Director | Cyber | Security Architecture | GCC

About Deloitte: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award. Our Purpose Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities. Our shared values guide the way we behave to make a positive, enduring impact: Lead the way Serve with integrity Take care of each other Foster inclusion Collaborate for measurable impact During your tenure as a Director, you will demonstrate and develop your capabilities in the following areas: Executive Advisory & Client Leadership Serve as a senior advisor to CISOs, CIOs, CTOs, Chief Architects, risk leaders, and executive committees on enterprise security architecture, cyber resilience, and secure technology transformation. Frame complex architecture and security challenges in business terms, connecting technical decisions to risk, resilience, regulatory exposure, cost, agility, and strategic growth. Lead executive workshops, architecture strategy sessions, target-state design workshops, and investment prioritisation discussions. Build long-term trusted-advisor relationships that generate repeat engagements, multi-year transformation programmes, and cross-practice opportunities. Represent the firm credibly in complex stakeholder environments, including boards, regulators, technology leadership, and third-party partners. Enterprise Security Architecture Strategy Lead the development of enterprise security architecture strategies, target-state operating models, roadmaps, and investment plans. Define security architecture principles, standards, control baselines, reference architectures, and reusable secure design patterns. Align security architecture with enterprise architecture, cloud strategy, data strategy, application modernisation, infrastructure transformation, and business operating models. Advise clients on pragmatic pathways from current-state complexity to secure, scalable target-state environments. Balance security, risk, regulatory requirements, commercial constraints, engineering feasibility, and speed to market. Architecture Assessment & Target-State Design Lead complex security architecture assessments across enterprise technology estates, including cloud, on-premises, hybrid, data centres, networks, applications, APIs, endpoints, OT, and third-party environments. Assess current-state architecture against security principles, business objectives, threat landscape, control effectiveness, resilience requirements, and regulatory obligations. Identify architectural risk, technical debt, control gaps, single points of failure, excessive complexity, and opportunities for consolidation or simplification. Design future-state security architectures across identity, network, endpoint, application, data, cloud, and operational technology domains. Develop transition roadmaps, sequencing plans, capability requirements, investment estimates, and measurable maturity outcomes. Zero Trust & Identity Architecture Lead the design and implementation of Zero Trust architectures across users, devices, networks, applications, data, workloads, and third-party access. Define Zero Trust operating models, policy frameworks, segmentation approaches, access controls, and continuous verification requirements. Advise on identity-first security, including IAM, CIAM, workforce identity, privileged access, machine identities, federation, SSO, MFA, passwordless authentication, and identity governance. Design access architectures for hybrid and multi-cloud environments, including least privilege, conditional access, session controls, and risk-based authentication. Support clients in moving from perimeter-based security models to identity-centric, context-aware, and continuously verified architectures. Secure-by-Design & Architecture Governance Establish and mature security architecture governance models, including architecture review boards, design authorities, intake processes, exception management, and assurance mechanisms. Embed secure-by-design and secure-by-default principles into enterprise and solution architecture processes. Define security acceptance criteria, non-functional requirements, control requirements, telemetry requirements, and validation approaches for major programmes. Review major technology investments, platforms, products, integrations, and transformation programmes for security architecture fit. Govern technical exceptions and security design debt through documented risk decisions, compensating controls, accountable owners, and remediation plans. Advise on architecture decision records, design documentation, traceability, and assurance evidence. Threat-Led Architecture & Resilience Apply threat modelling, attack-path analysis, MITRE ATT&CK-informed planning, and adversary perspective to architecture decisions. Translate threat intelligence, vulnerabilities, and control weaknesses into prioritised architecture and control recommendations. Design resilience into enterprise architectures, including segmentation, redundancy, recovery, backup, immutable storage, and crisis-response readiness. Advise on business continuity, disaster recovery, ransomware resilience, cyber crisis management, and recovery-time and recovery-point objectives. Support clients in defining realistic resilience outcomes aligned to critical business services, regulatory obligations, and risk tolerance. Application, Data & AI Security Architecture Advise on secure application architecture, API security, microservices, integration patterns, product security, and secure software supply chains. Embed security across the software delivery lifecycle, including secure SDLC, threat modelling, SAST, DAST, SCA, IaC scanning, secrets management, and pipeline security. Design data security architectures covering classification, encryption, tokenisation, key management, DLP, access controls, data residency, and privacy-by-design. Advise on secure AI and GenAI adoption, including model security, data protection, prompt and agent risk, non-human identity, access controls, guardrails, and AI governance alignment. Help clients adopt emerging technologies securely without inhibiting innovation or delivery speed. Engagement Delivery & Quality Assurance Own end-to-end delivery of complex security architecture engagements, including scoping, methodology, staffing, delivery governance, client satisfaction, and commercial performance. Develop and maintain reusable architecture assessment frameworks, maturity models, reference architectures, design patterns, and client deliverable templates. Review and quality-assure executive reports, architecture blueprints, target-state designs, roadmaps, business cases, and board presentations. Ensure engagements are delivered to Tier 1 quality standards, on time, within budget, and with clear, defensible recommendations. Manage delivery risk, scope discipline, stakeholder alignment, escalation, and engagement profitability. Business Development & Practice Growth Own a personal revenue target and contribute materially to the security architecture practice’s pipeline, revenue, margin, and growth objectives. Identify, qualify, and progress high-value security architecture opportunities across existing and target client accounts. Lead p