Technical Cyber Risk Assessment Manager, Deloitte Global Technology

• Perform in-depth technical cybersecurity risk assessments across cloud, identity, network, infrastructure, applications, and platforms.
• Validate actual control effectiveness by reviewing live configurations, security tooling outputs, logs, and architecture implementations.
• Provide expert challenge and guidance to DT teams on control design gaps, compensating controls, and risk reduction options.
• Oversee end-to-end technical risk assessments, ensuring risks are identified, findings appropriately communicated / acknowledged and risk treatment agreed and documented with all DT stakeholders.
• Provide oversight and technical assurance on the implementation of security controls within DT infrastructure, platforms, cloud, identity, and endpoint technologies.
• Work with Cybersecurity Architects to apply DT reference architectures and validate that deployed solutions align to design intent, patterns, and standards.
• Collaborate with the Deloitte Cyber Threat Intelligence (DCTI) and Security Operations Center (SOC) teams to evaluate how effective deployed controls are against real threats, incidents, peer-industry threat intelligence, and emerging TTPs.
• Escalate material threats or misconfigurations to DT leadership and support the design of effective remediation and mitigation strategies.
• Stay current on cybersecurity threats, vulnerabilities, emerging technologies, and relevant regulations/standards (e.g., NIST CSF 2.0, ISO 27001/27002, SOC 2).
• Monitor threat intelligence sources, industry reports, and community research to identify risks relevant to Deloitte's environment.
• Advise leadership on trends that require updates to controls, processes, playbooks, or preparedness activities.
• Conduct formal technology security risk assessments using Deloitte-aligned methodologies and industry standards (ISO 27005, NIST CSF, FAIR where appropriate).
• Ensure risks are clearly documented, rated, tracked, and communicated with stakeholders, including risk acceptance or remediation plans.
• Maintain strong documentation discipline aligned with Deloitte's Technology GRC requirements.
• Build and maintain strong relationships with Security Architecture & Engineering, Shared Cyber Services, Global Business Services, Member Firm Services, and Technology leadership teams.
• Translate complex technical issues into clear, business-orientated narratives for senior stakeholders.
• Facilitate risk treatment discussions and negotiate realistic remediation solutions.
• Produce clear, technically rigorous, and publication-ready risk assessment reports suitable for distribution across Deloitte's global member firms.
• Translate complex technical findings into concise, structured, business-relevant narratives that can be understood by engineering teams, leadership, and non-technical stakeholders.
• Ensure reports meet Deloitte's Technology GRC requirements, including defensible evidence, consistent risk ratings, traceability, and clear remediation guidance.
• Act as a knowledge-sharing catalyst by contributing high-quality documentation, reusable assessment artefacts, and thought leadership to the global cybersecurity community within Deloitte.

• Strong technical experience across cloud (Azure/AWS/GCP), identity platforms, infrastructure, network security, endpoint security, and/or application security.
• Proven ability to perform hands-on technical assessment and configuration review, not just policy audits.
• Strong grounding in cybersecurity risk management practices and control frameworks (NIST CSF, ISO/IEC 27001/27002, ISO/IEC 27005).
• Experience working with security operations, threat intelligence, and architecture teams.
• Ability to influence engineering teams and negotiate practical control improvements.
• Strong documentation, analytical, and communication skills suitable for senior and executive audiences.
• Experience in large, global, complex technology environments (preferably similar to Deloitte's scale).

• Relevant security certifications (CISSP, CISM, CRISC, CCSP, ISO 27001 Lead Auditor/Implementer).
• Familiarity with FAIR quantitative risk modelling.
• Experience with IaC security (Terraform), CI/CD pipelines, cloud native security services, and DevSecOps practices.
• Exposure to multi-cloud security architectures and Zero Trust.

• "route" is used for session stickiness
• "careerSiteCompanyId" is used to send the request to the correct data center
• "JSESSIONID" is placed on the visitor's device during the session so the server can identify the visitor
• "Load balancer cookie" (actual cookie name may vary) prevents a visitor from bouncing from one instance to another

Deloitte