Third-Party Cybersecurity Risk Assessor

Consultant - Manager | Cyber Operate | Third-Party Risk Assessor | KSA

About Deloitte: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.

Our Purpose

Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.

Our shared values guide the way we behave to make a positive, enduring impact:

During your tenure as a Consultant – Manager, you will demonstrate and develop your capabilities in the following areas

Design and maintain the TPRM framework

· Design the third-party and supply chain cybersecurity risk management framework: scope, roles and RACI across Cybersecurity, Procurement, Legal and business owners, risk tiering model, assessment depth per tier, and risk rating methodology

· Write and maintain the third-party cybersecurity policy, processes, procedures and SOPs for each lifecycle stage: intake, tiering, due diligence, contracting, onboarding, monitoring, reassessment, issue management, exceptions and offboarding

· Build the supporting toolkit: tiered questionnaires, evidence checklists, assessment and report templates, standard contract clauses and supplier security requirements schedules

· Embed TPRM steps into procurement and contract management processes, so no high-risk supplier is onboarded without a cybersecurity assessment

· Define TPRM KPIs and KRIs (coverage, overdue assessments, open high-risk findings), and review and update the framework regularly to reflect new NCA requirements, incidents and lessons learned

Run the third-party risk lifecycle

· Tier third parties by inherent risk, based on the data they handle, the systems they access, the service's criticality and their location

· Run due diligence before onboarding and before contract renewal, scaled to the tier

· Run periodic reassessments and manage secure offboarding, including access removal and return or deletion of data

Assess third parties

· Issue and review security questionnaires (e.g. SIG, CAIQ), and judge answers against evidence rather than accepting them at face value

· Review evidence such as ISO/IEC 27001 certificates and scope, SOC 2 reports, penetration test summaries, policies and incident history, and spot gaps, exclusions and out-of-date documents

· Carry out remote and on-site assessments of high-risk suppliers, including technical checks of how they protect the organisation's data and access

· Assess cloud and SaaS providers against NCA CCC and cloud security good practice, including data residency, encryption, access control and shared-responsibility gaps

· Assess contractors and integrators with remote or on-site access to IT and OT systems, working with the OT Security team

· Review suppliers' external attack surface and security ratings (e.g. SecurityScorecard, BitSight) as additional evidence

Manage supply chain cybersecurity risk

· Map critical supply chains, including the sub-contractors and fourth parties that critical suppliers rely on, and identify single points of failure and concentration risk (e.g. many services depending on one cloud provider or integrator)

· Software supply chain: set requirements for secure development, software bills of materials (SBOM), open-source component risk, code signing and integrity of updates and patches, working with the Application Security team

· Hardware and device supply chain: set requirements for the provenance, firmware integrity and secure configuration of IT, OT and IoT equipment delivered by vendors and integrators

· Make sure critical suppliers have tested incident response, business continuity and exit plans, and agree how they will notify and work with the organisation during an incident

· Coordinate the organisation's response to supplier breaches and supply-chain vulnerabilities: assess exposure quickly, contain access and track supplier actions

· Apply NIST SP 800-161 and ISO/IEC 27036 good practice to supply chain risk management

Make contracts protect the organisation

· Define standard cybersecurity and data protection clauses with Procurement and Legal: security requirements, right to audit, breach notification, sub-contractor controls, data location and PDPL obligations

· Review contracts and statements of work for high-risk suppliers, and make sure risk findings are reflected in contract conditions

Track, monitor and report

· Track supplier remediation actions to closure, and escalate suppliers who don't act

· Monitor critical suppliers continuously for breaches, rating drops and changes in their service

· Maintain the third-party inventory and risk register in the TPRM platform (e.g. OneTrust, ProcessUnity, Archer, ServiceNow VRM)

· Report third-party and supply chain risk posture, overdue assessments and high-risk suppliers to management, and feed results into the enterprise cyber risk register

Leadership Capabilities:

• Builds own understanding of our purpose and values; explores opportunities for impact.
• Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.
• Understands expectations and demonstrates personal accountability for keeping performance on track.
• Actively focuses on developing effective communication and relationship-building skills.
• Understands how their daily work contributes to the priorities of the team and the business.

Qualifications:

· Years of experience: 2- 8 years

· Bachelor's in IT, cybersecurity or a related field

· Hands-on experience assessing vendors' cybersecurity against ISO/IEC 27001, NIST or NCA requirements

· Has designed or updated a TPRM framework, policy, procedures or SOPs (Senior); has contributed to them (Mid)

· Able to read and challenge SOC 2 reports, ISO certificates and security evidence

· Understanding of supply chain risks: fourth parties, concentration, and software and hardware supply chain threats

· Enough technical understanding to judge cloud, access and data protection controls credibly

· Working knowledge of NCA ECC third-party and cloud requirements, and PDPL.

· Clear written English for reports, procedures and supplier communications

· Experience with a TPRM platform (OneTrust, ProcessUnity, Archer, ServiceNow VRM or similar)

· Experience with security rating services (SecurityScorecard, BitSight, UpGuard)

· Experience with software supply chain controls (SBOM, SCA, code signing) or hardware and firmware assurance

· Background in IT audit or procurement risk

· Experience assessing construction, facilities or OT contractors

· Arabic language is a plus

· At least one preferred: CTPRP, CISA, ISO/IEC 27001 Lead Auditor. Also valued: CTPRA, CRISC, CCSK, CDPSE.

· NCA ECC-2:2024 (third-party and cloud cybersecurity) · NCA CCC · ISO/IEC 27036 (parts 1–4) · NIST SP 800-161 Rev 1 · NIST SP 800-218 (SSDF) · NIST CSF 2.0 (Govern – Supply Chain) · PDPL · Shared Assessments SIG · CSA CAIQ