AI Security Senior Consultant

We need to output HTML fragment with sections: About the role? The posting includes description. We need headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections with real content. We have: - About the role: The introductory paragraph: "Our Deloitte Cyber team understands...". That's about the role. Could be "About the role". Use

About the role

then

...

. - Responsibilities: The "Work you'll do" bullet list. Use

Responsibilities

then

• each bullet. - Requirements: The "Qualifications Required:" list. Could be Requirements or Qualifications. The instruction says we can have both Requirements and Qualifications sections. We need to decide. The posting has "Qualifications Required:" and also "Preferred:" separate. Could treat "Qualifications" as required qualifications, and maybe "Skills" as the list of skills (the "A successful candidate would possess these skills:"). Thus: - Skills: list of skills bullet. - Qualifications: required qualifications bullet list. - Possibly also "Preferred" could be part of Qualifications? But we can include as part of Qualifications or maybe separate? The instruction: prefer few substantive sections over many thin ones. Could combine required and preferred into Qualifications? But we have separate headings allowed. Might be better to have Qualifications (required) and maybe not include Preferred as separate heading unless we have content. Could include Preferred under Qualifications as part of same list? But we need to preserve all info. Could add a note within Qualifications: required and preferred. But better to have Qualifications (required) and maybe another section "Preferred Qualifications". However the allowed headings list does not include "Preferred Qualifications". Only the given list: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we must map content to those. Thus: - About the role: intro paragraph. - Responsibilities: Work you'll do bullet list. - Requirements: maybe the "Qualifications Required:" (required) could go under Requirements. - Qualifications: maybe the "Preferred:" list could go under Qualifications. - Skills: the "A successful candidate would possess these skills:" list. - Benefits: Not explicitly stated besides discretionary annual incentive program. That's a benefit. Also maybe "Limited immigration sponsorship may be available." That's a benefit. Also maybe "You may also be eligible to participate in a discretionary annual incentive program". So we have benefits content. - Pay: The wage range: $105,400 to $207,800. Also mention discretionary annual incentive program but that's benefit. So Pay section with that range. - Schedule: Travel 25-50% mentioned. That's schedule? Could be under Schedule (travel). Also maybe not explicit schedule like full-time. But we have travel percentage. So we can put Schedule: Travel 25-50% on average. We must not include boilerplate like recruiting end date, EEO, etc. Remove "Recruiting for this role ends on 05/31/2027." That's minor metadata; we can fold into short p or drop. Probably drop. Also remove "The wage range for this role takes into account..." etc but we need to keep the range. The surrounding explanation can be omitted? We must preserve ALL substantive information; do not invent or summarize away detail. The explanation about wage range is not substantive? It's commentary; maybe we can keep just the range. The instruction: Preserve ALL substantive information; do NOT invent or summarize away detail. The explanation about wage range is not essential detail but could be considered boilerplate. Safer to keep just the range. Similarly, "Limited immigration sponsorship may be available." is a benefit. Now produce HTML. Structure:

  About the role

  Our Deloitte Cyber team understands the unique challenges and opportunities businesses face in cybersecurity. Join our team to deliver powerful solutions to help our clients navigate the ever-changing threat landscape. Through powerful solutions and managed services that simplify complexity, we enable our clients to operate with resilience, grow with confidence, and proactively manage to secure success. As a Senior Consultant, Strategy, Growth & Transformation in Deloitte Cyber's Cyber for AI practice, you will own and deliver work that helps clients understand and mitigate/monitor the risks of adopting AI across the enterprise and define the cybersecurity controls, governance, policy and risk management approaches needed to deploy AI securely and safely. You will combine client advisory with structured cyber risk and governance work, turning business and regulatory requirements into frameworks, roadmaps and recommendations, and you will work closely with the practice's Data, Infrastructure, Identity, Security Operations and Application Security teams to make sure strategy translates into implementable requirements. You will guide junior practitioners, lead project activities and client interactions and help identify, win and deliver new work.

  Responsibilities

  • Lead discovery and current-state assessments of client AI cybersecurity controls governance, risk management and security practices across business units and AI use cases.
  • Facilitate stakeholder workshops with security, risk, data science, legal and business leaders to surface AI risk concerns and gather requirements.
  • Develop AI risk registers, control frameworks and maturity assessments aligned to standards such as the NIST AI RMF, ISO/IEC 42001, the OWASP LLM Top 10 and MITRE ATLAS.
  • Translate strategic recommendations into workstream-level roadmaps, coordinating with Data, Infrastructure, Identity and Application Security practitioners on technical implementation details.
  • Draft governance artifacts, including AI use-case intake processes, policy templates, model risk tiering approaches and AI security awareness materials.
  • Own a workstream within a broader engagement, manage dependencies and milestones, provide day-to-day guidance to consultants, and support client demonstrations, executive readouts, and research, benchmarking, and estimation inputs to pursuits.

  Requirements

  • Bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity, or Risk Management
  • 4+ years of experience in cybersecurity, risk, or technology consulting, including experience with artificial intelligence or machine learning systems, data governance, or emerging technology risk.
  • Experience working with artificial intelligence and machine learning concepts, including model development, training, fine-tuning, retrieval-augmented generation, and agentic architectures.
  • Experience applying artificial intelligence risk and security frameworks or regulations, including the National Institute of Standards and Technology Artificial Intelligence Risk Management Framework (NIST AI RMF), International Organization for Standardization/International Electrotechnical Commission 42001 (ISO/IEC 42001), Open Worldwide Application Security Project Large Language Model Top 10 (OWASP LLM Top 10), MITRE Adversarial Threat Landscape for Artificial-Intelligence Systems (MITRE ATLAS), or the European Union Artificial Intelligence Act.
  • Experience conducting risk assessments, gap analyses, or maturity assessments in cybersecurity, privacy, or governance and developing strategy documents, governance frameworks, and executive presentation materials.
  • Ability to travel 25-50%, on average, based on the work you do and the clients and industries/sectors you serve.
  • Limited immigration sponsorship may be available.

  Qualifications

  • Experience in consulting, client delivery, or client-facing advisory roles and experience building or customizing prompts, templates, or lightweight artificial intelligence workflows to standardize recurring deliverables, including risk registers, maturity assessments, or policy drafts.
  • Experience with artificial intelligence governance platforms, governance, risk, and compliance tools, or model risk management systems.
  • Experience with the machine learning lifecycle and technologies such as PyTorch, TensorFlow, or MLflow.
  • Experience developing reusable strategy assets, reviewing work products of junior consultants, or contributing to methodologies and frameworks.
  • Experience in regulated industries such as financial services, healthcare, life sciences, or the public sector.
  • Certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Data Privacy Solutions Engineer (CDPSE), Artificial Intelligence Governance Professional (AIGP), or ISO/IEC 42001 Foundation or Lead Implementer.

  Skills

  • Ability to work independently and collaborate as part of a team
  • Effective written and verbal communication skills
  • Meticulous attention to detail and quality of work product
  • Ability to build and sustain professional relationships
  • Ability to lead projects or workstreams
  • Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment
  • Strong interpersonal skills and professional demeanor
  • Ability to meet deadlines
  • Ability to provide clear guidance to others

  Benefits

  • Discretionary annual incentive program (eligibility subject to program rules)
  • Limited immigration sponsorship may be available

  Pay

  $105,400 to $207,800

  Schedule

  Travel 25-50% on average

  Check for any duplicated content: Travel appears both in Requirements and Schedule. We moved travel to Requirements? Actually we placed travel under Requirements list. But we also have Schedule section with travel. That duplicates. We should avoid duplication. The instruction: Preserve ALL substantive information; do NOT invent or summarize away detail. We need to keep travel info somewhere. Could keep it only under Schedule and not duplicate in Requirements. But Requirements list also includes ability to travel; it's a requirement. Could keep it under Requirements and not have Schedule? But Schedule is a heading we can include only if posting actually states them. It does state travel percentage. So we need Schedule. We could keep travel info only under Schedule and remove from Requirements. However the Requirements list also includes ability to travel as a requirement; it's substantive. If we remove it, we lose that detail. But we could keep it in Requirements as a requirement and also have Schedule referencing same info; that duplicates but still preserves info. Duplication is not prohibited; they said do not repeat job title as heading, but duplication of content maybe okay. However they said "Prefer a few substantive sections over many thin ones." Duplication may be okay but could be considered thin. Better to keep travel only under Schedule and note that it's also a requirement? Could incorporate into Requirements as "Ability to travel 25-50% on average" and then Schedule could be omitted? But they said include a section ONLY when the posting has real, specific content for it. The posting does have schedule info (travel). So we should include Schedule. Having it also in Requirements is okay but maybe redundant. I'd keep it in both to preserve all detail; it's not violating any rule. The instruction about duplication: "Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions." Duplicated lines refers to duplicated lines in the posting, not our duplication. So fine. Now ensure no markdown fences. Output only HTML. Check for any leftover boilerplate: We removed recruiting end date, EEO, etc. We kept limited immigration sponsorship in Requirements and Benefits (duplicate). That's okay. Check for any mention of "You may also be eligible to participate in a discretionary annual incentive program, subject to the rules governing the program, whereby an award, if any, depends on various factors, including, without limitation, individual and organizational performance." We kept just "Discretionary annual incentive program (eligibility subject to program rules)". That's summarizing but maybe loses detail about award depends on factors. That could be considered summarizing away detail