coordinate with the service management office (SMO), centre of excellence (CoE) and domain leads so work flows smoothly across the programme Assure quality and delivery Set programme standards for deliverables: templates, quality review steps and acceptance criteria Run quality reviews and manage deliverable submission and formal acceptance Maintain the programme document repository and records so evidence is easy to find for audits and regulators Leadership Capabilities: Builds own understanding of our purpose and values; explores opportunities for impact. Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. Understands expectations and demonstrates personal accountability for keeping performance on track. Actively focuses on developing effective communication and relationship-building skills. Understands how their daily work contributes to the priorities of the team and the business. Qualifications: Years of experience: 5-10 total years Bachelor's in cybersecurity, IT, business or a related field Has designed or substantially updated a cybersecurity governance framework or policy suite (Senior); has written policies, procedures or SOPs (Mid) Proven PMO or programme management experience on large, multi-workstream programmes: planning, RAID, change control and status reporting Working knowledge of NCA ECC, ISO/IEC 27001 and NIST CSF 2.0 Strong stakeholder management and executive reporting Clear, concise written English Experience setting up and running steering committees in Saudi government or large private entities Experience with planning tools (MS Project, Primavera, Smartsheet) and Power BI dashboards Experience coordinating with service management (ITIL) functions Consulting background Arabic language is a plus. At least one preferred: PMP, CISM, CGEIT. Also valued: PgMP, PRINCE2 / MSP, ISO/IEC 27001 Lead Implementer, COBIT. NCA ECC-2:2024 ISO/IEC 27001:2022 ISO/IEC 27014 NIST CSF 2.0 (Govern) COBIT 2019 PMI PMBOK PRINCE2 / MSP</p><p><strong>Desired Candidate Profile</strong></p><p>Years of experience: 5-10 total years Bachelor's in cybersecurity, IT, business or a related field Has designed or substantially updated a cybersecurity governance framework or policy suite (Senior); has written policies, procedures or SOPs (Mid) Proven PMO or programme management experience on large, multi-workstream programmes: planning, RAID, change control and status reporting Working knowledge of NCA ECC, ISO/IEC 27001 and NIST CSF 2.0 Strong stakeholder management and executive reporting Clear, concise written English Experience setting up and running steering committees in Saudi government or large private entities Experience with planning tools (MS Project, Primavera, Smartsheet) and Power BI dashboards Experience coordinating with service management (ITIL) functions Consulting background Arabic language is a plus. At least one preferred: PMP, CISM, CGEIT. Also valued: PgMP, PRINCE2 / MSP, ISO/IEC 27001 Lead Implementer, COBIT.</p>
Saudi - Medina
<p>Set the architecture and standards Define and maintain the cybersecurity reference architecture, design principles and reusable security patterns, and publish them as the standard projects must follow Write technical security standards for identity, network, cloud, endpoint, data protection and application security, mapped to NCA ECC, CCC, DCC and NIST SP 800-53 Design the zero trust target architecture and a phased path to reach it Assure new solutions Run security architecture reviews and design approvals for new projects, platforms and vendor solutions, and issue clear review reports with conditions Lead threat modelling for critical and guest-facing systems, focusing on the threats that matter rather than long generic lists Explain design trade-offs in plain terms to engineers, project managers and executives, and hold the line on risks that can't be accepted Design key security capabilities Design controls for identity and privileged access, network segmentation, secure remote access, encryption and key management, and cloud security posture Embed security into the SDLC and DevSecOps pipelines with engineering and AppSec teams Evaluate and select security technologies with practical proof-of-concept testing, and maintain the security technology roadmap Work across the programme Work with the Strategy team so the architecture supports the roadmap, and with OT Security on IT/OT boundaries Keep an up-to-date view of architecture risks and exceptions, and report them to governance Leadership Capabilities: Builds own understanding of our purpose and values; explores opportunities for impact. Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. Understands expectations and demonstrates personal accountability for keeping performance on track. Actively focuses on developing effective communication and relationship-building skills. Understands how their daily work contributes to the priorities of the team and the business.</p><p><strong>Desired Candidate Profile</strong></p><p>Years of experience: 6-10 total years Bachelor's in computer science, engineering or a related field Hands-on depth in at least two of: identity and access, network security, cloud security (Azure, AWS or GCP), application security Has produced security architectures or design reviews for real systems in production Working knowledge of NCA ECC, CCC and DCC, and NIST SP 800-53 Clear written and verbal English SABSA or TOGAF training or practice Zero trust design and implementation experience (NIST SP PHONE_NUMBER) Experience with large digital, hospitality, smart-city or critical-infrastructure environments Arabic Language is a bonus At least one preferred: CISSP (ISSAP a plus), SABSA, CCSP. Also valued: TOGAF, AZ-500 / SC-100, AWS Certified Security Specialty, CCSK. Frameworks Knowledge: NCA ECC-2:2024 NCA CCC NCA DCC NIST SP 800-53 Rev 5 NIST SP PHONE_NUMBER ISO/IEC 27001/27002:2022 SABSA TOGAF</p>
Saudi - Medina
<p><b>Build a cybersecurity culture</b></p><p>Build a sense of cybersecurity ownership across the workforce and executives, so security is seen as everyone's responsibility, not only the IT team's</p><p>Drive a cybersecurity-first mindset in day-to-day decisions, from how staff handle data and suppliers to how projects and services are designed</p><p>Engage executives and senior leaders as visible role models: leadership messages, sponsorship of campaigns and participation in exercises</p><p>Measure cybersecurity culture over time through surveys, behaviour data and reporting trends, and target the areas where culture is weakest</p><p>Design the awareness programme</p><p>Design the cybersecurity awareness, training and culture framework and multi-year strategy: audiences, key behaviours, channels, annual plan and success measures, aligned with NCA ECC awareness and training requirements</p><p>Write and maintain the awareness and training policy, procedures and SOPs, including mandatory training rules, onboarding requirements, phishing simulation rules and escalation for repeat clickers</p><p>Run audience analysis to understand each group's risks, working patterns and preferred channels, including staff without regular computer access</p><p>Design tabletop exercises and campaigns</p><p>Design and run cybersecurity tabletop exercises for executives, crisis management teams, IT, OT and business units, based on realistic scenarios such as ransomware, data breach, supplier compromise, payment fraud and disruption to venue or guest operations</p><p>Facilitate the exercises, capture lessons learned, and track improvement actions with the Governance and Risk teams</p><p>Design themed awareness campaigns on priority topics such as phishing, passwords and MFA, social engineering, data protection (PDPL), safe use of AI tools, mobile and travel security, and physical security</p><p>Produce engaging content in Arabic and English: newsletters, posters, short videos, infographics, intranet pages and digital signage</p><p>Organise events such as cybersecurity awareness month, roadshows, competitions and site visits to operational and venue teams</p><p>Deliver role-based training</p><p>Design and deliver role-based training for all staff, executives and board members, IT and OT teams, developers, privileged users, finance and procurement, and contractors</p><p>Build onboarding security training for new joiners, contractors and seasonal staff</p><p>Manage training content and assignments in the learning management system (LMS), and track completion against targets</p><p>Run live sessions, workshops and executive briefings</p><p>Communicate</p><p>Issue clear security advisories and alerts to staff during active threats, in coordination with the SOC and Corporate Communications</p><p>Communicate the cybersecurity programme's progress and achievements internally, so people see why security matters</p><p>Test and measure behaviour</p><p>Plan and run phishing, smishing and vishing simulations (e.g. KnowBe4, Proofpoint), increasing difficulty over time, with follow-up training for those who fail</p><p>Measure what changes, not just attendance: click and report rates, repeat offenders, incident reporting trends, exercise outcomes and culture survey results</p><p>Report programme results and trends to the Governance and Performance Management teams, and adjust the plan based on the data</p><p>Work across the organisation</p><p>Work with HR on onboarding, mandatory training and policy acknowledgement</p><p>Work with Corporate Communications on brand, tone and channels</p><p>Build a network of security champions across departments and sites to carry the culture into every team</p><p>Leadership Capabilities: Builds own understanding of our purpose and values; explores opportunities for impact. Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. Understands expectations and demonstrates personal accountability for keeping performance on track. Actively focuses on developing effective communication and relationship-building skills. Understands how their daily work contributes to the priorities of the team and the business.</p><p>Qualifications:</p><p>Years of experience: 3-7 total professional years.</p><p>Bachelor's in communications, cybersecurity, IT, education or a related field</p><p>Has designed or run a security awareness or culture programme, including phishing simulations (Senior); has delivered awareness campaigns and training (Mid)</p><p>Experience designing or facilitating cybersecurity tabletop exercises (Senior)</p><p>Excellent writing and content creation skills in both Arabic and English</p><p>Solid understanding of common cyber threats (phishing, social engineering, account takeover) and NCA ECC awareness requirements</p><p>Confident presenter to audiences from front-line staff to executives</p><p>Experience with phishing simulation and awareness platforms (KnowBe4, Proofpoint, Cofense or similar) and LMS administration</p><p>Experience measuring security culture (culture surveys, behaviour metrics)</p><p>Content design skills (Canva, Adobe, short video editing)</p><p>Experience with large, mixed workforces such as hospitality, venues, operations or contractors</p><p>Behavioural science or adult learning background</p><p>Arabic Language is a plus.</p><p>At least one preferred: SANS Security Awareness Professional (SSAP), CompTIA Security+, CISM. Also valued: SANS Security Culture (LDR433), CIPD or other learning and development or communications qualifications.</p><p>NCA ECC-2:2024 (awareness and training)</p><p>NIST SP 800-50 Rev 1</p><p>NIST SP 800-84 (exercises)</p><p>ISO/IEC 27001:2022 (A.6.3)</p><p>PDPL (awareness of obligations)</p><p><strong>Desired Candidate Profile</strong></p><p>Years of experience: 3-7 total professional years.</p><p>Bachelor's in communications, cybersecurity, IT, education or a related field</p><p>Has designed or run a security awareness or culture programme, including phishing simulations (Senior); has delivered awareness campaigns and training (Mid)</p><p>Experience designing or facilitating cybersecurity tabletop exercises (Senior)</p><p>Excellent writing and content creation skills in both Arabic and English</p><p>Solid understanding of common cyber threats (phishing, social engineering, account takeover) and NCA ECC awareness requirements</p><p>Confident presenter to audiences from front-line staff to executives</p><p>Experience with phishing simulation and awareness platforms (KnowBe4, Proofpoint, Cofense or similar) and LMS administration</p><p>Experience measuring security culture (culture surveys, behaviour metrics)</p><p>Content design skills (Canva, Adobe, short video editing)</p><p>Experience with large, mixed workforces such as hospitality, venues, operations or contractors</p><p>Behavioural science or adult learning background</p><p>Arabic Language is a plus.</p><p>At least one preferred: SANS Security Awareness Professional (SSAP), CompTIA Security+, CISM. Also valued: SANS Security Culture (LDR433), CIPD or other learning and development or communications qualifications.</p><p>NCA ECC-2:2024 (awareness and training)</p><p>NIST SP 800-50 Rev 1</p><p>NIST SP 800-84 (exercises)</p><p>ISO/IEC 27001:2022 (A.6.3)</p><p>PDPL (awareness of obligations)</p>
Saudi - Medina
<p>Define the risk framework Design the cybersecurity risk management framework and methodology: risk taxonomy, asset and impact criteria, likelihood scales, risk matrix and scoring rules Define risk appetite and tolerance statements for cyber risk with leadership, aligned with the enterprise risk management (ERM) framework and ISO 31000 Write the risk management policy, procedures and templates, including risk acceptance, exceptions and escalation thresholds Align the framework with NCA ECC risk management requirements, ISO/IEC 27005 and NIST SP 800-30 Assess cyber risk Enterprise level: identify and assess the organisation's top cyber risks and scenarios (e.g. ransomware, data breach, payment fraud, service outage, OT disruption) with business and technology leaders Systems and projects: run risk assessments for critical systems, new projects and major changes before go-live, and agree treatment with owners New technology: assess the risk of adopting new technologies such as cloud services, AI and IoT platforms, and recommend conditions for safe use Specialist inputs: bring together findings from vulnerability management, penetration testing, OT security, third-party risk and threat intelligence into a single, joined-up risk view Run risk workshops that get honest input from business owners, and challenge optimistic or vague risk ratings Treat and monitor risk Maintain the cyber risk register: owners, ratings, treatment plans, due dates and status Track treatment plans to completion, re-assess residual risk, and escalate overdue or rising risks Manage the risk acceptance and exception process, making sure acceptances are justified, approved at the right level and time-limited Define key risk indicators (KRIs) and thresholds, and monitor them with the Performance Management team Report and advise Produce clear risk reports and heat maps for management and the risk committee, explaining what changed, why it matters and what decisions are needed Senior: introduce quantitative risk analysis (e.g. FAIR) for top risks to express exposure in financial terms Configure and run risk workflows in the GRC platform (e.g. Archer, ServiceNow IRM, MetricStream) Leadership Capabilities: Builds own understanding of our purpose and values; explores opportunities for impact. Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. Understands expectations and demonstrates personal accountability for keeping performance on track. Actively focuses on developing effective communication and relationship-building skills. Understands how their daily work contributes to the priorities of the team and the business.</p><p><strong>Desired Candidate Profile</strong></p><p>Years of experience: 4-8 total years Bachelor's in cybersecurity, IT, risk management or a related field Has designed or substantially improved a cyber or IT risk methodology (Senior), or run risk assessments end to end (Mid) Strong understanding of cybersecurity threats and controls, enough to judge technical risk credibly Working knowledge of ISO/IEC 27005, NIST SP 800-30, ISO 31000 and NCA ECC Clear written English for management and committee reporting Experience with a GRC platform (Archer, ServiceNow IRM, MetricStream or similar) is preferred. Quantitative risk analysis experience (FAIR) is preferred. Experience linking cyber risk to enterprise risk management in a large organisation is preferred. Background in large-scale development, hospitality, financial services or critical infrastructure is preferred. Arabic Language is preferred. At least one preferred: CRISC, ISO/IEC 27005 Risk Manager, CISM . Also valued: Open FAIR, CISSP, ISO 31000 Risk Manager. Frameworks & Standards: NCA ECC-2:2024 ISO/IEC 27005:2022 ISO 31000:2018 NIST SP 800-30 Rev 1 NIST SP 800-37 Rev 2 NIST CSF 2.0 (Govern Risk Management) FAIR</p>
Saudi - Medina
<h2><br></h2><h2>During your tenure as a Consultant - Manager, you will demonstrate and develop your capabilities in the following areas.</h2><ul><li><strong>Conduct vulnerability assessments</strong><ul><li>Networks: plan and run authenticated and unauthenticated assessments across corporate, data-Center, DMZ, wireless, guest-facing and partner-connected networks, including internal and internet-facing perimeter assessments</li><li>Cloud platforms: assess Azure, AWS and GCP environments, covering workloads, configuration and identity settings against CIS benchmarks and NCA CCC, and scan container images and Kubernetes clusters</li><li>Systems: assess Windows and Linux servers, endpoints, databases, virtualisation platforms, and network and security devices, including configuration and hardening checks against approved baselines</li><li>Applications: assess web applications, APIs and mobile app back-ends with authenticated DAST scanning, working with the Application Security team on in-depth testing</li></ul></li><li>Assess new systems before go-live and after major changes, and run targeted assessments on request</li><li>Produce clear assessment reports with risk-rated findings, evidence and practical remediation steps for each asset owner</li><li><strong>Run tooling and coverage</strong><ul><li>Operate and tune scanning platforms (e.g. Tenable, Qualys, Rapid7), including scan policies, credentials, schedules and agents</li><li>Keep scan coverage aligned with the asset inventory and CMDB, and find and close blind spots, including new and unmanaged assets</li><li>Work with the OT team on safe, approved methods for assessing industrial and building systems</li></ul></li><li><strong>Prioritize what matters</strong><ul><li>Prioritize vulnerabilities using CVSS, EPSS, CISA KEV, asset criticality, exposure and threat intelligence, so teams fix the riskiest issues first rather than chasing volume</li><li>Validate critical findings and filter out false positives before they reach IT teams</li><li>Track emerging threats and zero-days; run rapid exposure checks and issue clear advisories</li></ul></li><li><strong>Drive remediation</strong><ul><li>Agree remediation plans and deadlines with IT, cloud and application owners, and follow them through to closure with persistence and good working relationships</li><li>Verify fixes by rescanning, and manage the exception and risk-acceptance process with proper justification and expiry dates</li><li>Govern patch management in line with NIST SP 800-40, working with the infrastructure teams</li></ul></li><li><strong>Set up the programme and report on it</strong><ul><li>Define the vulnerability management policy, procedure, scan schedules and remediation SLAs in line with NCA ECC</li><li>Build dashboards and KPIs (SLA compliance, ageing, coverage, risk trend), and produce monthly reports for management</li><li>Automate scanning, ticketing and reporting where possible (e.g. Python, APIs, ServiceNow integration)</li><li>Share findings with the Penetration Testing, SOC and Risk teams so the overall risk picture stays current</li></ul></li></ul><h2>Leadership Capabilities:</h2><ul><li>Builds own understanding of our purpose and values; explores opportunities for impact.</li><li>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.</li><li>Understands expectations and demonstrates personal accountability for keeping performance on track.</li><li>Actively focuses on developing effective communication and relationship-building skills.</li><li>Understands how their daily work contributes to the priorities of the team and the business.</li></ul><p>Frameworks and Standards: NCA ECC-2:2024 NCA CCC NIST SP 800-40 Rev 4 NIST SP PHONE_NUMBER NIST CSF 2.0 ISO/IEC 27001:2022 (A.8.8) CIS Controls v8 CIS Benchmark</p><p><strong>Desired Candidate Profile</strong></p><h2>Qualifications:</h2><ul><li>Years of experience: 4-8 years in total with hands-on vulnerability assessment and management experience</li><li>Bachelor's in IT, cybersecurity or a related field</li><li>Practical experience with at least one enterprise scanner (Tenable, Qualys or Rapid7)</li><li>Has assessed at least two of: on-premise networks and systems, cloud platforms, web applications and APIs</li><li>Solid Windows, Linux, network and cloud fundamentals; understands CVSS and EPSS scoring</li><li>Knowledge of NCA ECC vulnerability management requirements</li><li>Scripting in Python or PowerShell for automation and reporting is preferred.</li><li>Experience with ITSM tools (ServiceNow, Jira) for remediation workflows is preferred.</li><li>Experience with cloud security posture (CSPM) or container scanning tools (e.g. Wiz, Prisma Cloud, Defender for Cloud) is preferred.</li><li>Arabic Language is preferred.</li><li>At least one preferred: CompTIA Security+, CySA+, CEH. Also valued: GIAC (GSEC, GCIH), and Tenable or Qualys vendor certifications.</li></ul>
Saudi - Medina
<p>Assess compliance</p><p>Run compliance assessments against NCA ECC-2:2024 and other applicable NCA controls: CSCC (critical systems), CCC (cloud), DCC (data), OTCC (OT), TCC (telework) and OSMACC (social media accounts)</p><p>Assess compliance with ISO/IEC 27001:2022, PDPL data protection requirements and other obligations that apply to the organisation</p><p>Assess new systems, projects and major changes for compliance before go-live</p><p>Interview control owners, review policies and procedures, and judge whether each control is fully, partially or not implemented</p><p>Test that controls work</p><p>Test control effectiveness through evidence sampling and technical checks: user access reviews, privileged account listings, firewall rules, logging and monitoring configuration, backup and restore records, patch status and hardening baselines</p><p>Validate technical configurations against required baselines, using automated compliance scans where available</p><p>Challenge weak or outdated evidence, and record clear, defensible findings</p><p>Prepare for regulators and audits</p><p>Prepare NCA compliance self-assessments, evidence packs and submissions, and support NCA assessments and other regulatory reviews</p><p>Support ISO/IEC 27001 certification and surveillance audits, and internal audit reviews</p><p>Coordinate responses to auditor requests and track audit findings to closure</p><p>Track and report</p><p>Maintain the compliance obligations register and the control-to-evidence mapping across NCA, ISO and NIST</p><p>Agree remediation plans with control owners, follow them through to closure, and verify fixes</p><p>Report compliance status, trends and overdue actions to management and governance committees</p><p>Monitor new and updated regulations (NCA, SDAIA/PDPL, NDMO) and assess their impact on the organization</p><p>Leadership Capabilities: Builds own understanding of our purpose and values; explores opportunities for impact. Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. Understands expectations and demonstrates personal accountability for keeping performance on track. Actively focuses on developing effective communication and relationship-building skills. Understands how their daily work contributes to the priorities of the team and the business.</p><p>Frameworks & Standards: NCA ECC-2:2024 NCA CSCC / CCC / DCC / OTCC / TCC / OSMACC ISO/IEC 27001:2022 NIST CSF 2.0 PDPL NDMO Data Management Standards</p><p><strong>Desired Candidate Profile</strong></p><h2>Qualifications:</h2><p>Years of experience: 2-8 total years</p><p>Bachelor's in cybersecurity, IT or a related field</p><p>Hands-on NCA ECC compliance assessment experience in Saudi Arabia (Mid and Senior)</p><p>Practical control testing and evidence review skills, with enough technical understanding to assess access, network, logging and configuration controls</p><p>Working knowledge of ISO/IEC 27001 and NIST CSF 2.0</p><p>Clear, precise written English</p><p>Experience with other NCA frameworks (CSCC, CCC, DCC, OTCC) is preferred.</p><p>Experience supporting NCA assessments or ISO/IEC 27001 certification audits is preferred.</p><p>Knowledge of PDPL and NDMO data management requirements is preferred.</p><p>Experience with a GRC platform (Archer, ServiceNow GRC, MetricStream or similar) is preferred.</p><p>Arabic language is preferred.</p><p>At least one preferred: CISA, ISO/IEC 27001 Lead Auditor, CISM . Also valued: CRISC, CISSP, CDPSE.</p>
Saudi - Medina
<p>Design the performance framework</p><p>Design the cybersecurity performance management framework: objectives, KPIs, KRIs, SLAs, targets and thresholds, data sources, owners, collection frequency and reporting lines</p><p>Write and maintain the supporting methodology, procedures and SOPs for data collection, validation, calculation, review and sign-off</p><p>Align metrics with the cybersecurity strategy, NCA ECC requirements and NIST CSF 2.0, so they measure outcomes and risk reduction, not just activity</p><p>Review and refine metrics regularly, retiring ones that no longer drive decisions</p><p>Define success metrics for cybersecurity functions and roles</p><p>Define clear success metrics for each cybersecurity function and its roles, agreed with each domain lead, for example:</p><ul><li>Strategy and architecture: roadmap milestones delivered, maturity uplift, designs reviewed before go-live, architecture exceptions open</li><li>Vulnerability management and penetration testing: scan coverage, remediation within SLA, ageing of critical vulnerabilities, retest closure rate, repeat findings</li><li>Application and OT security: applications onboarded to secure SDLC, critical code findings fixed before release, OT assets inventoried and monitored, OTCC gaps closed</li><li>Risk and compliance: risks assessed and treated on time, overdue treatment plans, NCA ECC compliance score and trend, audit findings closed</li><li>Third-party and supply chain: critical suppliers assessed before onboarding, reassessments on time, high-risk supplier findings open, critical suppliers with tested exit and continuity plans, fourth-party and concentration risks identified, supplier incidents and notification times</li><li>Governance and awareness: policies current and approved, committee actions closed, training completion, phishing simulation trends</li></ul><p>Define how each metric is measured: formula, data source, baseline, target, frequency, owner and evidence, so results are consistent and can be audited</p><p>Set measures at three levels: programme outcomes, function performance, and role and team contribution, and link them so leaders can see how individual work adds up to programme results</p><p>Support domain leads in using the metrics for team objectives and performance reviews</p><p>Work with the Governance team</p><p>Work closely with the Governance & PMO team to understand governance implementation requirements: approved policies, standards, roles and RACI, committee decisions and NCA obligations</p><p>Turn those requirements into measurable indicators, such as policy implementation and adherence, SOP compliance, role coverage, and committee decision and action closure rates</p><p>Track whether governance decisions are actually implemented on the ground, and report gaps back to the Governance team and steering committee</p><p>Provide performance evidence for ISMS management reviews and NCA compliance reporting</p><p>Measure services and the programme</p><p>Track the service levels and performance of managed security services and key security vendors, and run monthly service reviews with clear actions</p><p>Track programme delivery and benefits against plan, with the PMO</p><p>Measure cybersecurity maturity and NCA compliance trends over time, with the Strategy and Compliance teams</p><p>Build dashboards and reports</p><p>Build and maintain dashboards and scorecards for the CISO, steering committee and board (e.g. Power BI), with drill-down by function, team and role</p><p>Automate data collection from security tools, GRC, TPRM and ticketing platforms where possible, so reports are timely and consistent</p><p>Produce monthly and quarterly performance reports that explain what changed, why, and what needs to happen next, written in plain language for executives</p><p>Drive improvement</p><p>Spot negative trends and missed targets early, analyse root causes with the owners, and agree improvement actions</p><p>Track improvement actions to closure and show their effect in later reporting</p><p>Validate data quality and challenge figures that don't add up</p><p>Leadership Capabilities: Builds own understanding of our purpose and values; explores opportunities for impact. Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. Understands expectations and demonstrates personal accountability for keeping performance on track. Actively focuses on developing effective communication and relationship-building skills. Understands how their daily work contributes to the priorities of the team and the business.</p><p><b>Qualifications</b>:</p><p>Years of experience: 4-8 total professional years.</p><p>Bachelor's in IT, cybersecurity, business, data analytics or a related field</p><p>Has designed or run a KPI/KRI or SLA performance framework covering multiple functions (Senior); has built performance dashboards and reports (Mid)</p><p>Understanding of cybersecurity domains, including third-party and supply chain risk, enough to define meaningful metrics for each function</p><p>Strong data skills: Excel and Power BI (or Tableau), with data modelling</p><p>Experience managing SLAs and service performance (ITIL)</p><p>Clear, concise written English for executive reporting</p><p>SQL or Python for data extraction and automation</p><p>Experience linking organisational KPIs to team and individual objectives</p><p>Experience with managed security services (MSSP) contracts and service reviews</p><p>Experience with maturity assessment models</p><p>Knowledge of ISO/IEC 27004 and NIST SP 800-55</p><p><br></p><p><strong>Desired Candidate Profile</strong></p><p>Years of experience: 4-8 total professional years.</p><p>Bachelor's in IT, cybersecurity, business, data analytics or a related field</p><p>Has designed or run a KPI/KRI or SLA performance framework covering multiple functions (Senior); has built performance dashboards and reports (Mid)</p><p>Understanding of cybersecurity domains, including third-party and supply chain risk, enough to define meaningful metrics for each function</p><p>Strong data skills: Excel and Power BI (or Tableau), with data modelling</p><p>Experience managing SLAs and service performance (ITIL)</p><p>Clear, concise written English for executive reporting</p><p>SQL or Python for data extraction and automation</p><p>Experience linking organisational KPIs to team and individual objectives</p><p>Experience with managed security services (MSSP) contracts and service reviews</p><p>Experience with maturity assessment models</p><p>Knowledge of ISO/IEC 27004 and NIST SP 800-55</p><p>Arabic is a plus</p><p>At least one preferred: ITIL 4, CISM, Microsoft Power BI Data Analyst (PL-300). Also valued: PMP, CGEIT, COBIT.</p><p>NIST CSF 2.0</p><p>NIST SP 800-55 (performance measurement)</p><p>ISO/IEC 27004</p><p>NCA ECC-2:2024</p><p>ITIL 4</p><p>COBIT 2019</p><p>Balanced Scorecard</p>
Saudi - Medina
<p>During your tenure as a Senior Consultant/ Manager, you will demonstrate and develop your capabilities in the following areas</p><p><br></p><p>Find and prioritise opportunities</p><p>· Work with domain leads to map manual, repetitive and high-volume tasks across strategy, technical assessments, risk, compliance, TPRM, governance and performance management</p><p><br></p><p>· Build a prioritised backlog of AI and automation use cases, with expected time savings, risk and effort for each</p><p><br></p><p>· Track AI advancements and good practice, and share them with the Innovation Guidance Team and the wider programme</p><p><br></p><p>Build AI and automation solutions</p><p>· Design, build and deploy solutions such as:</p><p><br></p><p>o Evidence and document analysis: reviewing policies, contracts, SOC 2 reports and compliance evidence against required controls</p><p><br></p><p>o TPRM automation: pre-filling and reviewing supplier questionnaires and flagging gaps</p><p><br></p><p>o Vulnerability analytics: enriching and prioritising findings using asset, threat and exploit data</p><p><br></p><p>o Reporting automation: generating draft assessment reports, dashboards and executive summaries</p><p><br></p><p>o AI assistants: helping the team search frameworks, policies and past work</p><p><br></p><p>o Anomaly detection: detection use cases with the SOC where relevant</p><p><br></p><p>· Build data pipelines and integrations with security tools, GRC and TPRM platforms, ticketing systems and Power BI</p><p><br></p><p>· Choose the right approach for each problem, whether rules, scripts, classical ML or large language models (LLMs), rather than defaulting to AI</p><p><br></p><p>Make AI secure and responsible</p><p>· Define standards for safe AI use in the programme: data handling, human review of AI outputs, prompt and model security, and logging</p><p><br></p><p>· Protect sensitive data: keep it within approved environments and meet PDPL, NCA and SDAIA requirements</p><p><br></p><p>· Test AI solutions against prompt injection, data leakage and incorrect outputs, following OWASP Top 10 for LLM Applications and NIST AI RMF</p><p><br></p><p>· Apply MLOps practices: version control, testing, monitoring, model performance tracking and documented governance of each solution</p><p><br></p><p>Enable the team</p><p>· Document solutions clearly and train specialists to use them well</p><p><br></p><p>· Measure adoption and time saved, and report results to programme leadership with the Performance Management team</p><p><br></p><p>Leadership Capabilities:</p><p><br></p><p>Builds own understanding of our purpose and values; explores opportunities for impact. </p><p>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. </p><p>Understands expectations and demonstrates personal accountability for keeping performance on track. </p><p>Actively focuses on developing effective communication and relationship-building skills. </p><p>Understands how their daily work contributes to the priorities of the team and the business. </p><p>Qualifications:</p><p><br></p><p>· Total years of experience: 3-7 total professional years.</p><p><br></p><p>· Bachelor's or Master's in computer science, data science, AI or a related field</p><p><br></p><p>· Strong Python, with experience shipping ML or LLM-based solutions into real use, not only prototypes</p><p><br></p><p>· Experience with ML and LLM frameworks (e.g. PyTorch, scikit-learn, LangChain, LlamaIndex or similar) and building retrieval-augmented (RAG) solutions</p><p><br></p><p>· Experience with cloud AI platforms (Azure OpenAI / Azure AI, AWS Bedrock / SageMaker or GCP Vertex AI) and APIs</p><p><br></p><p>· Data engineering skills: SQL, pandas and building data pipelines</p><p><br></p><p>· Understanding of secure and responsible AI practices</p><p><br></p><p>· Cybersecurity, GRC or risk domain experience</p><p><br></p><p>· Experience integrating with ServiceNow, Archer, OneTrust or security tool APIs</p><p><br></p><p>· MLOps tooling (MLflow, Docker, CI/CD)</p><p><br></p><p>· Knowledge of Saudi AI and data regulations (SDAIA AI Ethics Principles, PDPL)</p><p><br></p><p>· Arabic language is a plus.</p><p><br></p><p>· At least one preferred: Microsoft Azure AI Engineer (AI-102), AWS Certified Machine Learning (Specialty or Engineer), Google Professional Machine Learning Engineer. Also valued: ISO/IEC 42001 Lead Implementer, IAPP AIGP.</p><p><strong>Desired Candidate Profile</strong></p><p><br></p>
Saudi - Medina
<p>Our shared values guide the way we behave to make a positive, enduring impact:</p><p><br></p><p>During your tenure as a Consultant – Manager, you will demonstrate and develop your capabilities in the following areas.</p><p><br></p><p>Plan and scope engagements</p><p>· Agree scope, objectives, rules of engagement and test windows with system owners, and obtain written authorisation before any testing</p><p><br></p><p>· Choose the right approach for each target: black-box, grey-box or white-box, external or internal, announced or unannounced</p><p><br></p><p>· Follow a defined methodology (NIST SP 800-115, PTES, OWASP) and keep testing safe for live, guest-facing services</p><p><br></p><p>Conduct penetration tests</p><p>· Web applications and APIs: test authentication, authorisation, business logic, injection, session handling and API security, following the OWASP Testing Guide and ASVS</p><p><br></p><p>· Mobile applications: test iOS and Android apps and their back-ends following OWASP MASTG</p><p><br></p><p>· Internal and external networks: test perimeter exposure, internal segmentation, lateral movement and privilege escalation</p><p><br></p><p>· Active Directory and identity: test AD and Entra ID attack paths, Kerberos weaknesses, privilege misconfigurations and credential exposure</p><p><br></p><p>· Cloud environments: test Azure, AWS and GCP for misconfigurations, excessive permissions and exposed services</p><p><br></p><p>· Wireless and physical: test corporate and guest Wi-Fi and, where authorised, physical access controls</p><p><br></p><p>· Social engineering: run authorised phishing and pretexting exercises with the Awareness team</p><p><br></p><p>Run red and purple team exercises (Senior)</p><p>· Plan and lead objective-based red team exercises that emulate realistic threat actors, mapped to MITRE ATT&CK</p><p><br></p><p>· Run purple team sessions with the SOC to test and improve detection and response</p><p><br></p><p>Report and drive fixes</p><p>· Write clear, risk-rated reports with evidence, attack narratives and practical remediation steps, plus a short executive summary in plain language</p><p><br></p><p>· Brief technical teams and management on results, and explain business impact without exaggeration</p><p><br></p><p>· Retest fixes, confirm closure, and pass validated findings to Vulnerability Management and Risk for tracking</p><p><br></p><p>· Build reusable test cases, scripts and checklists to make testing faster and more consistent</p><p><br></p><p>Leadership Capabilities:</p><p><br></p><p>Builds own understanding of our purpose and values; explores opportunities for impact. </p><p>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. </p><p>Understands expectations and demonstrates personal accountability for keeping performance on track. </p><p>Actively focuses on developing effective communication and relationship-building skills. </p><p>Understands how their daily work contributes to the priorities of the team and the business. </p><p>Qualifications:</p><p><br></p><p>· Years of experience: 2-7 total years</p><p><br></p><p>· Bachelor's in cybersecurity, computer science or a related field, or equivalent practical experience</p><p><br></p><p>· Hands-on experience delivering penetration tests for real organisations, not only labs or CTFs</p><p><br></p><p>· Strong with core tools: Burp Suite, Nmap, Metasploit, BloodHound and common post-exploitation frameworks</p><p><br></p><p>· Scripting in Python, Bash or PowerShell</p><p><br></p><p>· Strong report writing in English</p><p><br></p><p>· A recognised hands-on offensive certification (e.g. OSCP) for Mid and Senior levels</p><p><br></p><p>· Red team experience with C2 frameworks (e.g. Cobalt Strike, Sliver, Mythic) is preferred.</p><p><br></p><p>· Mobile application and cloud penetration testing experience is preferred.</p><p><br></p><p>· Exploit development or code review skills is preferred.</p><p><br></p><p>· Experience testing hospitality, payments, smart-city or OT-adjacent environments is preferred.</p><p><br></p><p>· Arabic language is preferred.</p><p><br></p><p>· At least one preferred: OSCP, CREST CRT/CCT, GPEN. Also valued: OSEP, OSWE, CRTO, GWAPT, eCPPT/eWPT, PNPT. CEH is accepted at Junior level only.</p><p><strong>Desired Candidate Profile</strong></p><p><br></p>
Saudi - Medina
<p>Design OT security</p><p>Define the OT security architecture and reference designs: Purdue-model zoning, IEC 62443 zones and conduits, OT DMZs, secure remote access, and backup and recovery</p><p>Set cybersecurity requirements for OEMs, system integrators and contractors (IEC 62443-2-4, 3-3, 4-2), and review their designs before installation</p><p>Secure new builds through to handover: check that systems are delivered hardened, documented, and with default credentials and unused services removed</p><p>Define secure IT/OT integration patterns for systems that share data with business and smart-city platforms</p><p>Assess OT environments</p><p>Build and maintain the OT asset inventory: controllers, HMIs, servers, network devices and their communication paths</p><p>Run IEC 62443 risk assessments: identify zones, set target security levels, assess gaps and recommend controls</p><p>Assess compliance with NCA OTCC and NCA ECC for OT systems, and track remediation</p><p>Test OT and connected IT environments</p><p>Configuration reviews: review the security configuration of PLCs, HMIs, engineering workstations, SCADA and historian servers, industrial switches and firewalls against vendor hardening guides and approved baselines</p><p>Firewall and segmentation testing: review firewall rule sets at IT/OT and zone boundaries, and test that segmentation actually blocks unauthorized paths between corporate IT, the OT DMZ and control networks</p><p>Network traffic analysis: capture and analyze OT network traffic (e.g. Wireshark, Zeek, OT monitoring platforms) to baseline normal communications, find unknown assets, insecure protocols, cleartext credentials and unexpected external connections</p><p>Connected IT systems: test the Windows and Linux servers, domain controllers, jump hosts and remote access gateways that support OT, covering patching, hardening, accounts and privileges</p><p>Remote and wireless access: test vendor remote access paths, VPNs and industrial wireless for weak authentication and exposure</p><p>Run safe, passive or approved active testing only, with change approval and operations sign-off, so live processes are never disrupted</p><p>Produce clear test reports with risk-rated findings, evidence and practical fixes that suit the operational environment</p><p>Manage OT security operations</p><p>Deploy and manage OT network monitoring (e.g. Nozomi, Claroty, Dragos), and tune detections for industrial protocols (Modbus, BACnet, DNP3, IEC 61850)</p><p>Build OT incident response playbooks with the SOC and operations teams, and run joint exercises</p><p>Manage OT vulnerabilities and patching in line with vendor support and plant safety requirements</p><p>Control and monitor third-party and vendor remote access to OT systems</p><p>Govern and report</p><p>Write OT security policies, standards and procedures aligned with NCA OTCC and IEC 62443</p><p>Work closely with operations and engineering teams on live sites, explaining security in operational terms and respecting safety and uptime</p><p>Report OT risk posture and compliance status to management</p><p>Leadership Capabilities:</p><p>Builds own understanding of our purpose and values; explores opportunities for impact.</p><p>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.</p><p>Understands expectations and demonstrates personal accountability for keeping performance on track.</p><p>Actively focuses on developing effective communication and relationship-building skills.</p><p>Understands how their daily work contributes to the priorities of the team and the business.</p><p>Qualifications:</p><p>Years of experience: 5-10 total years</p><p>Bachelor's in electrical, control, computer engineering or a related field</p><p>Hands-on experience with OT/ICS environments: PLCs, DCS, SCADA, BMS, HMIs and industrial networks</p><p>Working knowledge of industrial protocols (e.g. Modbus, BACnet, DNP3, OPC UA, IEC 61850)</p><p>Practical experience applying IEC 62443 and NCA OTCC</p><p>Hands-on technical testing in OT or converged IT/OT environments: configuration reviews, firewall rule reviews and segmentation testing</p><p>Network traffic capture and analysis skills (e.g. Wireshark, Zeek), including industrial protocols</p><p>Experience with at least one OT monitoring platform (Nozomi, Claroty, Dragos or similar)</p><p>Comfortable working on live operational sites under safety rules</p><p>Experience with building management, district cooling, utilities, ride or show control, or smart-city IoT is preferred.</p><p>Experience securing new-build projects through construction and handover is preferred.</p><p>Windows/Active Directory hardening and testing in OT environments is preferred.</p><p>Network engineering skills (industrial firewalls, segmentation, data diodes) is preferred.</p><p>Arabic Language is preferred.</p><p>At least one preferred: GICSP, GRID, ISA/IEC 62443 Cybersecurity Expert/Specialist . Also valued: CISSP, GCIP, GPEN, vendor certifications (Nozomi, Claroty, Dragos).</p><p>Frameworks & Standards: NCA OTCC-1:2022 NCA ECC-2:2024 IEC 62443 (2-1, 2-4, 3-2, 3-3, 4-2) NIST SP 800-82 Rev 3 NIST SP 800-53 Rev 5 NIST CSF 2.0 MITRE ATT&CK for ICS</p><p><strong>Desired Candidate Profile</strong></p><p>Years of experience: 5-10 total years</p><p>Bachelor's in electrical, control, computer engineering or a related field</p><p>Hands-on experience with OT/ICS environments: PLCs, DCS, SCADA, BMS, HMIs and industrial networks</p><p>Working knowledge of industrial protocols (e.g. Modbus, BACnet, DNP3, OPC UA, IEC 61850)</p><p>Practical experience applying IEC 62443 and NCA OTCC</p><p>Hands-on technical testing in OT or converged IT/OT environments: configuration reviews, firewall rule reviews and segmentation testing</p><p>Network traffic capture and analysis skills (e.g. Wireshark, Zeek), including industrial protocols</p><p>Experience with at least one OT monitoring platform (Nozomi, Claroty, Dragos or similar)</p><p>Comfortable working on live operational sites under safety rules</p><p>Experience with building management, district cooling, utilities, ride or show control, or smart-city IoT is preferred.</p><p>Experience securing new-build projects through construction and handover is preferred.</p><p>Windows/Active Directory hardening and testing in OT environments is preferred.</p><p>Network engineering skills (industrial firewalls, segmentation, data diodes) is preferred.</p><p>Arabic Language is preferred.</p><p>At least one preferred: GICSP, GRID, ISA/IEC 62443 Cybersecurity Expert/Specialist . Also valued: CISSP, GCIP, GPEN, vendor certifications (Nozomi, Claroty, Dragos).</p>
Saudi - Medina
<p>Our shared values guide the way we behave to make a positive, enduring impact:</p><p><br></p><p>During your tenure as a Senior Consultant – Manager, you will demonstrate and develop your capabilities in the following areas.</p><p><br></p><p>Set the secure development standard</p><p>· Define the secure SDLC, secure coding standards and application security requirements, aligned with NCA ECC, OWASP ASVS and NIST SSDF</p><p><br></p><p>· Set security requirements and acceptance criteria for in-house and vendor-built applications, including contract clauses and release checks</p><p><br></p><p>· Build and maintain the application inventory, with a risk rating for each application</p><p><br></p><p>Embed security in the pipeline</p><p>· Implement and tune SAST, DAST, SCA and secrets scanning in CI/CD pipelines (e.g. Checkmarx, Fortify, Veracode, SonarQube, Snyk, Burp Suite)</p><p><br></p><p>· Triage tool findings, remove noise, and give developers clear, fix-ready guidance so security doesn't slow releases</p><p><br></p><p>· Review container, infrastructure-as-code and cloud-native deployments with DevOps teams</p><p><br></p><p>Assess applications in depth</p><p>· Run application security assessments of web, mobile and API applications, including manual testing of authentication, authorization and business logic</p><p><br></p><p>· Perform secure code reviews of high-risk features and components</p><p><br></p><p>· Lead threat modelling for new applications and major changes, working with architects and development teams</p><p><br></p><p>· Review third-party and SaaS applications before they are adopted</p><p><br></p><p>Drive fixes and build skills</p><p>· Track application vulnerabilities to closure with development teams and vendors; verify fixes before release</p><p><br></p><p>· Report application risk posture and trends to management</p><p><br></p><p>· Train developers on secure coding, OWASP Top 10 and API Security Top 10, and build a network of security champions in development teams</p><p><br></p><p>Leadership Capabilities:</p><p><br></p><p>Builds own understanding of our purpose and values; explores opportunities for impact. </p><p>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. </p><p>Understands expectations and demonstrates personal accountability for keeping performance on track. </p><p>Actively focuses on developing effective communication and relationship-building skills. </p><p>Understands how their daily work contributes to the priorities of the team and the business. </p><p>Qualifications:</p><p><br></p><p>Years of experience: 4-8+ total years</p><p>Bachelor's in computer science, software engineering or a related field</p><p>Software development background in at least one language (e.g. Java, C#/.NET, JavaScript/TypeScript, Python), with the ability to read and review code</p><p>Hands-on experience with SAST, DAST and SCA tools in real development environments</p><p>Strong knowledge of OWASP Top 10, API Security Top 10 and ASVS</p><p>Experience with CI/CD pipelines and DevSecOps practices</p><p>Mobile application security experience (OWASP MASVS/MASTG) is preferred.</p><p>Cloud-native and container security (Kubernetes, Docker, infrastructure-as-code) is preferred.</p><p>Experience with payment or customer-facing platforms (PCI DSS awareness) is preferred.</p><p>Experience running a security champions programme is preferred.</p><p>Arabic Language is preferred.</p><p>At least one preferred: CSSLP, GWEB, OSWE. Also valued: GWAPT, CASE, eWPT, Burp Suite Certified Practitioner.</p><p><strong>Desired Candidate Profile</strong></p><p><br></p>
Senior Consultant – Senior Manager| Cyber Operate | OT Security Specialist| KSA
Information Technology
Saudi - Riyadh
<strong>About Deloitte</strong>: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.<br><br><strong>Our Purpose<br><br></strong>Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.<br><br>Our shared values guide the way we behave to make a positive, enduring impact:<br><br>During your tenure as a Senior Consultant – Senior Manager, you will demonstrate and develop your capabilities in the following areas.<br><br>Design OT security<br><br><ul><li> Define the OT security architecture and reference designs: Purdue-model zoning, IEC 62443 zones and conduits, OT DMZs, secure remote access, and backup and recovery</li><li> Set cybersecurity requirements for OEMs, system integrators and contractors (IEC 62443-2-4, 3-3, 4-2), and review their designs before installation</li><li> Secure new builds through to handover: check that systems are delivered hardened, documented, and with default credentials and unused services removed</li><li> Define secure IT/OT integration patterns for systems that share data with business and smart-city platforms<br><br></li></ul>Assess OT environments<br><br><ul><li> Build and maintain the OT asset inventory: controllers, HMIs, servers, network devices and their communication paths</li><li> Run IEC 62443 risk assessments: identify zones, set target security levels, assess gaps and recommend controls</li><li> Assess compliance with NCA OTCC and NCA ECC for OT systems, and track remediation<br><br></li></ul>Test OT and connected IT environments<br><br><ul><li> Configuration reviews: review the security configuration of PLCs, HMIs, engineering workstations, SCADA and historian servers, industrial switches and firewalls against vendor hardening guides and approved baselines</li><li> Firewall and segmentation testing: review firewall rule sets at IT/OT and zone boundaries, and test that segmentation actually blocks unauthorized paths between corporate IT, the OT DMZ and control networks</li><li> Network traffic analysis: capture and analyze OT network traffic (e.g. Wireshark, Zeek, OT monitoring platforms) to baseline normal communications, find unknown assets, insecure protocols, cleartext credentials and unexpected external connections</li><li> Connected IT systems: test the Windows and Linux servers, domain controllers, jump hosts and remote access gateways that support OT, covering patching, hardening, accounts and privileges</li><li> Remote and wireless access: test vendor remote access paths, VPNs and industrial wireless for weak authentication and exposure</li><li> Run safe, passive or approved active testing only, with change approval and operations sign-off, so live processes are never disrupted</li><li> Produce clear test reports with risk-rated findings, evidence and practical fixes that suit the operational environment<br><br></li></ul>Manage OT security operations<br><br><ul><li> Deploy and manage OT network monitoring (e.g. Nozomi, Claroty, Dragos), and tune detections for industrial protocols (Modbus, BACnet, DNP3, OPC UA, IEC 61850)</li><li> Build OT incident response playbooks with the SOC and operations teams, and run joint exercises</li><li> Manage OT vulnerabilities and patching in line with vendor support and plant safety requirements</li><li> Control and monitor third-party and vendor remote access to OT systems<br><br></li></ul>Govern and report<br><br><ul><li> Write OT security policies, standards and procedures aligned with NCA OTCC and IEC 62443</li><li> Work closely with operations and engineering teams on live sites, explaining security in operational terms and respecting safety and uptime</li><li> Report OT risk posture and compliance status to management<br><br></li></ul><strong>Leadership Capabilities<br><br></strong><ul><li>Builds own understanding of our purpose and values; explores opportunities for impact. </li><li>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. </li><li>Understands expectations and demonstrates personal accountability for keeping performance on track. </li><li>Actively focuses on developing effective communication and relationship-building skills. </li><li>Understands how their daily work contributes to the priorities of the team and the business. <br><br></li></ul><strong>Qualifications<br><br></strong><ul><li> Years of experience: 5-10 total years</li><li> Bachelor's in electrical, control, computer engineering or a related field</li><li> Hands-on experience with OT/ICS environments: PLCs, DCS, SCADA, BMS, HMIs and industrial networks</li><li> Working knowledge of industrial protocols (e.g. Modbus, BACnet, DNP3, OPC UA, IEC 61850)</li><li> Practical experience applying IEC 62443 and NCA OTCC</li><li> Hands-on technical testing in OT or converged IT/OT environments: configuration reviews, firewall rule reviews and segmentation testing</li><li> Network traffic capture and analysis skills (e.g. Wireshark, Zeek), including industrial protocols</li><li> Experience with at least one OT monitoring platform (Nozomi, Claroty, Dragos or similar)</li><li> Comfortable working on live operational sites under safety rules</li><li> Experience with building management, district cooling, utilities, ride or show control, or smart-city IoT is preferred.</li><li> Experience securing new-build projects through construction and handover is preferred.</li><li> Windows/Active Directory hardening and testing in OT environments is preferred.</li><li> Network engineering skills (industrial firewalls, segmentation, data diodes) is preferred.</li><li> Arabic Language is preferred.</li><li> At least one preferred: GICSP, GRID, ISA/IEC 62443 Cybersecurity Expert/Specialist. Also valued: CISSP, GCIP, GPEN, vendor certifications (Nozomi, Claroty, Dragos).</li><li> Frameworks & Standards: NCA OTCC-1:2022</li><li> NCA ECC-2:2024</li><li> IEC 62443 (2-1, 2-4, 3-2, 3-3, 4-2)</li><li> NIST SP 800-82 Rev 3</li><li> NIST SP 800-115</li><li> NIST CSF 2.0</li><li> MITRE ATT&CK for ICS</li></ul>
Senior Consultant/Manager | Cyber Operate | Awareness, Training & Communications Specialist |KSA
Information Technology
Saudi - Riyadh
<strong>About Deloitte</strong>: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.<br><br><strong>Our Purpose<br><br></strong>Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.<br><br>Our shared values guide the way we behave to make a positive, enduring impact:<br><br>During your tenure as a Senior Consultant/Manager, you will demonstrate and develop your capabilities in the following areas<br><br>Build a cybersecurity culture<br><br><ul><li> Build a sense of cybersecurity ownership across the workforce and executives, so security is seen as everyone's responsibility, not only the IT team's</li><li> Drive a cybersecurity-first mindset in day-to-day decisions, from how staff handle data and suppliers to how projects and services are designed</li><li> Engage executives and senior leaders as visible role models: leadership messages, sponsorship of campaigns and participation in exercises</li><li> Measure cybersecurity culture over time through surveys, behaviour data and reporting trends, and target the areas where culture is weakest<br><br></li></ul>Design the awareness programme<br><br><ul><li> Design the cybersecurity awareness, training and culture framework and multi-year strategy: audiences, key behaviours, channels, annual plan and success measures, aligned with NCA ECC awareness and training requirements</li><li> Write and maintain the awareness and training policy, procedures and SOPs, including mandatory training rules, onboarding requirements, phishing simulation rules and escalation for repeat clickers</li><li> Run audience analysis to understand each group's risks, working patterns and preferred channels, including staff without regular computer access<br><br></li></ul>Design tabletop exercises and campaigns<br><br><ul><li> Design and run cybersecurity tabletop exercises for executives, crisis management teams, IT, OT and business units, based on realistic scenarios such as ransomware, data breach, supplier compromise, payment fraud and disruption to venue or guest operations</li><li> Facilitate the exercises, capture lessons learned, and track improvement actions with the Governance and Risk teams</li><li> Design themed awareness campaigns on priority topics such as phishing, passwords and MFA, social engineering, data protection (PDPL), safe use of AI tools, mobile and travel security, and physical security</li><li> Produce engaging content in Arabic and English: newsletters, posters, short videos, infographics, intranet pages and digital signage</li><li> Organise events such as cybersecurity awareness month, roadshows, competitions and site visits to operational and venue teams<br><br></li></ul>Deliver role-based training<br><br><ul><li> Design and deliver role-based training for all staff, executives and board members, IT and OT teams, developers, privileged users, finance and procurement, and contractors</li><li> Build onboarding security training for new joiners, contractors and seasonal staff</li><li> Manage training content and assignments in the learning management system (LMS), and track completion against targets</li><li> Run live sessions, workshops and executive briefings<br><br></li></ul>Communicate<br><br><ul><li> Issue clear security advisories and alerts to staff during active threats, in coordination with the SOC and Corporate Communications</li><li> Communicate the cybersecurity programme's progress and achievements internally, so people see why security matters<br><br></li></ul>Test and measure behaviour<br><br><ul><li> Plan and run phishing, smishing and vishing simulations (e.g. KnowBe4, Proofpoint), increasing difficulty over time, with follow-up training for those who fail</li><li> Measure what changes, not just attendance: click and report rates, repeat offenders, incident reporting trends, exercise outcomes and culture survey results</li><li> Report programme results and trends to the Governance and Performance Management teams, and adjust the plan based on the data<br><br></li></ul>Work across the organisation<br><br><ul><li> Work with HR on onboarding, mandatory training and policy acknowledgement</li><li> Work with Corporate Communications on brand, tone and channels</li><li> Build a network of security champions across departments and sites to carry the culture into every team<br><br></li></ul><strong>Leadership Capabilities<br><br></strong><ul><li>Builds own understanding of our purpose and values; explores opportunities for impact. </li><li>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. </li><li>Understands expectations and demonstrates personal accountability for keeping performance on track. </li><li>Actively focuses on developing effective communication and relationship-building skills. </li><li>Understands how their daily work contributes to the priorities of the team and the business. <br><br></li></ul><strong>Qualifications<br><br></strong><ul><li> Years of experience: 3-7 total professional years.</li><li> Bachelor's in communications, cybersecurity, IT, education or a related field</li><li> Has designed or run a security awareness or culture programme, including phishing simulations (Senior); has delivered awareness campaigns and training (Mid)</li><li> Experience designing or facilitating cybersecurity tabletop exercises (Senior)</li><li> Excellent writing and content creation skills in both Arabic and English</li><li> Solid understanding of common cyber threats (phishing, social engineering, account takeover) and NCA ECC awareness requirements</li><li> Confident presenter to audiences from front-line staff to executives</li><li> Experience with phishing simulation and awareness platforms (KnowBe4, Proofpoint, Cofense or similar) and LMS administration</li><li> Experience measuring security culture (culture surveys, behaviour metrics)</li><li> Content design skills (Canva, Adobe, short video editing)</li><li> Experience with large, mixed workforces such as hospitality, venues, operations or contractors</li><li> Behavioural science or adult learning background</li><li> Arabic Language is a plus.</li><li> At least one preferred: SANS Security Awareness Professional (SSAP), CompTIA Security+, CISM. Also valued: SANS Security Culture (LDR433), CIPD or other learning and development or communications qualifications.</li><li> NCA ECC-2:2024 (awareness and training)</li><li> NIST SP 800-50 Rev 1</li><li> NIST SP 800-84 (exercises)</li><li> ISO/IEC 27001:2022 (A.6.3)</li><li> PDPL (awareness of obligations)</li></ul>
Saudi - Riyadh
<strong>About Deloitte</strong>: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.<br><br><strong>Our Purpose<br><br></strong>Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.<br><br>Our shared values guide the way we behave to make a positive, enduring impact:<br><br>During your tenure as a Consultant – Manager, you will demonstrate and develop your capabilities in the following areas.<br><br>Plan and scope engagements<br><br><ul><li> Agree scope, objectives, rules of engagement and test windows with system owners, and obtain written authorisation before any testing</li><li> Choose the right approach for each target: black-box, grey-box or white-box, external or internal, announced or unannounced</li><li> Follow a defined methodology (NIST SP 800-115, PTES, OWASP) and keep testing safe for live, guest-facing services<br><br></li></ul>Conduct penetration tests<br><br><ul><li> Web applications and APIs: test authentication, authorisation, business logic, injection, session handling and API security, following the OWASP Testing Guide and ASVS</li><li> Mobile applications: test iOS and Android apps and their back-ends following OWASP MASTG</li><li> Internal and external networks: test perimeter exposure, internal segmentation, lateral movement and privilege escalation</li><li> Active Directory and identity: test AD and Entra ID attack paths, Kerberos weaknesses, privilege misconfigurations and credential exposure</li><li> Cloud environments: test Azure, AWS and GCP for misconfigurations, excessive permissions and exposed services</li><li> Wireless and physical: test corporate and guest Wi-Fi and, where authorised, physical access controls</li><li> Social engineering: run authorised phishing and pretexting exercises with the Awareness team<br><br></li></ul>Run red and purple team exercises (Senior)<br><br><ul><li> Plan and lead objective-based red team exercises that emulate realistic threat actors, mapped to MITRE ATT&CK</li><li> Run purple team sessions with the SOC to test and improve detection and response<br><br></li></ul>Report and drive fixes<br><br><ul><li> Write clear, risk-rated reports with evidence, attack narratives and practical remediation steps, plus a short executive summary in plain language</li><li> Brief technical teams and management on results, and explain business impact without exaggeration</li><li> Retest fixes, confirm closure, and pass validated findings to Vulnerability Management and Risk for tracking</li><li> Build reusable test cases, scripts and checklists to make testing faster and more consistent<br><br></li></ul><strong>Leadership Capabilities<br><br></strong><ul><li>Builds own understanding of our purpose and values; explores opportunities for impact. </li><li>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. </li><li>Understands expectations and demonstrates personal accountability for keeping performance on track. </li><li>Actively focuses on developing effective communication and relationship-building skills. </li><li>Understands how their daily work contributes to the priorities of the team and the business. <br><br></li></ul><strong>Qualifications<br><br></strong><ul><li> Years of experience: 2-7 total years</li><li> Bachelor's in cybersecurity, computer science or a related field, or equivalent practical experience</li><li> Hands-on experience delivering penetration tests for real organisations, not only labs or CTFs</li><li> Strong with core tools: Burp Suite, Nmap, Metasploit, BloodHound and common post-exploitation frameworks</li><li> Scripting in Python, Bash or PowerShell</li><li> Strong report writing in English</li><li> A recognised hands-on offensive certification (e.g. OSCP) for Mid and Senior levels</li><li> Red team experience with C2 frameworks (e.g. Cobalt Strike, Sliver, Mythic) is preferred.</li><li> Mobile application and cloud penetration testing experience is preferred.</li><li> Exploit development or code review skills is preferred.</li><li> Experience testing hospitality, payments, smart-city or OT-adjacent environments is preferred.</li><li> Arabic language is preferred.</li><li> At least one preferred: OSCP, CREST CRT/CCT, GPEN. Also valued: OSEP, OSWE, CRTO, GWAPT, eCPPT/eWPT, PNPT. CEH is accepted at Junior level only.</li><li> Frameworks & Standards: NCA ECC-2:2024 (penetration testing)</li><li> NIST SP 800-115</li><li> PTES</li><li> OWASP WSTG / ASVS / MASTG</li><li> MITRE ATT&CK</li><li> CREST methodology</li></ul>
Senior Consultant – Senior Manager| Cyber Operate | Security Architecture | KSA
Information Technology
Saudi - Riyadh
<strong>About Deloitte:</strong> When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.<br><br><strong>Our Purpose<br><br></strong>Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.<br><br>Our shared values guide the way we behave to make a positive, enduring impact:<br><br><ul><li> Lead the way</li><li> Serve with integrity</li><li> Take care of each other</li><li> Foster inclusion</li><li> Collaborate for measurable impact<br><br></li></ul>During your tenure as a <strong>Senior Consultant – Senior Manager,</strong> you will demonstrate and develop your capabilities in the following areas.<br><br><strong>Set the architecture and standards<br><br></strong><ul><li> Define and maintain the cybersecurity reference architecture, design principles and reusable security patterns, and publish them as the standard projects must follow</li><li> Write technical security standards for identity, network, cloud, endpoint, data protection and application security, mapped to NCA ECC, CCC, DCC and NIST SP 800-53</li><li> Design the zero trust target architecture and a phased path to reach it<br><br></li></ul><strong>Assure new solutions<br><br></strong><ul><li> Run security architecture reviews and design approvals for new projects, platforms and vendor solutions, and issue clear review reports with conditions</li><li> Lead threat modelling for critical and guest-facing systems, focusing on the threats that matter rather than long generic lists</li><li> Explain design trade-offs in plain terms to engineers, project managers and executives, and hold the line on risks that can't be accepted<br><br></li></ul><strong>Design Key Security Capabilities<br><br></strong><ul><li> Design controls for identity and privileged access, network segmentation, secure remote access, encryption and key management, and cloud security posture</li><li> Embed security into the SDLC and DevSecOps pipelines with engineering and AppSec teams</li><li> Evaluate and select security technologies with practical proof-of-concept testing, and maintain the security technology roadmap<br><br></li></ul><strong>Work across the programme<br><br></strong><ul><li> Work with the Strategy team so the architecture supports the roadmap, and with OT Security on IT/OT boundaries</li><li> Keep an up-to-date view of architecture risks and exceptions, and report them to governance<br><br></li></ul><strong>Leadership Capabilities<br><br></strong><ul><li> Builds own understanding of our purpose and values; explores opportunities for impact.</li><li> Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.</li><li> Understands expectations and demonstrates personal accountability for keeping performance on track.</li><li> Actively focuses on developing effective communication and relationship-building skills.</li><li> Understands how their daily work contributes to the priorities of the team and the business. <br><br></li></ul><strong>Qualifications<br><br></strong><ul><li> Years of experience: 6-10 total years</li><li> Bachelor's in computer science, engineering or a related field</li><li> Hands-on depth in at least two of: identity and access, network security, cloud security (Azure, AWS or GCP), application security</li><li> Has produced security architectures or design reviews for real systems in production</li><li> Working knowledge of NCA ECC, CCC and DCC, and NIST SP 800-53</li><li> Clear written and verbal English</li><li> SABSA or TOGAF training or practice</li><li> Zero trust design and implementation experience (NIST SP 800-207)</li><li> Experience with large digital, hospitality, smart-city or critical-infrastructure environments</li><li> Arabic Language is a bonus</li><li> At least one preferred: CISSP (ISSAP a plus), SABSA, CCSP. Also valued: TOGAF, AZ-500 / SC-100, AWS Certified Security – Specialty, CCSK.</li><li> Frameworks Knowledge: NCA ECC-2:2024</li><li> NCA CCC</li><li> NCA DCC</li><li> NIST SP 800-53 Rev 5</li><li> NIST SP 800-207</li><li> ISO/IEC 27001/27002:2022</li><li> SABSA</li><li> TOGAF</li></ul>
Senior Consultant – Manager| Cyber Operate | Application Security Specialist | KSA
Information Technology
Saudi - Riyadh
<strong>About Deloitte</strong>: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.<br><br><strong>Our Purpose<br><br></strong>Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.<br><br>Our shared values guide the way we behave to make a positive, enduring impact:<br><br>During your tenure as a Senior Consultant – Manager, you will demonstrate and develop your capabilities in the following areas.<br><br>Set the secure development standard<br><br><ul><li> Define the secure SDLC, secure coding standards and application security requirements, aligned with NCA ECC, OWASP ASVS and NIST SSDF</li><li> Set security requirements and acceptance criteria for in-house and vendor-built applications, including contract clauses and release checks</li><li> Build and maintain the application inventory, with a risk rating for each application<br><br></li></ul>Embed security in the pipeline<br><br><ul><li> Implement and tune SAST, DAST, SCA and secrets scanning in CI/CD pipelines (e.g. Checkmarx, Fortify, Veracode, SonarQube, Snyk, Burp Suite)</li><li> Triage tool findings, remove noise, and give developers clear, fix-ready guidance so security doesn't slow releases</li><li> Review container, infrastructure-as-code and cloud-native deployments with DevOps teams<br><br></li></ul>Assess applications in depth<br><br><ul><li> Run application security assessments of web, mobile and API applications, including manual testing of authentication, authorization and business logic</li><li> Perform secure code reviews of high-risk features and components</li><li> Lead threat modelling for new applications and major changes, working with architects and development teams</li><li> Review third-party and SaaS applications before they are adopted<br><br></li></ul>Drive fixes and build skills<br><br><ul><li> Track application vulnerabilities to closure with development teams and vendors; verify fixes before release</li><li> Report application risk posture and trends to management</li><li> Train developers on secure coding, OWASP Top 10 and API Security Top 10, and build a network of security champions in development teams<br><br></li></ul><strong>Leadership Capabilities<br><br></strong><ul><li>Builds own understanding of our purpose and values; explores opportunities for impact. </li><li>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. </li><li>Understands expectations and demonstrates personal accountability for keeping performance on track. </li><li>Actively focuses on developing effective communication and relationship-building skills. </li><li>Understands how their daily work contributes to the priorities of the team and the business. <br><br></li></ul><strong>Qualifications<br><br></strong><ul><li>Years of experience: 4-8+ total years</li><li>Bachelor's in computer science, software engineering or a related field</li><li>Software development background in at least one language (e.g. Java, C#/.NET, JavaScript/TypeScript, Python), with the ability to read and review code</li><li>Hands-on experience with SAST, DAST and SCA tools in real development environments</li><li>Strong knowledge of OWASP Top 10, API Security Top 10 and ASVS</li><li>Experience with CI/CD pipelines and DevSecOps practices</li><li>Mobile application security experience (OWASP MASVS/MASTG) is preferred.</li><li>Cloud-native and container security (Kubernetes, Docker, infrastructure-as-code) is preferred.</li><li>Experience with payment or customer-facing platforms (PCI DSS awareness) is preferred.</li><li>Experience running a security champions programme is preferred.</li><li>Arabic Language is preferred.</li><li>At least one preferred: CSSLP, GWEB, OSWE. Also valued: GWAPT, CASE, eWPT, Burp Suite Certified Practitioner.</li><li>Frameworks & Standards: NCA ECC-2:2024</li><li> OWASP ASVS / SAMM / Top 10 / API Security Top 10</li><li> NIST SP 800-218 (SSDF)</li><li> ISO/IEC 27001:2022 (A.8.25–A.8.29)</li><li> PCI DSS v4.0 (awareness)</li></ul>
Consultant – Senior Manager| Cyber Operate | Cybersecurity Compliance Specialist | KSA
Information Technology
Saudi - Riyadh
<strong>About Deloitte</strong>: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.<br><br><strong>Our Purpose<br><br></strong>Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.<br><br>Our shared values guide the way we behave to make a positive, enduring impact:<br><br>During your tenure as a Consultant – Senior Manager, you will demonstrate and develop your capabilities in the following areas.<br><br>Assess compliance<br><br><ul><li> Run compliance assessments against NCA ECC-2:2024 and other applicable NCA controls: CSCC (critical systems), CCC (cloud), DCC (data), OTCC (OT), TCC (telework) and OSMACC (social media accounts)</li><li> Assess compliance with ISO/IEC 27001:2022, PDPL data protection requirements and other obligations that apply to the organisation</li><li> Assess new systems, projects and major changes for compliance before go-live</li><li> Interview control owners, review policies and procedures, and judge whether each control is fully, partially or not implemented<br><br></li></ul>Test that controls work<br><br><ul><li> Test control effectiveness through evidence sampling and technical checks: user access reviews, privileged account listings, firewall rules, logging and monitoring configuration, backup and restore records, patch status and hardening baselines</li><li> Validate technical configurations against required baselines, using automated compliance scans where available</li><li> Challenge weak or outdated evidence, and record clear, defensible findings<br><br></li></ul>Prepare for regulators and audits<br><br><ul><li> Prepare NCA compliance self-assessments, evidence packs and submissions, and support NCA assessments and other regulatory reviews</li><li> Support ISO/IEC 27001 certification and surveillance audits, and internal audit reviews</li><li> Coordinate responses to auditor requests and track audit findings to closure<br><br></li></ul>Track and report<br><br><ul><li> Maintain the compliance obligations register and the control-to-evidence mapping across NCA, ISO and NIST</li><li> Agree remediation plans with control owners, follow them through to closure, and verify fixes</li><li> Report compliance status, trends and overdue actions to management and governance committees</li><li> Monitor new and updated regulations (NCA, SDAIA/PDPL, NDMO) and assess their impact on the organization<br><br></li></ul><strong>Leadership Capabilities<br><br></strong><ul><li>Builds own understanding of our purpose and values; explores opportunities for impact. </li><li>Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. </li><li>Understands expectations and demonstrates personal accountability for keeping performance on track. </li><li>Actively focuses on developing effective communication and relationship-building skills. </li><li>Understands how their daily work contributes to the priorities of the team and the business. <br><br></li></ul><strong>Qualifications<br><br></strong><ul><li>Years of experience: 2-8 total years</li><li>Bachelor's in cybersecurity, IT or a related field</li><li>Hands-on NCA ECC compliance assessment experience in Saudi Arabia (Mid and Senior)</li><li>Practical control testing and evidence review skills, with enough technical understanding to assess access, network, logging and configuration controls</li><li>Working knowledge of ISO/IEC 27001 and NIST CSF 2.0</li><li>Clear, precise written English</li><li>Experience with other NCA frameworks (CSCC, CCC, DCC, OTCC) is preferred.</li><li>Experience supporting NCA assessments or ISO/IEC 27001 certification audits is preferred.</li><li>Knowledge of PDPL and NDMO data management requirements is preferred.</li><li>Experience with a GRC platform (Archer, ServiceNow GRC, MetricStream or similar) is preferred.</li><li>Arabic language is preferred.</li><li>At least one preferred: CISA, ISO/IEC 27001 Lead Auditor, CISM. Also valued: CRISC, CISSP, CDPSE.</li><li> Frameworks & Standards: NCA ECC-2:2024</li><li> NCA CSCC / CCC / DCC / OTCC / TCC / OSMACC</li><li> ISO/IEC 27001:2022</li><li> NIST CSF 2.0</li><li> PDPL</li><li> NDMO Data Management Standards</li></ul>