Deloitte
Cyber Performance Management Specialist, Cyber Operate
- Permanent
- Riyadh, Saudi Arabia
- Experience 2 - 5 yrs
Job expiry date: 28/11/2026
Job overview
Date posted
14/10/2026
Location
Riyadh, Saudi Arabia
Salary
SAR 20,000 - 30,000 per month
Compensation
Comprehensive package
Experience
2 - 5 yrs
Seniority
Experienced
Qualification
Bachelors degree
Expiration date
28/11/2026
Job description
The CISO, steering committee and board all need a clear picture of whether the cybersecurity programme is working, and this Cyber Performance Management Specialist in Deloitte's Cyber Operate team in Riyadh builds it. Everything rests on a performance framework of objectives, KPIs, KRIs, SLAs, targets and thresholds, aligned with NCA ECC and NIST CSF 2.0 so the numbers reflect outcomes and risk reduction. Each cybersecurity function gets its own success metrics, agreed with the domain lead, from vulnerability remediation within SLA and OT assets monitored to supplier reassessments and NCA ECC compliance trends. Metrics are defined precisely, with formula, data source, baseline, target, owner and evidence, and linked from programme outcomes down to individual roles. Working with the Governance & PMO team, you turn policies, RACI and committee decisions into indicators that show whether governance is happening on the ground. Managed security services and key vendors are reviewed monthly against their service levels. Power BI dashboards and scorecards, fed where possible by automated data from security tools, GRC, TPRM and ticketing platforms, carry the results to executives. When targets slip, root causes are analysed with owners and improvement actions tracked to closure. Expect to bring 4 to 8 years of experience, strong Power BI skills with data modelling, ITIL-based SLA management and ideally SQL or Python, with ITIL 4, CISM or PL-300 preferred.
Required skills
Key responsibilities
- Design the cybersecurity performance management framework covering objectives, KPIs, KRIs, SLAs, targets, thresholds, data sources, owners and reporting lines
- Write and maintain the methodology, procedures and SOPs for data collection, validation, calculation, review and sign-off
- Align metrics with the cybersecurity strategy, NCA ECC and NIST CSF 2.0 so they measure outcomes and risk reduction
- Refine metrics regularly and retire those that no longer drive decisions
- Define success metrics for each cybersecurity function and role, agreed with domain leads
- Specify each metric's formula, data source, baseline, target, frequency, owner and evidence so results are consistent and auditable
- Connect programme, function and role-level measures so leaders can see how individual work adds up
- Help domain leads use the metrics for team objectives and performance reviews
- Convert governance requirements such as policies, RACI, committee decisions and NCA obligations into measurable indicators
- Monitor whether governance decisions are implemented and report gaps to the Governance team and steering committee
- Provide performance evidence for ISMS management reviews and NCA compliance reporting
- Run monthly service reviews with managed security services and key security vendors
- Track programme delivery and benefits against plan with the PMO
- Measure cybersecurity maturity and NCA compliance trends with the Strategy and Compliance teams
- Build dashboards and scorecards in Power BI for the CISO, steering committee and board with drill-down by function, team and role
- Automate data collection from security tools, GRC, TPRM and ticketing platforms
- Produce monthly and quarterly performance reports in plain language for executives
- Investigate negative trends and missed targets with owners and agree improvement actions
- Drive improvement actions to closure and show their effect in later reporting
- Validate data quality and challenge figures that do not add up
Experience & skills
- Bring 4 to 8 years of total professional experience
- Hold a bachelor's degree in IT, cybersecurity, business, data analytics or a related field
- Show experience designing or running a multi-function KPI, KRI or SLA performance framework at Senior level, or building performance dashboards and reports at Mid level
- Understand cybersecurity domains, including third-party and supply chain risk, well enough to define meaningful metrics
- Model data in Excel and Power BI or Tableau
- Manage SLAs and service performance using ITIL practices
- Write clear, concise English for executive reporting
- Query and automate data with SQL or Python
- Cascade organisational KPIs into team and individual objectives
- Offer experience with MSSP contracts and service reviews
- Apply maturity assessment models
- Know ISO/IEC 27004 and NIST SP 800-55
- Possess at least one of ITIL 4, CISM or Microsoft Power BI Data Analyst (PL-300), with PMP, CGEIT or COBIT also valued (preferred)
- Speak Arabic (a plus)