Director | Cyber | Cloud Security | GCC

About Deloitte: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award. Our Purpose Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities. Our shared values guide the way we behave to make a positive, enduring impact: Lead the way Serve with integrity Take care of each other Foster inclusion Collaborate for measurable impact During your tenure as a Director, you will demonstrate and develop your capabilities in the following areas: Client Leadership & Executive Advisory Act as a senior trusted advisor to CIOs, CISOs, CTOs, Chief Risk Officers, cloud leaders, and boards on cloud security strategy, risk, architecture, and transformation. Lead executive workshops and steering committees, translating complex technical risks into clear business impact, investment priorities, and actionable roadmaps. Advise clients on cloud security operating models, governance structures, risk appetite, control frameworks, regulatory obligations, and secure cloud adoption. Build durable senior client relationships that generate repeat advisory work, implementation opportunities, and multi-year transformation programmes. Represent the firm with credibility in complex, politically sensitive, and commercially significant client environments. Cloud Security Strategy & Transformation Lead the design of enterprise cloud security strategies across AWS, Azure, Google Cloud, hybrid, private cloud, and SaaS environments. Develop secure cloud landing zones, reference architectures, security baselines, guardrails, and target-state operating models. Advise on Zero Trust adoption, identity-first security, secure remote access, privileged access management, data protection, and secure network segmentation. Define cloud security governance models, including policy frameworks, exception management, risk acceptance, control ownership, and continuous assurance. Support clients in establishing measurable cloud security maturity roadmaps, prioritised by business risk, regulatory exposure, technical feasibility, and investment return. Technical Assessment & Architecture Review Lead complex cloud security assessments, architecture reviews, threat models, red-team-informed reviews, and control-effectiveness evaluations across IaaS, PaaS, SaaS, containers, and serverless environments. Assess security posture across major cloud platforms, including: Identity and access management: Entra ID, IAM, Okta, Ping, privileged access, federation, SSO, entitlement sprawl, and identity governance. Cloud platform security: AWS Organizations, Azure Management Groups, Google Cloud Organization policies, landing zones, resource hierarchies, and multi-account/multi-tenant architectures. Network security: VPC/VNet design, private connectivity, segmentation, egress controls, firewalling, WAF, DDoS protection, and hybrid connectivity. Data protection: Encryption, key management, KMS/HSM, tokenisation, data classification, DLP, backup resilience, and cross-border data controls. Detection and response: Cloud-native logging, SIEM/SOAR integration, XDR/CXDR, threat detection, incident response, forensics readiness, and recovery. Application and workload security: Container and Kubernetes security, API security, serverless security, CI/CD pipeline security, and software supply-chain controls. Cloud security tooling: CSPM, CNAPP, CIEM, DSPM, CWPP, IaC scanning, secrets management, policy-as-code, and posture management platforms. Identify material misconfigurations, excessive privileges, lateral-movement paths, data-exposure risks, control gaps, and resilience weaknesses. Produce technically rigorous findings, risk-rated remediation plans, architecture recommendations, and executive-ready reports. Quality-assure complex client deliverables and ensure findings are defensible, commercially relevant, and actionable. DevSecOps & Engineering Integration Advise clients on embedding security across the software development lifecycle, including secure-by-design principles, threat modelling, secure coding standards, and automated controls. Assess and improve CI/CD security, infrastructure-as-code governance, pipeline integrity, artefact signing, dependency management, and secrets protection. Guide adoption of policy-as-code, automated compliance checks, security testing, and continuous control validation. Partner with cloud engineering, platform, DevOps, and application teams to ensure security recommendations are practical, scalable, and commercially viable. Advise on security automation opportunities that reduce manual effort, improve control consistency, and accelerate secure delivery. Regulatory, Risk & Resilience Advisory Advise clients on cloud-related regulatory and compliance obligations, including NIST CSF, ISO 27001, CIS Benchmarks, CSA CCM, SOC 2, PCI DSS, GDPR, DORA, and sector-specific requirements. Support cloud risk assessments, third-party and concentration-risk reviews, resilience assessments, and regulatory readiness programmes. Advise on business continuity, disaster recovery, backup strategy, ransomware resilience, and recovery-time objectives in cloud environments. Support incident preparedness, tabletop exercises, crisis-management planning, and post-incident remediation programmes. Help clients establish defensible risk narratives for boards, regulators, auditors, and external stakeholders. Engagement Delivery & Quality Own end-to-end delivery of complex cloud security engagements, including scoping, methodology, resourcing, delivery governance, risk management, and client satisfaction. Ensure engagements are commercially viable, delivered on time and budget, and meet the firm’s quality, independence, and professional standards. Lead engagement planning, staffing decisions, delivery reviews, quality assurance, and escalation management. Develop and maintain reusable methodologies, assessment frameworks, technical baselines, report templates, and delivery accelerators. Monitor engagement economics, including utilisation, realisation, margin, scope discipline, and delivery risk. Business Development & Market Growth Own a personal revenue target and contribute to the cloud security practice’s pipeline, revenue, and profitability objectives. Identify, qualify, and progress cloud security opportunities across existing clients and target accounts. Lead proposal development, solution design, pricing strategy, capability positioning, and bid defence for high-value pursuits. Build compelling propositions that differentiate the firm across cloud security assessment, transformation, DevSecOps, CNAPP/CSPM advisory, Zero Trust, and cloud resilience. Develop repeatable offerings, accelerators, assessment tools, benchmarking assets, and thought leadership that support scalable growth. Cultivate relationships with cloud providers, security vendors, alliances, industry bodies, and referral partners to expand market reach. Support cross-selling into broader cyber, technology transformation, risk, audit, and managed-services practices. Represent the firm at conferences, executive roundtables, client briefings, webinars, and industry forums. People Leadership & Capability Development Recruit, lead, coach, and develop a high-performing t