Consultant – Manager| Cyber Operate | Cybersecurity Risk Specialist | KSA

Deloitte Development LLC; Riyadh; On-site; SAR 300,000 - 520,000; Full time

Job summary

Deloitte in Saudi Arabia is seeking a Consultant – Manager, Cyber Operate, Cybersecurity Risk Specialist to lead risk design and governance across enterprise IT and critical infra. You will define the risk framework, assess top cyber risks, oversee treatment plans and produce clear reports for management and risk committees.

4–8 years’ experience and a Bachelor’s in cybersecurity or related field are required; Arabic language is preferred.

Qualifications

• 4–8 years of experience in cyber risk management or related field.
• Bachelor's degree in cybersecurity, IT, risk management or related field.
• Familiarity with ISO/IEC 27005, NIST SP 800-30, ISO 31000 and NCA ECC.
• Experience with GRC platforms (Archer, ServiceNow IRM, MetricStream) preferred.

Responsibilities

• Define the cyber risk management framework and methodology.
• Assess top cyber risks across the enterprise and with project teams.
• Maintain risk treatments, KRIs, and risk registers with owners and timelines.
• Produce risk reports and heat maps for management and risk committees.

Skills

Cyber risk management

Risk assessment

Policy & governance

Education

Bachelor's degree in cybersecurity, IT, risk management or related field

Tools

Archer

ServiceNow IRM

MetricStream

Job description

Consultant – Manager| Cyber Operate | Cybersecurity Risk Specialist | KSA

About Deloitte : When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.

Our Purpose

Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.

Our shared values guide the way we behave to make a positive, enduring impact:

During your tenure as a Consultant – Manager, you will demonstrate and develop your capabilities in the following areas.

Define the risk framework

• Design the cybersecurity risk management framework and methodology: risk taxonomy, asset and impact criteria, likelihood scales, risk matrix and scoring rules
• Define risk appetite and tolerance statements for cyber risk with leadership, aligned with the enterprise risk management (ERM) framework and ISO 31000
• Write the risk management policy, procedures and templates, including risk acceptance, exceptions and escalation thresholds
• Align the framework with NCA ECC risk management requirements, ISO/IEC 27005 and NIST SP 800-30

Assess cyber risk

• Enterprise level: identify and assess the organisation's top cyber risks and scenarios (e.g. ransomware, data breach, payment fraud, service outage, OT disruption) with business and technology leaders
• Systems and projects: run risk assessments for critical systems, new projects and major changes before go-live, and agree treatment with owners
• New technology: assess the risk of adopting new technologies such as cloud services, AI and IoT platforms, and recommend conditions for safe use
• Specialist inputs: bring together findings from vulnerability management, penetration testing, OT security, third-party risk and threat intelligence into a single, joined-up risk view
• Run risk workshops that get honest input from business owners, and challenge optimistic or vague risk ratings

Treat and monitor risk

• Maintain the cyber risk register: owners, ratings, treatment plans, due dates and status
• Track treatment plans to completion, re-assess residual risk, and escape overdue or rising risks
• Manage the risk acceptance and exception process, making sure acceptances are justified, approved at the right level and time-limited
• Define key risk indicators (KRIs) and thresholds, and monitor them with the Performance Management team

Report and advise

• Produce clear risk reports and heat maps for management and the risk committee, explaining what changed, why it matters and what decisions are needed
• Senior: introduce quantitative risk analysis (e.g. FAIR) for top risks to express exposure in financial terms
• Configure and run risk workflows in the GRC platform (e.g. Archer, ServiceNow IRM, MetricStream)

Leadership Capabilities:

• Builds own understanding of our purpose and values; explores opportunities for impact.
• Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.
• Understands expectations and demonstrates personal accountability for keeping performance on track.
• Actively focuses on developing effective communication and relationship-building skills.
• Understands how their daily work contributes to the priorities of the team and the business.

Qualifications:

Years of experience: 4-8 total years

Bachelor's in cybersecurity, IT, risk management or a related field

Has designed or substantially improved a cyber or IT risk methodology (Senior), or run risk assessments end to end (Mid)

Strong understanding of cybersecurity threats and controls, enough to judge technical risk credibly

Working knowledge of ISO/IEC 27005, NIST SP 800-30, ISO 31000 and NCA ECC

Clear written English for management and committee reporting

Experience with a GRC platform (Archer, ServiceNow IRM, MetricStream or similar) is preferred.

Quantitative risk analysis experience (FAIR) is preferred.

Experience linking cyber risk to enterprise risk management in a large organisation is preferred.

Background in large-scale development, hospitality, financial services or critical infrastructure is preferred.

Arabic Language is preferred.

• At least one preferred: CRISC, ISO/IEC 27005 Risk Manager, CISM. Also valued: Open FAIR, CISSP, ISO 31000 Risk Manager.