Join Deloitte's Cyber team as an Assistant Manager specializing in Threat Modeling. This role is crucial for assessing and mitigating security risks within applications, networks, and business processes. You will be instrumental in developing proactive security strategies to protect valuable assets and enable new opportunities.

Deloitte empowers organizations to build robust defenses against cyber threats and safeguard critical assets. Our approach emphasizes security, vigilance, and resilience, integrating cyber risk management from the outset of strategy development to effectively manage information and technology risks.

Conduct comprehensive threat modeling for applications, networks, security solutions, APIs, and business workflows. Perform in-depth security architecture reviews to identify design flaws, control gaps, and security vulnerabilities. Analyze architecture diagrams, data flows, trust boundaries, and integration points to understand system intricacies. Identify potential threats, abuse cases, attack paths, and weaknesses in business logic.

Provide practical recommendations for security controls and mitigation strategies. Develop reusable threat modeling templates, checklists, and review playbooks. Utilize threat intelligence and adversary tactics to assess threat plausibility. Document security recommendations, risk and control gap assessments, and attack path analyses. Create executive-level summaries for risk stakeholders.

We are seeking a Threat Modeling Specialist with 4 to 7 years of profound experience in understanding and assessing security risks across applications, networks, security solutions, and business logic. A strong grasp of at least two threat modeling methodologies such as STRIDE, PASTA, DREAD, or MITRE ATT&CK is essential.

Familiarity with security frameworks like NIST Cybersecurity Framework, ISO 27001, ISO 42001, and CIS Controls/Benchmarks is required. Experience with risk assessment and rating methodologies, as well as tools for diagramming, architecture review, or threat modeling, is expected. A good understanding of the AI ecosystem, including Agentic AI, AI agents, A2A protocols, MCP, and RAG, is also beneficial.

A Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field is necessary. The role involves producing threat modeling reports, security architecture review reports, risk and control gap assessments, and attack path documentation. Proficiency in analyzing data flows and trust boundaries, and developing security recommendations and mitigation plans is key.