Director | Cyber | Security Architecture | GCC

About Deloitte: When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award. Our Purpose Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities. Our shared values guide the way we behave to make a positive, enduring impact:
• Lead the way
• Serve with integrity
• Take care of each other
• Foster inclusion
• Collaborate for measurable impact During your tenure as a Director, you will demonstrate and develop your capabilities in the following areas: Executive Advisory & Client Leadership
• Serve as a senior advisor to CISOs, CIOs, CTOs, Chief Architects, risk leaders, and executive committees on enterprise security architecture, cyber resilience, and secure technology transformation.
• Frame complex architecture and security challenges in business terms, connecting technical decisions to risk, resilience, regulatory exposure, cost, agility, and strategic growth.
• Lead executive workshops, architecture strategy sessions, target-state design workshops, and investment prioritisation discussions.
• Build long-term trusted-advisor relationships that generate repeat engagements, multi-year transformation programmes, and cross-practice opportunities.
• Represent the firm credibly in complex stakeholder environments, including boards, regulators, technology leadership, and third-party partners. Enterprise Security Architecture Strategy
• Lead the development of enterprise security architecture strategies, target-state operating models, roadmaps, and investment plans.
• Define security architecture principles, standards, control baselines, reference architectures, and reusable secure design patterns.
• Align security architecture with enterprise architecture, cloud strategy, data strategy, application modernisation, infrastructure transformation, and business operating models.
• Advise clients on pragmatic pathways from current-state complexity to secure, scalable target-state environments.
• Balance security, risk, regulatory requirements, commercial constraints, engineering feasibility, and speed to market. Architecture Assessment & Target-State Design
• Lead complex security architecture assessments across enterprise technology estates, including cloud, on-premises, hybrid, data centres, networks, applications, APIs, endpoints, OT, and third-party environments.
• Assess current-state architecture against security principles, business objectives, threat landscape, control effectiveness, resilience requirements, and regulatory obligations.
• Identify architectural risk, technical debt, control gaps, single points of failure, excessive complexity, and opportunities for consolidation or simplification.
• Design future-state security architectures across identity, network, endpoint, application, data, cloud, and operational technology domains.
• Develop transition roadmaps, sequencing plans, capability requirements, investment estimates, and measurable maturity outcomes. Zero Trust & Identity Architecture
• Lead the design and implementation of Zero Trust architectures across users, devices, networks, applications, data, workloads, and third-party access.
• Define Zero Trust operating models, policy frameworks, segmentation approaches, access controls, and continuous verification requirements.
• Advise on identity-first security, including IAM, CIAM, workforce identity, privileged access, machine identities, federation, SSO, MFA, passwordless authentication, and identity governance.
• Design access architectures for hybrid and multi-cloud environments, including least privilege, conditional access, session controls, and risk-based authentication.
• Support clients in moving from perimeter-based security models to identity-centric, context-aware, and continuously verified architectures. Secure-by-Design & Architecture Governance
• Establish and mature security architecture governance models, including architecture review boards, design authorities, intake processes, exception management, and assurance mechanisms.
• Embed secure-by-design and secure-by-default principles into enterprise and solution architecture processes.
• Define security acceptance criteria, non-functional requirements, control requirements, telemetry requirements, and validation approaches for major programmes.
• Review major technology investments, platforms, products, integrations, and transformation programmes for security architecture fit.
• Govern technical exceptions and security design debt through documented risk decisions, compensating controls, accountable owners, and remediation plans.
• Advise on architecture decision records, design documentation, traceability, and assurance evidence. Threat-Led Architecture & Resilience
• Apply threat modelling, attack-path analysis, MITRE ATT&CK-informed planning, and adversary perspective to architecture decisions.
• Translate threat intelligence, vulnerabilities, and control weaknesses into prioritised architecture and control recommendations.
• Design resilience into enterprise architectures, including segmentation, redundancy, recovery, backup, immutable storage, and crisis-response readiness.
• Advise on business continuity, disaster recovery, ransomware resilience, cyber crisis management, and recovery-time and recovery-point objectives.
• Support clients in defining realistic resilience outcomes aligned to critical business services, regulatory obligations, and risk tolerance. Application, Data & AI Security Architecture
• Advise on secure application architecture, API security, microservices, integration patterns, product security, and secure software supply chains.
• Embed security across the software delivery lifecycle, including secure SDLC, threat modelling, SAST, DAST, SCA, IaC scanning, secrets management, and pipeline security.
• Design data security architectures covering classification, encryption, tokenisation, key management, DLP, access controls, data residency, and privacy-by-design.
• Advise on secure AI and GenAI adoption, including model security, data protection, prompt and agent risk, non-human identity, access controls, guardrails, and AI governance alignment.
• Help clients adopt emerging technologies securely without inhibiting innovation or delivery speed. Engagement Delivery & Quality Assurance
• Own end-to-end delivery of complex security architecture engagements, including scoping, methodology, staffing, delivery governance, client satisfaction, and commercial performance.
• Develop and maintain reusable architecture assessment frameworks, maturity models, reference architectures, design patterns, and client deliverable templates.
• Review and quality-assure executive reports, architecture blueprints, target-state designs, roadmaps, business cases, and board presentations.
• Ensure engagements are delivered to Tier 1 quality standards, on time, within budget, and with clear, defensible recommendations.
• Manage delivery risk, scope discipline, stakeholder alignment, escalation, and engagement profitability. Business Development & Practice Growth
• Own a personal revenue target and contribute materially to the security architecture practice’s pipeline, revenue, margin, and growth objectives.
• Identify, qualify, and progress high-value security architecture opportunities across existing and target client accounts.
• Lead pursuit strategy, proposal development, solution architecture, pricing models, capability positioning, and bid defence.
• Develop differentiated offerings across security architecture assessment, Zero Trust, secure transformation, architecture governance, resilience, and emerging technology security.
• Create reusable intellectual property, benchmarks, diagnostic tools, accelerators, and thought leadership that support scalable delivery and market differentiation.
• Support cross-selling into cyber strategy, cloud security, technology risk, privacy, managed services, and enterprise architecture practices.
• Build relationships with technology vendors, cloud providers, alliances, industry bodies, and referral partners.
• Represent the firm at client briefings, conferences, executive roundtables, and industry events. Team Leadership & Capability Development
• Recruit, lead, mentor, and develop security architects, principal consultants, managers, and technical specialists.
• Set performance objectives, provide technical and commercial coaching, and build succession depth across the practice.
• Develop capability across enterprise architecture, Zero Trust, cloud, identity, application security, data protection, resilience, and emerging technology.
• Foster a high-performance culture based on technical rigour, client value, collaboration, innovation, and professional integrity.
• Support knowledge sharing, community of practice development, and consistent delivery standards across the firm. Technical Expertise Required
• Enterprise and solution architecture: Enterprise architecture frameworks, target-state design, architecture governance, capability mapping, and technology roadmap development.
• Security architecture frameworks: SABSA, TOGAF, NIST Cybersecurity Framework, NIST SP 800-207, ISO 27001, CIS Controls, CSA CCM, and relevant regulatory regimes.
• Zero Trust: Zero Trust strategy, identity-centric access, micro-segmentation, continuous verification, policy enforcement, and secure access service edge (SSE/SASE).
• Identity and access: IAM, PAM, CIAM, federation, SSO, MFA, passwordless authentication, identity governance, machine identities, and entitlement management.
• Cloud and hybrid architecture: AWS, Azure, Google Cloud, private cloud, hybrid connectivity, landing zones, multi-cloud design, and secure platform architectures.
• Network security: Segmentation, SD-WAN, SASE, zero-trust network access, firewalls, proxy, secure remote access, DDoS protection, and hybrid network design.
• Application and API security: Secure SDLC, API gateways, microservices, OAuth/OIDC, API security, application hardening, and software supply-chain controls.
• Data protection: Encryption, KMS/HSM, tokenisation, DLP, data classification, privacy-by-design, data residency, and secure data sharing.
• Resilience and continuity: Business continuity, disaster recovery, backup architecture, ransomware resilience, recovery objectives, and critical service protection.
• Detection and response integration: Security telemetry, SIEM, SOAR, XDR, detection engineering, incident response, and forensic readiness.
• Emerging technology: AI/ML and GenAI security, IoT/OT security, container and Kubernetes security, serverless, and secure automation.
• Architecture tooling and automation: Architecture modelling tools, policy-as-code, IaC, security automation, control validation, and continuous assurance. Business Development Expectations As a Director in a Tier 1 consulting firm, the role carries explicit commercial accountability:
• Build and maintain a qualified pipeline aligned to annual revenue, growth, and profitability targets.
• Lead the pursuit of complex, high-value security architecture engagements with executive sponsorship and multi-workstream delivery.
• Convert trusted-advisor relationships into repeat advisory, transformation, implementation, managed-service, and recurring-revenue opportunities.
• Develop compelling, differentiated propositions that address client outcomes rather than technology features alone.
• Support account planning, cross-practice selling, and strategic growth in priority accounts.
• Lead pricing, commercial modelling, scope definition, and risk-adjusted engagement planning.
• Maintain strong win rates, high-quality client references, and repeat-business performance.
• Build the firm’s external market presence through publications, speaking engagements, client events, and industry partnerships. Leadership Capabilities
• Builds own understanding of our purpose and values; explores opportunities for impact.
• Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.
• Understands expectations and demonstrates personal accountability for keeping performance on track.
• Actively focuses on developing effective communication and relationship-building skills.
• Understands how their daily work contributes to the priorities of the team and the business.  Qualifications
• 12+ years of progressive experience in cybersecurity, security architecture, enterprise architecture, technology risk, or consulting.
• 5+ years leading complex security architecture engagements, enterprise architecture programmes, or major security transformation initiatives.
• 3+ years in a Director, Senior Manager, or equivalent leadership role with responsibility for delivery, people, and commercial outcomes.
• Demonstrated experience advising large enterprise or regulated-sector clients at executive level.
• Proven ability to lead architecture assessments, target-state design, governance models, and multi-year transformation roadmaps.
• Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, Engineering, or a related discipline; equivalent professional experience will be considered. Preferred Certifications
• SABSA Chartered Architect (SCF/SCM) or equivalent security architecture certification.
• TOGAF certification.
• CISSP, CISSP-ISSAP, CCSP, CISM, CISA, or CRISC.
• Cloud architecture or security certifications across AWS, Azure, or Google Cloud.
• NIST, Zero Trust, enterprise resilience, or emerging technology security credentials. Success Measures
• Revenue, pipeline growth, win rate, engagement margin, and client references.
• Quality, commercial relevance, and adoption of architecture strategies, target-state designs, and roadmaps.
• Client satisfaction, repeat engagement, and strength of executive-level relationships.
• Development of differentiated methodologies, reference architectures, accelerators, and thought leadership.
• Team capability, retention, succession readiness, and delivery consistency.
• Measurable improvement in clients’ security architecture maturity, resilience, and secure-by-design adoption.