Director Cyber Cloud Security GCC

About Deloitte: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.

Our Purpose

Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.

Our shared values guide the way we behave to make a positive, enduring impact:

• Lead the way
• Serve with integrity
• Take care of each other
• Foster inclusion
• Collaborate for measurable impact
  
  

During your tenure as a Director, you will demonstrate and develop your capabilities in the following areas:

Client Leadership & Executive Advisory

• Act as a senior trusted advisor to CIOs, CISOs, CTOs, Chief Risk Officers, cloud leaders, and boards on cloud security strategy, risk, architecture, and transformation.
• Lead executive workshops and steering committees, translating complex technical risks into clear business impact, investment priorities, and actionable roadmaps.
• Advise clients on cloud security operating models, governance structures, risk appetite, control frameworks, regulatory obligations, and secure cloud adoption.
• Build durable senior client relationships that generate repeat advisory work, implementation opportunities, and multi-year transformation programmes.
• Represent the firm with credibility in complex, politically sensitive, and commercially significant client environments.
  
  

Cloud Security Strategy & Transformation

• Lead the design of enterprise cloud security strategies across AWS, Azure, Google Cloud, hybrid, private cloud, and SaaS environments.
• Develop secure cloud landing zones, reference architectures, security baselines, guardrails, and target-state operating models.
• Advise on Zero Trust adoption, identity-first security, secure remote access, privileged access management, data protection, and secure network segmentation.
• Define cloud security governance models, including policy frameworks, exception management, risk acceptance, control ownership, and continuous assurance.
• Support clients in establishing measurable cloud security maturity roadmaps, prioritised by business risk, regulatory exposure, technical feasibility, and investment return.
  
  

Technical Assessment & Architecture Review

• Lead complex cloud security assessments, architecture reviews, threat models, red-team-informed reviews, and control-effectiveness evaluations across IaaS, PaaS, SaaS, containers, and serverless environments.
• Assess security posture across major cloud platforms, including:
• Identity and access management: Entra ID, IAM, Okta, Ping, privileged access, federation, SSO, entitlement sprawl, and identity governance.
• Cloud platform security: AWS Organizations, Azure Management Groups, Google Cloud Organization policies, landing zones, resource hierarchies, and multi-account/multi-tenant architectures.
• Network security: VPC/VNet design, private connectivity, segmentation, egress controls, firewalling, WAF, DDoS protection, and hybrid connectivity.
• Data protection: Encryption, key management, KMS/HSM, tokenisation, data classification, DLP, backup resilience, and cross-border data controls.
• Detection and response: Cloud-native logging, SIEM/SOAR integration, XDR/CXDR, threat detection, incident response, forensics readiness, and recovery.
• Application and workload security: Container and Kubernetes security, API security, serverless security, CI/CD pipeline security, and software supply-chain controls.
• Cloud security tooling: CSPM, CNAPP, CIEM, DSPM, CWPP, IaC scanning, secrets management, policy-as-code, and posture management platforms.
• Identify material misconfigurations, excessive privileges, lateral-movement paths, data-exposure risks, control gaps, and resilience weaknesses.
• Produce technically rigorous findings, risk-rated remediation plans, architecture recommendations, and executive-ready reports.
• Quality-assure complex client deliverables and ensure findings are defensible, commercially relevant, and actionable.
  
  

DevSecOps & Engineering Integration

• Advise clients on embedding security across the software development lifecycle, including secure-by-design principles, threat modelling, secure coding standards, and automated controls.
• Assess and improve CI/CD security, infrastructure-as-code governance, pipeline integrity, artefact signing, dependency management, and secrets protection.
• Guide adoption of policy-as-code, automated compliance checks, security testing, and continuous control validation.
• Partner with cloud engineering, platform, DevOps, and application teams to ensure security recommendations are practical, scalable, and commercially viable.
• Advise on security automation opportunities that reduce manual effort, improve control consistency, and accelerate secure delivery.
  
  

Regulatory, Risk & Resilience Advisory

• Advise clients on cloud-related regulatory and compliance obligations, including NIST CSF, ISO 27001, CIS Benchmarks, CSA CCM, SOC 2, PCI DSS, GDPR, DORA, and sector-specific requirements.
• Support cloud risk assessments, third-party and concentration-risk reviews, resilience assessments, and regulatory readiness programmes.
• Advise on business continuity, disaster recovery, backup strategy, ransomware resilience, and recovery-time objectives in cloud environments.
• Support incident preparedness, tabletop exercises, crisis-management planning, and post-incident remediation programmes.
• Help clients establish defensible risk narratives for boards, regulators, auditors, and external stakeholders.
  
  

Engagement Delivery & Quality

• Own end-to-end delivery of complex cloud security engagements, including scoping, methodology, resourcing, delivery governance, risk management, and client satisfaction.
• Ensure engagements are commercially viable, delivered on time and budget, and meet the firm’s quality, independence, and professional standards.
• Lead engagement planning, staffing decisions, delivery reviews, quality assurance, and escalation management.
• Develop and maintain reusable methodologies, assessment frameworks, technical baselines, report templates, and delivery accelerators.
• Monitor engagement economics, including utilisation, realisation, margin, scope discipline, and delivery risk.
  
  

Business Development & Market Growth

• Own a personal revenue target and contribute to the cloud security practice’s pipeline, revenue, and profitability objectives.
• Identify, qualify, and progress cloud security opportunities across existing clients and target accounts.
• Lead proposal development, solution design, pricing strategy, capability positioning, and bid defence for high-value pursuits.
• Build compelling propositions that differentiate the firm across cloud security assessment, transformation, DevSecOps, CNAPP/CSPM advisory, Zero Trust, and cloud resilience.
• Develop repeatable offerings, accelerators, assessment tools, benchmarking assets, and thought leadership that support scalable growth.
• Cultivate relationships with cloud providers, security vendors, alliances, industry bodies, and referral partners to expand market reach.
• Support cross-selling into broader cyber, technology transformation, risk, audit, and managed-services practices.
• Represent the firm at conferences, executive roundtables, client briefings, webinars, and industry forums.
  
  

People Leadership & Capability Development

• Recruit, lead, coach, and develop a high-performing team of cloud security consultants, architects, engineers, and managers.
• Set clear objectives, provide technical and commercial mentoring, and support progression toward senior manager and director-level roles.
• Build technical capability in cloud architecture, IAM, CNAPP/CSPM, Kubernetes, DevSecOps, detection and response, and secure transformation.
• Foster a culture of technical excellence, intellectual curiosity, client focus, collaboration, and ethical professional conduct.
• Support succession planning, knowledge sharing, and retention of critical cloud security talent.
  
  

Technical Expertise Required

• Multi-cloud platforms: Advanced experience with AWS and Azure; strong Google Cloud knowledge is highly desirable.
• Cloud architecture: Landing zones, multi-account/multi-subscription design, resource hierarchies, hybrid connectivity, and secure reference architectures.
• Identity and access: Cloud IAM, Entra ID, AWS IAM/Identity Center, federation, SSO, PAM, CIEM, least privilege, and identity governance.
• Cloud security tooling: CSPM, CNAPP, CIEM, CWPP, DSPM, IaC scanning, policy-as-code, and posture management platforms.
• Network and segmentation: VPC/VNet architecture, private connectivity, micro-segmentation, egress control, WAF, and secure hybrid designs.
• Data security: KMS/HSM, encryption, key rotation, data classification, DLP, backup resilience, and data-residency controls.
• Detection and response: Cloud-native logging, SIEM/SOAR integration, XDR/CXDR, detection engineering, incident response, and forensic readiness.
• Workload and application security: Containers, Kubernetes, serverless, API security, CI/CD security, and software supply-chain assurance.
• DevSecOps: Secure SDLC, threat modelling, IaC security, Terraform, GitHub Actions/Azure DevOps/GitLab CI, secrets management, and automated compliance.
• Security frameworks: NIST CSF, ISO 27001, CIS Benchmarks, CSA CCM, SOC 2, PCI DSS, GDPR, DORA, and relevant regional regulatory regimes.
• Emerging domains: AI/ML security, GenAI governance, SaaS security, third-party risk, quantum-readiness considerations, and resilient cloud operating models.
  
  

Business Development Expectations

• Build and maintain a qualified personal pipeline aligned to annual revenue and growth targets.
• Lead pursuits for complex, high-value cloud security engagements, typically involving multi-workstream delivery and executive sponsorship.
• Develop trusted-advisor relationships that convert advisory work into transformation, implementation, managed-service, and recurring-revenue opportunities.
• Contribute to account plans, cross-practice selling, and strategic growth in priority client accounts.
• Create differentiated propositions, point-of-view papers, benchmarks, and accelerators that strengthen the firm’s market position.
• Support pricing, commercial modelling, scope definition, and risk-adjusted engagement planning.
• Maintain strong win rates, client references, and repeat-business performance.
• Build the firm’s external brand through publications, speaking engagements, client events, and industry partnerships.
  
  

Leadership Capabilities

• Builds own understanding of our purpose and values; explores opportunities for impact.
• Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.
• Understands expectations and demonstrates personal accountability for keeping performance on track.
• Actively focuses on developing effective communication and relationship-building skills.
• Understands how their daily work contributes to the priorities of the team and the business. 
  
  

Qualifications

• 12+ years of progressive experience in cybersecurity, cloud security, security architecture, technology risk, or consulting.
• 5+ years leading complex cloud security engagements, assessments, or transformation programmes.
• 3+ years in a Director, Senior Manager, or equivalent leadership role with delivery, people, and commercial responsibility.
• Demonstrated experience advising large enterprise or regulated-sector clients on multi-cloud security strategy and transformation.
• Proven track record of winning, leading, and delivering high-value consulting engagements.
• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, Information Systems, or a related field; equivalent experience will be considered.
  
  

Preferred Certifications

• CISSP, CCSP, CISM, CISA, or CRISC.
• AWS Certified Security – Specialty or AWS Solutions Architect – Professional.
• Microsoft Certified: Azure Security Engineer Associate or Azure Solutions Architect Expert.
• Google Professional Cloud Security Engineer.
• TOGAF, SABSA, or equivalent enterprise/security architecture certification.
• Kubernetes security, DevSecOps, or cloud-native security certifications.
  
  

Success Measures

• Revenue, pipeline growth, win rate, engagement margin, and client references.
• Quality and commercial impact of cloud security assessments and transformation programmes.
• Adoption of firm methodologies, accelerators, and differentiated service offerings.
• Client satisfaction, repeat engagement, and executive-level relationships.
• Team capability, retention, engagement quality, and succession readiness.
• Measurable improvement in clients’ cloud security posture, resilience, and regulatory readiness.

---