Lead Consultant - Cybersecurity Commissioning, Verification & Validation

Accountabilities:

• Lead cybersecurity commissioning activities for new and existing industrial and cyber-physical environments.

• Translate cybersecurity requirements, specifications, standards, and design documentation into executable commissioning and verification procedures.

• Develop commissioning plans, test scripts, verification checklists, evidence requirements, and acceptance criteria.

• Coordinate cybersecurity activities with engineering, construction, systems integration, and operational readiness teams.

• Verify that cybersecurity controls have been implemented as intended before operational acceptance, identifying gaps and documenting technical risks.

• Lead verification and validation (V&V) activities across operational technology (OT) and industrial control systems (ICS).

• Review system architectures, network diagrams, configurations, engineering documentation, and implementation evidence against approved requirements and applicable standards.

• Validate cybersecurity controls covering network segmentation, firewalls, remote access, identity and access management, system hardening, vulnerability management, logging, monitoring, endpoint security, backup and recovery, and other critical areas.

• Develop structured test procedures with clear objectives, prerequisites, test steps, expected results, evidence requirements, and acceptance criteria.

• Conduct on-site and remote validation activities, ensuring that testing does not unnecessarily disrupt production, system availability, or safety-critical operations.

• Coordinate technical execution with client representatives, engineering teams, system integrators, original equipment manufacturers (OEMs), and other stakeholders.

• Track findings, outstanding evidence, dependencies, remediation activities, and retesting requirements throughout each engagement.

• Produce technically rigorous commissioning records, validation reports, findings, and final deliverables supported by objective evidence.

• Translate validation failures into practical remediation recommendations and verify corrective actions through targeted retesting.

• Escalate unresolved technical risks and residual issues that may affect cybersecurity readiness or operational acceptance.

• Apply relevant standards and guidance, including ISA/IEC 62443, NIST SP 800-82, ISA84.00.09 v3 (2024), PLC Top 20 Secure Programming Practices, and cyber-informed engineering principles.

• Contribute to repeatable commissioning and V&V methodologies, technical procedures, templates, checklists, and internal guidance.

• Support the development and evaluation of laboratory environments and technical tools for testing cybersecurity procedures before deployment in sensitive operational systems.

• Provide technical guidance and mentorship to consultants and engineers, reviewing their test procedures, evidence, findings, and deliverables.

• Support effort estimation, resource planning, scheduling, and coordination across assigned engagements.

Requirements:

• At least 7 years of relevant experience in operational technology, industrial automation, control systems engineering, industrial cybersecurity, commissioning, systems integration, systems validation, engineering assurance, or related cyber-physical environments.

• Practical experience working with industrial control systems and associated infrastructure, including PLCs, Distributed Control Systems (DCS), SCADA, Building Management Systems (BMS), Safety Instrumented Systems (SIS), industrial networks, and field devices.

• Strong understanding of industrial network architectures, segmentation, zones and conduits, firewalls, remote access, communications paths, and security boundaries.

• Experience executing technical testing, commissioning, verification, validation, assurance, or system acceptance activities.

• Experience working directly with technical teams in industrial facilities, critical infrastructure, data centers, manufacturing, utilities, oil and gas, or comparable operational environments.

• Ability to review engineering documentation, architecture diagrams, system configurations, technical requirements, and implementation evidence.

• Proven ability to develop structured test procedures and objectively assess whether cybersecurity requirements have been implemented successfully.

• Experience documenting technical findings, identifying implementation gaps, and developing practical remediation recommendations.

• Understanding of industrial cybersecurity architecture and the implementation of security controls across operational environments.

• Familiarity with relevant cybersecurity standards and practices, including ISA/IEC 62443 (2-1, 3-3, 3-2, 4-2), NIST SP 800-82, ISA84.00.09 v3 (2024), and PLC Top 20 Secure Programming Practices.

• Understanding of how cybersecurity activities interact with engineering, construction, integration, commissioning, operations, and system lifecycle processes.

• Practical experience with cybersecurity control validation, including network segmentation, access control, secure remote access, identity management, system hardening, patch and vulnerability management, logging, monitoring, and endpoint security.

• Experience with industrial or OT commissioning, Factory Acceptance Testing (FAT), Site Acceptance Testing (SAT), integrated systems testing, systems integration, or systems validation is beneficial.

• Additional experience in control-system engineering, OT network engineering, security architecture, technical cybersecurity assessments, OT penetration testing, control-system modernization, or greenfield and brownfield projects is an advantage.

• Familiarity with technical tools and laboratory environments used for cybersecurity verification and validation.

• Relevant certifications are beneficial but not required, including ISA/IEC 62443, GIAC Industrial Cybersecurity (GICSP), CISSP, industrial automation or control-system vendor certifications, commissioning or networking credentials, and safety certifications such as OSHA or ISA84.

• Strong written and verbal communication skills, with the ability to explain technical findings and remediation recommendations to both technical and non-technical stakeholders.

• Demonstrated leadership and mentoring abilities, including reviewing technical work and promoting engineering discipline, evidence-based validation, and safe testing practices.

• Strong troubleshooting, root-cause analysis, structured problem-solving, and attention to technical detail.

• A safety-first mindset and understanding of the relationship between cybersecurity, process safety, functional safety, operational reliability, and safety-critical systems.

• Ability to manage multiple technical workstreams, dependencies, schedules, and project requirements.

• Willingness and ability to travel regularly, both domestically and internationally, including to offshore, remote, and industrial client locations.

• Ability to work in varied industrial environments, including potentially noisy, dusty, or temperature-extreme facilities, and to follow site safety procedures and use required personal protective equipment (PPE).

• Ability to walk, stand, and move around for extended periods, climb stairs or ladders when required, and lift or carry equipment weighing up to 25 pounds.

• Flexibility to work across time zones and adapt to client schedules.

Benefits:

• Permanent, full-time employment.

• Remote work arrangement, with on-site client visits and fieldwork as required.

• Attractive salary and benefits package; specific compensation figures are not provided in the job description.

• Opportunity to work on cybersecurity commissioning and assurance projects across industrial and critical infrastructure environments.

• Exposure to diverse technologies and sectors, including utilities, manufacturing, data centers, and oil and gas.

• Opportunity to contribute to technical methodologies, laboratory capabilities, and the development of cybersecurity validation practices.

• Professional development through collaboration with experienced engineering, cybersecurity, and technical assurance professionals.