Client and Business Cyber Services Associate Director - BISO

Deloitte • Dayton, OH

2d • $130,900 - $268,700

About The Position

The Associate Director, Government & Public Services (GPS) Business Information Security Officer (BISO) is a leadership role within Deloitte Technology-US (DT-US) Cyber Security, with matrixed relationships across Cyber Operations, Security Architecture, Cyber Design, and technology and business leaders. The role leads Cloud Security, Application Security, and AI security for GPS and ensures alignment with applicable Federal and Department of Defense security and compliance requirements. It serves as a trusted advisor to GPS and executive stakeholders and drives secure software and AI practices throughout the development lifecycle to protect critical assets.

The position leads security and compliance across cloud and hybrid environments, secure software development, AI-enabled and AI-assisted development, and Federal and DoD client readiness. It develops risk-based security plans, metrics, and remediation approaches; collaborates with delivery, legal, procurement, client, vendor, and cloud-provider teams; and leads and develops security professionals while building organizational capability through training, reference architectures, and playbooks. The role is part of DT-US Cyber Security, which protects Deloitte and client data and adapts its strategic cyber risk program to evolving threats, business strategies, risks, and vulnerabilities.

Requirements

• Bachelor’s degree or equivalent in Information Technology, Computer Science, or Engineering.
• At least 10 years of experience in cybersecurity and/or risk management.
• At least 4 years of experience supporting highly regulated environments, such as federal, defense, audit and financial services, or critical infrastructure.
• Demonstrated experience driving cloud security and compliance, including FedRAMP and DoD Cloud Computing SRG authorizations.
• At least 2 years of people and/or process management experience.
• Ability to obtain a US Government security clearance or public trust determination, as required.
• Ability to travel an average of 10%, based on work and clients served.
• Must be legally authorized to work in the United States without current or future employer sponsorship.
• Ability to work independently and collaboratively as part of a team.
• Effective written and verbal communication skills.
• Meticulous attention to detail and quality of work product.
• Ability to build and sustain professional relationships and maintain a professional demeanor.
• Ability to lead projects or workstreams and prioritize multiple tasks in a fast-paced, dynamic environment.
• Ability to meet deadlines and mentor and provide clear guidance to others.

Nice To Haves

• Demonstrated ability to drive cybersecurity organizational change across the application development lifecycle, including security and AI governance in SSDLC and DevSecOps pipelines.
• Working knowledge of secure AI and machine learning practices, including prompt injection, data poisoning, and model supply chain risks.
• Working knowledge of OWASP, application security, software supply chain security (including SBOM and SLSA), and vulnerability remediation.
• Deep knowledge of NIST SP 800-53 Rev. 5, SP 800-171, SP 800-37, SP 800-218, SP 800-218A, NIST CSF 2.0, and NIST AI RMF 1.0.
• Knowledge of FedRAMP, DoD Cloud Computing SRG, DoDI 8510.01, DISA STIGs, DFARS 252.204-7012, and CMMC.
• Knowledge of ISO/IEC 27001:2022, ISO/IEC 42001, Cloud Security Alliance Cloud Controls Matrix, and OWASP Top 10 for LLM Applications.
• Understanding of global security and risk-management trends, including Zero Trust architecture and the evolving Federal and DoD regulatory landscape.
• Ability to communicate security and risk concepts to technical and nontechnical audiences and influence senior stakeholders in a highly matrixed organization.
• Industry certifications such as CISSP, CISM, CCSP, CSSLP, CISA, or GIAC, or equivalent experience; DoD 8140 qualification is a plus.

Responsibilities

• Ensure security controls and compliance for cloud and hybrid environments, including AWS, Azure, and GCP, aligned with FedRAMP, DoD Cloud Computing Security Requirements Guide, and NIST SP 800-53 requirements.
• Champion cybersecurity requirements for cloud, Zero Trust, and vulnerability management across the organization.
• Oversee and operationalize Secure Software Development Lifecycle objectives, including secure-by-design practices, software supply chain security, and federal secure software attestation support.
• Integrate AI security and governance throughout the SSDLC, covering AI-assisted development tools and AI-enabled solutions in alignment with relevant NIST and OWASP guidance.
• Establish AI security practices for model and data provenance, prompt injection and adversarial testing, AI bills of materials, human oversight, and continuous monitoring.
• Drive GPS readiness and evidence for Federal and DoD client requirements, including RMF, NIST SP 800-171, DFARS, CMMC, DISA STIG hardening, and CUI protection.
• Protect critical assets and prioritize cybersecurity investments using a risk-based approach consistent with NIST CSF 2.0.
• Develop plans to enforce cybersecurity standards, minimize vulnerabilities, and strengthen business IT security posture through continuous monitoring and remediation.
• Develop cybersecurity and AI risk metrics that communicate status, inform leadership, and drive remediation plans.
• Partner with delivery, legal, procurement, and client teams to manage contractual flow-down and compliance obligations, and engage vendors and cloud providers on security and AI readiness.
• Lead and develop a high-performing security team and build cloud, application, and AI security competency through training, reference architectures, and playbooks.
• Lead projects or workstreams, manage multiple priorities, meet deadlines, and mentor and guide others.

Benefits

• Broad range of employee benefits (specific benefits are not itemized in the posting).
• Potential eligibility to participate in a discretionary annual incentive program, subject to program rules and individual and organizational performance.
• Professional development opportunities, including on-the-job learning, formal development programs, leadership opportunities, and mentorship.

What This Job Offers

• Job Type: Full-time
• Career Level: Director