Join Deloitte's Cyber team as an Assistant Manager specializing in Threat Modeling. This role is crucial for safeguarding organizations by proactively identifying and assessing security risks. You will be at the forefront of preventing cyberattacks and protecting valuable assets, contributing to a secure, vigilant, and resilient digital environment.

We empower organizations to manage cyber risk effectively, enabling them to seize new opportunities. By embedding cyber risk considerations into strategy development, we ensure robust management of information and technology risks.

Conduct comprehensive threat modeling for applications, networks, security solutions, APIs, and business workflows. Perform detailed security architecture reviews to pinpoint design flaws, control gaps, and potential security vulnerabilities. Analyze architecture diagrams, data flows, trust boundaries, and integration points to understand system interdependencies.

Identify emerging threats, abuse cases, and attack paths. Document business logic weaknesses and recommend practical security controls and mitigation strategies to enhance overall system security.

This position requires 4 to 7 years of experience as a Threat Modeling Specialist with a deep understanding of application, network, and security solution risks. Proficiency in at least two threat modeling methodologies (e.g., STRIDE, PASTA, DREAD, MITRE ATT&CK) is essential.

Familiarity with security frameworks like NIST Cybersecurity Framework, ISO 27001, ISO 42001, and CIS Controls is expected. Experience in risk assessment and employing various risk rating methodologies is required. You should be adept at using diagramming and threat modeling tools, and capable of creating reusable threat modeling templates and checklists.

Knowledge of threat intelligence and adversary tactics is important for assessing threat plausibility. A strong understanding of the AI ecosystem, including Agentic AI, AI agents, A2A protocols, MCP, and RAG, is also necessary. A Bachelor's or Master's degree in Computer Science, Information Security, or a related field is required.