Job description

Saudi organisations need proof, not just policy, that their cybersecurity controls actually work, and this Riyadh role in Deloitte's Cyber Operate team gathers that proof. Assessments cover NCA ECC-2:2024 alongside CSCC, CCC, DCC, OTCC, TCC and OSMACC, as well as ISO/IEC 27001:2022 and PDPL obligations. Before new systems or major changes go live, their compliance is checked. Each control is rated as fully, partially or not implemented after interviews with control owners and a review of policies and procedures. Evidence sampling and technical checks go deeper, looking at access reviews, privileged accounts, firewall rules, logging, backup and restore records, patch status and hardening, with automated scans where possible. Findings have to be defensible, so outdated or weak evidence is pushed back on. Regulator readiness is a big part of the work, from NCA self-assessments and evidence packs to ISO certification and surveillance audits and internal audit requests. Remediation is followed to closure, the obligations register and NCA, ISO and NIST control mapping stay current, and governance committees get regular status updates. Two to eight years of experience with hands-on NCA ECC assessments in Saudi Arabia is required, and CISA, ISO 27001 Lead Auditor, CISM, GRC platform experience and Arabic are all preferred.