Consultant - Manager | Cyber Operate | Third-Party Risk Assessor | KSA

Consultant - Manager | Cyber Operate | Third-Party Risk Assessor | KSA About Deloitte : When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award. Our Purpose Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities. Our shared values guide the way we behave to make a positive, enduring impact: During your tenure as a Consultant – Manager, you will demonstrate and develop your capabilities in the following areas Design and maintain the TPRM framework · Design the third-party and supply chain cybersecurity risk management framework: scope, roles and RACI across Cybersecurity, Procurement, Legal and business owners, risk tiering model, assessment depth per tier, and risk rating methodology · Write and maintain the third-party cybersecurity policy, processes, procedures and SOPs for each lifecycle stage: intake, tiering, due diligence, contracting, onboarding, monitoring, reassessment, issue management, exceptions and offboarding · Build the supporting toolkit: tiered questionnaires, evidence checklists, assessment and report templates, standard contract clauses and supplier security requirements schedules · Embed TPRM steps into procurement and contract management processes, so no high-risk supplier is onboarded without a cybersecurity assessment · Define TPRM KPIs and KRIs (coverage, overdue assessments, open high-risk findings), and review and update the framework regularly to reflect new NCA requirements, incidents and lessons learned Run the third-party risk lifecycle · Tier third parties by inherent risk, based on the data they handle, the systems they access, the service's criticality and their location · Run due diligence before onboarding and before contract renewal, scaled to the tier · Run periodic reassessments and manage secure offboarding, including access removal and return or deletion of data Assess third parties · Issue and review security questionnaires (e.g. SIG, CAIQ), and judge answers against evidence rather than accepting them at face value · Review evidence such as ISO/IEC 27001 certificates and scope, SOC 2 reports, penetration test summaries, policies and incident history, and spot gaps, exclusions and out-of-date documents · Carry out remote and on-site assessments of high-risk suppliers, including technical checks of how they protect the organisation's data and access · Assess cloud and SaaS providers against NCA CCC and cloud security good practice, including data residency, encryption, access control and shared-responsibility gaps · Assess contractors and integrators with remote or on-site access to IT and OT systems, working with the OT Security team · Review suppliers' external attack surface and security ratings (e.g. SecurityScorecard, BitSight) as additional evidence Manage supply chain cybersecurity risk · Map critical supply chains, including the sub-contractors and fourth parties that critical suppliers rely on, and identify single points of failure and concentration risk (e.g. many services depending on one cloud provider or integrator) · Software supply chain: set requirements for secure development, software bills of materials (SBOM), open-source component risk, code signing and integrity of updates and patches, working with the Application Security team · Hardware and device supply chain: set requirements for the provenance, firmware integrity and secure configuration of IT, OT and IoT equipment delivered by vendors and integrators · Make sure critical suppliers have tested incident response, business continuity and exit plans, and agree how they will notify and work with the organisation during an incident · Coordinate the organisation's response to supplier breaches and supply-chain vulnerabilities: assess exposure quickly, contain access and track supplier actions · Apply NIST SP 800-161 and ISO/IEC 27036 good practice to supply chain risk management Make contracts protect the organisation · Define standard cybersecurity and data protection clauses with Procurement and Legal: security requirements, right to audit, breach notification, sub-contractor controls, data location and PDPL obligations · Review contracts and statements of work for high-risk suppliers, and make sure risk findings are reflected i

Design and maintain the TPRM framework; Run the third-party risk lifecycle; Assess third parties; Manage supply chain cybersecurity risk; Make contracts protect the organisation.