Client and Business Cyber Services Associate Director - BISO

Position Summary Are you passionate about technology and interested in joining a community of collaborative colleagues who respectfully and courageously seek to challenge the status quo? If so, read on to learn more about an exciting opportunity with Deloitte Technology-US (DT-US). We are curious and life-long learners focused on technology and innovation, including how AI is reshaping the way secure software gets built. Recruiting for this role ends on 12/7/2026. Work you’ll do The Associate Director, Government & Public Services (GPS) Business Information Security Officer (BISO) is a leadership role within the DT-US Cyber Security function, with a matrixed relationship to Cyber Operations, Security Architecture, Cyber Design, and Technology and Business leaders across the US Member Firm. The role is accountable for leading Cloud Security, Application Security, and AI security for GPS, and for ensuring GPS meets current Federal and Department of Defense (DoD) security and compliance requirements. The US Chief Information Security Officer (CISO) oversees the strategy and governance of information security, risk management, and information security operations for the entire Deloitte US firm, including GPS, an US$8 billion business line serving Federal, Defense, state, and local clients. As a key member of the DT-US Cyber Security leadership team, the Associate Director serves as a trusted advisor to GPS and executive stakeholders, drives secure software and AI practices across the development lifecycle, and works across the organization to protect critical assets. Responsibilities: Ensure security controls and compliance for cloud and hybrid environments (AWS, Azure, GCP), aligned to FedRAMP (Rev. 5 and FedRAMP 20x), the DoD Cloud Computing Security Requirements Guide (SRG) and its impact levels, and NIST SP 800-53 Rev. 5.Work proactively with colleagues across the organization to champion cyber security requirements for cloud, Zero Trust, and vulnerability management.Oversee and operationalize the security objectives of the Secure Software Development Lifecycle (SSDLC), aligned to the NIST Secure Software Development Framework (SSDF, SP 800-218) and secure-by-design principles, including software supply chain security (SBOMs, dependency and provenance controls) and support for federal secure software attestation requirements.Integrate AI across every phase of the SSDLC (requirements, design and threat modeling, build, test, release, and operations), governing both AI-assisted development (code assistants and agentic tools) and AI-enabled solutions in line with NIST SP 800-218A, the NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile, and the OWASP Top 10 for LLM Applications.Establish AI security practices including model and data provenance, prompt injection and adversarial testing (AI red teaming), AI bill of materials, human oversight, and continuous monitoring of AI systems.Drive GPS readiness and evidence for Federal and DoD client requirements, including the Risk Management Framework (NIST SP 800-37 and DoDI 8510.01), NIST SP 800-171, DFARS View phone number on click.appcast.io, the Cybersecurity Maturity Model Certification (CMMC) program (32 CFR Part 170 and DFARS View phone number on click.appcast.io), DISA STIG hardening, and CUI protection.Protect critical assets and align and prioritize cyber security investments using a risk-based approach consistent with NIST Cybersecurity Framework (CSF) 2.0.Develop plans to enforce established cyber security standards, minimize vulnerabilities, and strengthen the business information technology posture, including continuous monitoring and remediation.Develop cyber security and AI risk metrics that report exact status, inform leadership, and drive remediation plans.Partner with delivery, legal, procurement, and client teams to manage contractual flow-down and compliance obligations and engage vendors and cloud providers on security and AI readiness.Lead and develop a high-performing team of security professionals while building cloud, application, and AI security competency across the organization through training, reference architectures, and playbooks. The successful candidate would possess these skills Ability to work independently and collaborate as part of a teamEffective written and verbal communication skillsMeticulous attention to detail and quality of work productAbility to build and sustain professional relationshipsAbility to lead projects or workstreamsAbility to manage and prioritize multiple tasks in a fast-paced and dynamic environmentStrong interpersonal skills and professional demeanorAbility to meet deadlinesAbility to mentor and provide clear guidance to others The team Deloitte Technology-US helps power Deloitte’s success. Deloitte Technology-US drives Deloitte, which serves many of the world’s largest, most respected organizations. DT-US develops and deploys cutting-edge internal and go-to-market solutions that help Deloitte operate effectively and lead in the market. Our reputation is built on a tradition of delivering with excellence. The ~3,000 professionals in DT-US deliver services including: Cyber SecurityTechnology SupportTechnology & InfrastructureApplicationsRelationship ManagementStrategy & CommunicationsProject ManagementStrategic Financial Management Cyber Security Cyber Security vigilantly protects Deloitte and client data. The team leads a strategic cyber risk program that adapts to a rapidly changing threat landscape, including AI-enabled threats, and to changes in business strategies, risks, and vulnerabilities. Using situational awareness and threat intelligence, and building a security culture across the organization, with integration into the global cyber security capabilities that help protect the Deloitte brand. Areas of focus include: Risk & ComplianceIdentity & Access ManagementData ProtectionCyber DesignIncident ResponseSecurity ArchitectureAI Security & GovernanceBusiness Partnership Qualifications Required: Bachelor’s degree or equivalent in Information Technology, Computer Science, or Engineering.Minimum 10 years of experience in cybersecurity and/or risk management, includingMinimum 4 years supporting highly regulated environments (e.g., federal, defense, audit and financial services, or critical infrastructure).Demonstrated experience driving security and compliance for cloud, including FedRAMP and DoD Cloud Computing SRG authorizations.Minimum 2 years of people and/or process management experienceMust be able to obtain US Government security clearance or public trust determination, as required.Ability to travel 10%, on average, based on the work you do and the clients and industries/sectors you serveMust be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future. Preferred: Demonstrated ability to drive organizational changes in cyber security for the application development lifecycle, including integrating security and AI governance into the SSDLC and DevSecOps pipelines.Working knowledge of secure AI and machine learning practices, including AI-specific threats such as prompt injection, data poisoning, and model supply chain risk.Working knowledge of OWASP, application security, software supply chain security (SBOM, SLSA), and vulnerability remediation processes.Deep knowledge of standards and guidance, including:NIST SP 800-53 Rev. 5, SP 800-171, SP 800-37 (RMF), SP 800-218 (SSDF), SP 800-218A, NIST CSF 2.0, and NIST AI RMF 1.0FedRAMP (Rev. 5 and 20x), DoD Cloud Computing SRG, DoDI 8510.01, DISA STIGs, DFARS View phone number on click.appcast.io, and CMMCISO/IEC 27001:2022, ISO/IEC 42001, Cloud Security Alliance Cloud Controls Matrix (CCM), and OWASP Top 10 for LLM ApplicationsUnderstanding of and ability to apply trends in global security and risk management, including Zero Trust architecture and the evolving Federal and DoD regulatory landscape.Ability to frame and communicate security and risk-related concepts to technical and nontechnical audiences at various levels, and to influence senior stakeholders in a highly matrixed organization.Industry certifications such as CISSP, CISM, CCSP, CSSLP, CISA, GIAC, or equivalent experience strongly preferred; DoD 8140 qualification a plus. The wage range for this role takes into account the wide range of factors that are considered in making compensation decisions including but not limited to skill sets; experience and training; licensure and certifications; and other business and organizational needs. The disclosed range estimate has not been adjusted for the applicable geographic differential associated with the location at which the position may be filled. At Deloitte, it is not typical for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range is $130,900 to $268,700. You may also be eligible to participate in a discretionary annual incentive program, subject to the rules governing the program, whereby an award, if any, depends on various factors, including, without limitation, individual and organizational performance. EA_ExpHire Deloitte is committed to providing reasonable accommodations for people with disabilities. If you require a reasonable accommodation to participate in the recruiting process, please direct your inquiries to the Global Call Center (GCC) at View email address on click.appcast.io. Recruiting tips From developing a stand out resume to putting your best foot forward in the interview, we want you to feel prepared and confident as you explore opportunities at Deloitte. Check out recruiting tips from Deloitte recruiters. Benefits At Deloitte, we know that great people make a great organization. We value our people and offer employees a broad range of benefits. Learn more about what working at Deloitte can mean for you. Our people and culture Our inclusive culture empowers our people to be who they are, contribute their unique perspectives, and make a difference individually and collectively. It enables us to leverage different ways of thinking, ideas, and perspectives, and bring more creativity and innovation to help solve our clients' most complex challenges. This makes Deloitte one of the most rewarding places to work. Our purpose Deloitte’s purpose is to make an impact that matters for our people, clients, and communities. At Deloitte, purpose is synonymous with how we work every day. It defines who we are. Our purpose comes through in our work with clients that enables impact and value in their organizations, as well as through our own investments, commitments, and actions across areas that help drive positive outcomes for our communities. Learn more. Professional development From entry-level employees to senior leaders, we believe there’s always room to learn. We offer opportunities to build new skills, take on leadership opportunities and connect and grow through mentorship. From on-the-job learning experiences to formal development programs, our professionals have a variety of opportunities to continue to grow throughout their career. As used in this posting, "Deloitte" means Deloitte Services LP, a subsidiary of Deloitte LLP. Please see for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability or protected veteran status, or any other legally protected basis, in accordance with applicable law. Requisition code: 374119 Job ID 374119 Cyber and Technology Risk | Client and Business Cyber ServicesSame job available in 31 locations