Senior Consultant/Manager | Cyber Operate | Awareness, Training & Communications Specialist |KSA

Role overview

Build culture and design programs

• Build cybersecurity ownership across the workforce and executives and encourage security-first behavior in daily decisions.
• Engage senior leaders as visible role models through messages, campaign sponsorship, and participation in exercises.
• Measure culture through surveys, behavior data, and reporting trends, then target areas needing improvement.
• Design an awareness, training, and culture framework and multi-year strategy aligned with NCA ECC awareness and training requirements.
• Write and maintain policies, procedures, and SOPs covering mandatory training, onboarding, phishing simulations, and repeat-clicker escalation.
• Analyze audience risks, work patterns, and preferred channels, including for staff without regular computer access.

Exercises, campaigns, and content

• Design and run tabletop exercises for executives, crisis teams, IT, OT, and business units using scenarios such as ransomware, data breaches, supplier compromise, payment fraud, and operational disruption.
• Facilitate exercises, capture lessons learned, and track improvement actions with Governance and Risk teams.
• Design campaigns on phishing, passwords and MFA, social engineering, data protection, safe AI use, mobile and travel security, and physical security.
• Produce Arabic and English newsletters, posters, short videos, infographics, intranet pages, and digital signage.
• Organize awareness month events, roadshows, competitions, and visits to operational and venue teams.

Training, communications, and measurement

• Design and deliver role-based training for staff, executives, board members, IT and OT teams, developers, privileged users, finance and procurement, and contractors.
• Build onboarding security training for new joiners, contractors, and seasonal staff; manage LMS assignments and track completion against targets.
• Run live sessions, workshops, and executive briefings; issue security advisories and alerts with the SOC and Corporate Communications.
• Plan phishing, smishing, and vishing simulations using platforms such as KnowBe4 or Proofpoint, with follow-up training for people who fail.
• Measure click and report rates, repeat offenders, incident reporting, exercise outcomes, and culture survey results; report results and adjust the plan.
• Work with HR and Corporate Communications and build a network of security champions across departments and sites.

Qualifications and experience

• 3–7 total professional years of experience.
• Bachelor’s degree in communications, cybersecurity, IT, education, or a related field.
• Security awareness or culture program and phishing simulation experience is specified for the senior level; awareness campaign and training delivery experience is specified for the mid level.
• Cybersecurity tabletop exercise design or facilitation experience is specified for the senior level.
• Solid understanding of phishing, social engineering, account takeover, and NCA ECC awareness requirements.
• Experience with large, mixed workforces such as hospitality, venues, operations, or contractors is valued.

Skills and platforms

• Excellent Arabic and English writing and content creation skills are listed, although Arabic is also separately described as a plus.
• Confident presentation skills for front-line staff through executive audiences.
• Experience with KnowBe4, Proofpoint, Cofense, or similar awareness platforms and LMS administration.
• Experience measuring security culture with surveys and behavior metrics.
• Content design skills such as Canva, Adobe, and short-video editing; behavioral science or adult-learning background is valued.
• At least one of SANS Security Awareness Professional (SSAP), CompTIA Security+, or CISM is preferred; SANS Security Culture (LDR433), CIPD, or other learning and development or communications qualifications are also valued.
• Referenced standards include NCA ECC-2:2024, NIST SP 800-50 Rev. 1, NIST SP 800-84, ISO/IEC 27001:2022 A.6.3, and PDPL awareness obligations.

Leadership capabilities

About Deloitte