Senior Consultant/Manager | Cyber Operate | Cyber Performance Management Specialist |KSA

Senior Consultant/Manager | Cyber Operate | Cyber Performance Management Specialist |KSA About Deloitte : When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award. Our Purpose Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities. Our shared values guide the way we behave to make a positive, enduring impact: During your tenure as a Senior Consultant/Manager, you will demonstrate and develop your capabilities in the following areas Design the performance framework · Design the cybersecurity performance management framework: objectives, KPIs, KRIs, SLAs, targets and thresholds, data sources, owners, collection frequency and reporting lines · Write and maintain the supporting methodology, procedures and SOPs for data collection, validation, calculation, review and sign-off · Align metrics with the cybersecurity strategy, NCA ECC requirements and NIST CSF 2.0, so they measure outcomes and risk reduction, not just activity · Review and refine metrics regularly, retiring ones that no longer drive decisions Define success metrics for cybersecurity functions and roles · Define clear success metrics for each cybersecurity function and its roles, agreed with each domain lead, for example: o Strategy and architecture: roadmap milestones delivered, maturity uplift, designs reviewed before go-live, architecture exceptions open o Vulnerability management and penetration testing: scan coverage, remediation within SLA, ageing of critical vulnerabilities, retest closure rate, repeat findings o Application and OT security: applications onboarded to secure SDLC, critical code findings fixed before release, OT assets inventoried and monitored, OTCC gaps closed o Risk and compliance: risks assessed and treated on time, overdue treatment plans, NCA ECC compliance score and trend, audit findings closed o Third-party and supply chain: critical suppliers assessed before onboarding, reassessments on time, high-risk supplier findings open, critical suppliers with tested exit and continuity plans, fourth-party and concentration risks identified, supplier incidents and notification times o Governance and awareness: policies current and approved, committee actions closed, training completion, phishing simulation trends · Define how each metric is measured: formula, data source, baseline, target, frequency, owner and evidence, so results are consistent and can be audited · Set measures at three levels: programme outcomes, function performance, and role and team contribution, and link them so leaders can see how individual work adds up to programme results · Support domain leads in using the metrics for team objectives and performance reviews Work with the Governance team · Work closely with the Governance & PMO team to understand governance implementation requirements: approved policies, standards, roles and RACI, committee decisions and NCA obligations · Turn those requirements into measurable indicators, such as policy implementation and adherence, SOP compliance, role coverage, and committee decision and action closure rates · Track whether governance decisions are actually implemented on the ground, and report gaps back to the Governance team and steering committee · Provide performance evidence for ISMS management reviews and NCA compliance reporting Measure services and the programme · Track the service levels and performance of managed security services and key security vendors, and run monthly service reviews with clear actions · Track programme delivery and benefits against plan, with the PMO · Measure cybersecurity maturity and NCA compliance trends over time, with the Strategy and Compliance teams Build dashboards and reports · Build and maintain dashboards and scorecards for the CISO, steering committee and board (e.g. Power BI), with drill-down by function, team and role · Automate data collection from security tools, GRC, TPRM and ticketing platforms where possible, so reports are timely and consistent · Produce monthly and quarterly performance reports that explain what changed, why, and what needs to happen next, written in plain language for executives Drive improvement · Spot negative trends and missed targets early, analyse root causes with the owners,

Not explicitly separated into a Requirements/Qualifications section in the posting. The content describes responsibilities, metrics, and interactions but does not enumerate a distinct list of candidate prerequisites.

Design the cybersecurity performance management framework; define success metrics for cybersecurity functions and roles; define how each metric is measured (formula, data source, baseline, target, frequency, owner, evidence); set measures at three levels (programme outcomes, function performance, role and team contribution); support domain leads in using metrics for objectives and performance reviews; work with Governance & PMO to understand governance requirements and turn them into measurable indicators; track governance implementation through policy adherence, SOP compliance, role coverage, and decision closure rates; provide performance evidence for ISMS management reviews and NCA compliance; measure service levels and programme delivery; build dashboards and reports (Power BI) with drill-down by function, team, and role; automate data collection from security tools, GRC, TPRM and ticketing platforms; produce monthly and quarterly performance reports; spot negative trends, analyze root causes with owners, and drive improvement.