Client and Business Cyber Services Associate Director - BISO

Are you passionate about technology and interested in joining a community of collaborative colleagues who respectfully and courageously seek to challenge the status quo? If so, read on to learn more about an exciting opportunity with Deloitte Technology-US (DT-US).

We are curious and life-long learners focused on technology and innovation, including how AI is reshaping the way secure software gets built.

Recruiting for this role ends on 12/7/2026.

Work you'll do

The Associate Director, Government & Public Services (GPS) Business Information Security Officer (BISO) is a leadership role within the DT-US Cyber Security function, with a matrixed relationship to Cyber Operations, Security Architecture, Cyber Design, and Technology and Business leaders across the US Member Firm.

The role is accountable for leading Cloud Security, Application Security, and AI security for GPS, and for ensuring GPS meets current Federal and Department of Defense (DoD) security and compliance requirements.

The US Chief Information Security Officer (CISO) oversees the strategy and governance of information security, risk management, and information security operations for the entire Deloitte US firm, including GPS, an US$8 billion business line serving Federal, Defense, state, and local clients.

As a key member of the DT-US Cyber Security leadership team, the Associate Director serves as a trusted advisor to GPS and executive stakeholders, drives secure software and AI practices across the development lifecycle, and works across the organization to protect critical assets.

Responsibilities:


* Ensure security controls and compliance for cloud and hybrid environments (AWS, Azure, GCP), aligned to FedRAMP (Rev.

5 and FedRAMP 20x), the DoD Cloud Computing Security Requirements Guide (SRG) and its impact levels, and NIST SP 800-53 Rev.

5.


* Work proactively with colleagues across the organization to champion cyber security requirements for cloud, Zero Trust, and vulnerability management.


* Oversee and operationalize the security objectives of the Secure Software Development Lifecycle (SSDLC), aligned to the NIST Secure Software Development Framework (SSDF, SP 800-218) and secure-by-design principles, including software supply chain security (SBOMs, dependency and provenance controls) and support for federal secure software attestation requirements.


* Integrate AI across every phase of the SSDLC (requirements, design and threat modeling, build, test, release, and operations), governing both AI-assisted development (code assistants and agentic tools) and AI-enabled solutions in line with NIST SP 800-218A, the NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile, and the OWASP Top 10 for LLM Applications.


* Establish AI security practices including model and data provenance, prompt injection and adversarial testing (AI red teaming), AI bill of materials, human oversight, and continuous monitoring of AI systems.


* Drive GPS ...