Cyber Manager - Cloud DevSecOps

Cyber Cloud Security
- Dev Sec Ops  Manager Position Summary

Are you interested in working in a dynamic environment that offers opportunities for professional growth and new responsibilities? If so, Deloitte & Touche LLP could be the place for you. Traditional security programs have often been unsuccessful in unifying the need to both secure and support technology innovation required by the business. Join Deloitte's Cloud Cyber Services team and become a member of the largest group of cybersecurity professionals worldwide.

Recruiting for this role will end on 12/31/2026

As a Dev Sec Ops  Security Manager, you will lead client engagements focused on transforming and scaling Secure-by-Design, Dev Sec Ops , Application Security, and Secure SDLC capabilities across cloud and modern engineering environments. You will work with security, technology, engineering, risk, and business leaders to translate cybersecurity requirements into practical engineering solutions while enabling organizations to deliver software securely and efficiently.

• Lead complex Dev Sec Ops  and Secure-by-Design engagements, owning delivery from current-state assessment and strategy through roadmap development, solution design, implementation, and operationalization.
• Serve as a trusted advisor and primary day-to-day client contact, working with senior stakeholders across Cybersecurity, Engineering, Cloud, Application Development, Risk, Compliance, and Technology leadership.
• Lead Dev Sec Ops  and Secure SDLC maturity assessments across people, process, technology, and governance; identify capability gaps and develop prioritized transformation roadmaps.
• Design and implement Secure-by-Design operating models that integrate security throughout the application lifecycle from business requirements and architecture through development, testing, deployment, and production operations.
• Lead the strategy and adoption of AI-enabled Dev Sec Ops  and Application Security, Integrating AI/Agentic capabilities across Secure SDLC and CI/CD for automated security assessments, threat analysis, vulnerability discovery, Triage, and risk-based prioritization.
• Design and implement AI-assisted vulnerability remediation, including root-cause analysis, remediation recommendations, automated code fixes, remediation validation, and integration with existing App Sec, vulnerability management, and developer workflows
• Establish secure AI/Agentic AI governance and guardrails, AI threat Modeling, identity and data protection, prompt-injection controls, secure agent permissions, and metrics to measure automation and remediation effectiveness.
• Define and optimize security engagement and application intake processes, including application risk classification, security assessments, threat modeling, architecture reviews, control validation, approvals, exception management, and go-live governance.
• Translate enterprise security policies and frameworks such as NIST CSF, NIST 800-53, OWASP, ISO 27001, and organizational security standards into actionable engineering controls and automated security requirements.
• Guide integration of Application Security capabilities including SAST, DAST, SCA, secrets scanning, IaC scanning, container security, API security, threat modeling, penetration testing, and vulnerability management into CI/CD pipelines and developer workflows.
• Advance software supply chain security, including dependency management, artifact integrity, SBOM, secure build pipelines, code signing, secrets management, PKI/HSM considerations, and software provenance.
• Assess and improve cloud-native, container, Kubernetes, and runtime security, helping engineering teams prioritize remediation while maintaining development velocity.
• Define Dev Sec Ops  operating models and governance structures, including organizational responsibilities, service catalogs, intake models, RACI, security champions, governance forums, and escalation mechanisms.
• Establish security metrics, KPIs, KRIs, dashboards, and executive reporting covering security assessment cycle time, vulnerability trends, remediation performance, control compliance, risk reduction, and engineering adoption.
• Lead…