Job description

NCA ECC-2:2024 sits at the centre of this Riyadh role in Deloitte's Cyber Operate team, alongside CSCC, CCC, DCC, OTCC, TCC and OSMACC, ISO/IEC 27001:2022 and PDPL. Compliance assessments are run against those frameworks, and new systems, projects and major changes are reviewed before go-live. Control owners are interviewed, policies checked, and each control judged as fully, partially or not implemented. Testing goes beyond paperwork, covering user access reviews, privileged accounts, firewall rules, logging, backups, patching and hardening baselines, with automated scans where available. Weak or outdated evidence gets challenged, and findings are written so they hold up. NCA self-assessments, evidence packs and submissions are prepared here, and ISO/IEC 27001 certification and surveillance audits need your support. Remediation plans are agreed with control owners and verified at closure, while the obligations register and control-to-evidence mapping across NCA, ISO and NIST are kept current. Management and governance committees receive regular reporting, and changes from NCA, SDAIA/PDPL and NDMO are tracked for impact. Between 2 and 8 years of experience, hands-on NCA ECC assessment work in Saudi Arabia and clear written English are required, with CISA, ISO 27001 Lead Auditor or CISM preferred.