Bureau Veritas→
Lead Consultant - Cybersecurity… at Bureau Veritas · Remote
Skills
Job Description
A WORLD LEADER IN TESTING, INSPECTION & CERTIFICATION SERVICES
Bureau Veritas offers dynamic, exciting employment opportunities with an attractive salary/benefit package and an opportunity to play a vital role with a global organization. If you would enjoy working in a dynamic environment and are looking for an opportunity to become part of a stellar team of professionals, we invite you to apply online today.
Bureau Veritas is an Equal Opportunity Employer, and as such we recruit, hire, train, and promote persons in all job classifications without regard to race, color, religion, sex, national origin, disability, age, marital status, citizen status, sexual orientation, gender identity, genetics, status as a protected veteran, or any other non-job-related characteristics.
This position is responsible to ensure equal opportunity in employment in that all persons are treated equally and on the basis of merit, in decisions regarding selection, placement, promotions, training, work assignments, transfers and other personnel actions.
City: Remote
State: Remote
Job Summary:
The Lead Consultant, Cybersecurity Commissioning, Verification & Validation is a senior technical delivery role responsible for executing and leading cybersecurity commissioning, verification, validation, and assurance activities across industrial and cyber-physical environments.
The role focuses primarily on delivery. The individual will lead technical assessments, develop and execute verification procedures, review engineering and cybersecurity evidence, perform field and remote validation activities, document findings, support remediation, and ensure cybersecurity requirements are implemented and operating as intended.
The Lead Consultant works directly with client engineering, operations, commissioning, construction, security, system integrators, OEMs, and other project stakeholders to integrate cybersecurity verification into the broader engineering and commissioning lifecycle.
The role requires a practical understanding of operational technology, industrial control systems, cybersecurity architecture, commissioning practices, and technical assurance. The individual must be capable of translating cybersecurity requirements and design intent into executable test procedures, objective evidence, technical findings, and actionable remediation.
Essential Duties and Responsibilities
Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.
Cybersecurity Commissioning Leadership
Lead cybersecurity commissioning activities for new and existing industrial and cyber-physical environments.
Translate cybersecurity requirements, specifications, standards, and design requirements into executable commissioning and verification procedures.
Develop commissioning plans, verification checklists, test scripts, evidence requirements, and acceptance criteria.
Coordinate cybersecurity commissioning activities with broader engineering, construction, integration, and operational readiness activities.
Verify that cybersecurity requirements have been implemented as intended prior to operational acceptance.
Identify incomplete, incorrectly implemented, or unverified cybersecurity requirements and document associated technical risks.
Support retesting and closure of commissioning findings following remediation.
Maintain clear traceability between cybersecurity requirements, verification activities, evidence, findings, remediation, and closure.
Verification & Validation
Lead cybersecurity verification and validation activities across OT and cyber-physical systems.
Validate implemented cybersecurity controls against design documentation, specifications, approved architectures, client requirements, and applicable standards.
Perform technical verification through configuration review, evidence inspection, system observation, targeted testing, and stakeholder walkthroughs.
Evaluate whether implemented controls are technically effective and appropriate for the operational environment.
Identify differences between documented design, configured implementation, and actual operating conditions.
Develop structured V&V test procedures with defined objectives, prerequisites, test steps, expected results, evidence requirements, and acceptance criteria.
Maintain accurate validation records and supporting evidence throughout execution.
Support regression or repeat validation following system changes and remediation activities.
Technical Delivery Leadership
Lead the technical execution of cybersecurity commissioning and V&V engagements from planning through final reporting.
Review system architecture, network diagrams, control narratives, security requirements, configuration documentation, asset information, and other engineering artifacts.
Identify technical prerequisites and evidence required before commissioning and validation activities begin.
Coordinate execution with client representatives, engineering teams, system integrators, OEMs, and other responsible parties.
Track technical findings, outstanding evidence, dependencies, retesting requirements, and remediation status.
Escalate technical risks and execution blockers that may affect cybersecurity readiness or completion of validation activities.
Ensure technical findings are supported by objective evidence and clearly communicated.
Produce technically rigorous commissioning records, validation reports, findings, and final deliverables.
Support effort estimation, resource planning, and scheduling for assigned engagements.
Industrial Control Systems Expertise
Apply practical knowledge of industrial and operational technology environments, including:
PLC-based control systems
Distributed Control Systems (DCS)
SCADA systems
Building Management and Building Automation Systems (BMS/BAS)
Safety Instrumented Systems (SIS)
Industrial networks
Field devices and intelligent electronic devices
Engineering workstations and operator interfaces
Historians, application servers, and supporting infrastructure
Understand industrial network architectures, segmentation, zones and conduits, firewalls, remote access, communications paths, and security boundaries.
Assess cybersecurity controls without unnecessarily disrupting operational or safety-critical systems.
Understand the interaction between cybersecurity controls, system availability, engineering requirements, operational constraints, and functional safety.
Cybersecurity Control Validation
Lead and perform validation activities covering areas including:
Network segmentation and security boundaries
Firewall and access-control implementation
Secure remote access
Identity and access management
Privileged access
Authentication and authorization
System and device hardening
Secure configuration
Unnecessary services and communications
Patch and vulnerability management
Backup and recovery
Logging and monitoring
Endpoint security
Security monitoring integration
Time synchronization
Configuration and change management
Engineering workstation security
Application and server security
Physical and logical access controls
Asset inventory and system documentation
Cybersecurity recovery readiness
Engineering & Field Validation
Conduct on-site and remote validation activities within industrial and cyber-physical environments.
Validate security controls against actual system configurations rather than relying solely on documentation or questionnaire responses.
Review configurations and supporting artifacts necessary to demonstrate control implementation.
Work safely within live, operational, pre-operational, and commissioning environments.
Coordinate testing activities to minimize potential impact to production, availability, safety, or system functionality.
Recognize when a cybersecurity test could introduce operational risk and establish an appropriate validation approach.
Support troubleshooting and root-cause analysis when controls cannot be successfully validated.
Clearly distinguish between verified controls, partially verified controls, failed validation, and controls that cannot be tested because prerequisites or evidence are unavailable.
Findings, Remediation & Closure
Develop clear technical findings supported by objective evidence.
Translate validation failures into practical remediation actions for engineering, integration, cybersecurity, and operations teams.
Differentiate between design issues, implementation issues, configuration issues, documentation gaps, and operational readiness issues.
Support technical discussions with responsible stakeholders to determine practical remediation approaches.
Validate remediation through targeted retesting and evidence review.
Maintain traceability of findings through remediation and closure.
Identify residual risks that cannot be resolved through technical remediation and support appropriate escalation.
Standards & Methodology
Apply relevant cybersecurity standards, practices and guidelines to commissioning and verification activities, including:
ISA/IEC 62443 (2-1, 3-3, 3-2, 4-2)
NIST SP 800-82
ISA84.00.09 v3 (2024)
PLC Top 20 Secure Programming Practices
Client cybersecurity requirements and engineering standards
Applicable regulatory and sector-specific requirements
Cyber-informed engineering principles
Translate standards and cybersecurity requirements into practical, testable engineering controls.
Contribute to development and improvement of repeatable commissioning and V&V methodologies, procedures, checklists, templates, and technical guidance.
Support consistency in how evidence is collected, findings are documented, and controls are validated across engagements.
Tools, Lab & Technical Capability
Use appropriate technical tools to support cybersecurity verification and validation activities.
Support development of representative laboratory environments for validation of test procedures and methodologies.
Test commissioning procedures in controlled environments before applying them to sensitive operational systems where appropriate.
Help evaluate technical tools and approaches used for OT cybersecurity validation.
Contribute lessons learned from engagements into reusable testing procedures and internal technical guidance.
Team Leadership & Mentorship
Provide technical guidance to consultants and engineers supporting commissioning and V&V engagements.
Review test procedures, evidence, findings, and technical deliverables prepared by other team members.
Help junior team members understand industrial systems, commissioning methodology, validation techniques, and safe testing practices.
Promote strong engineering discipline, evidence-based validation, safety awareness, and structured problem solving.
Support consistent documntation and reporting practices across engagements.
Supervisory Responsibilities
No supervisory responsibilities
Skills
The requirements listed below are representative of acquired skills required.
Operational Technology (OT) and Industrial Control Systems (ICS):
- In-depth knowledge of PLC-based control systems, Distributed Control Systems (DCS), SCADA systems, Building Management Systems (BMS), Safety Instrumented Systems (SIS), industrial networks, and field devices.
- Understanding of industrial network architectures, segmentation, zones and conduits, firewalls, remote access, and security boundaries.
Cybersecurity Standards and Frameworks:
- Familiarity with ISA/IEC 62443, NIST SP 800-82, ISA84.00.09 v3 (2024), and PLC Top 20 Secure Programming Practices.
- Ability to translate standards and cybersecurity requirements into practical, testable engineering controls.
Cybersecurity Control Validation:
- Expertise in validating network segmentation, firewall and access-control implementation, secure remote access, identity and access management, system and device hardening, patch and vulnerability management, logging and monitoring, and endpoint security.
Verification & Validation (V&V) Methodologies:
- Ability to develop structured V&V test procedures with defined objectives, prerequisites, test steps, expected results, evidence requirements, and acceptance criteria.
- Experience in conducting on-site and remote validation activities within industrial and cyber-physical environments.
Tools and Lab Environments:
- Proficiency in using technical tools to support cybersecurity verification and validation activities.
- Experience in developing representative laboratory environments for validation of test procedures and methodologies.
Industry-Specific Knowledge:
- Industrial and Cyber-Physical Environments
- Practical experience working with industrial control systems and associated infrastructure.
- Experience in industrial or OT commissioning, Factory Acceptance Testing (FAT), Site Acceptance Testing (SAT), and systems integration.
Competency
The requirements listed below are competencies required to perform the job successfully.
Communication:
- Strong written and verbal communication skills to clearly document findings, develop remediation recommendations, and communicate technical information to non-technical stakeholders.
Team Leadership & Mentorship:
- Ability to provide technical guidance to consultants and engineers, review technical deliverables, and mentor junior team members.
- Promotion of strong engineering discipline, evidence-based validation, safety awareness, and structured problem-solving.
Problem-Solving:
- Strong troubleshooting and root-cause analysis skills to identify and address implementation gaps and technical issues.
Attention to Detail:
- Strong attention to technical detail to ensure accurate validation of cybersecurity controls and documentation of findings.
Safety-First Approach:
- Demonstrated commitment to safety when working with operational systems and in industrial environments.
Project Management:
- Ability to manage multiple technical workstreams and dependencies, and support effort estimation, resource planning, and scheduling for assigned engagements.
Education, Certifications, and Experience (required)
- 7+ years of relevant experience across operational technology, industrial automation, control systems engineering, industrial cybersecurity, commissioning, systems integration, systems or component validation, engineering assurance, or related cyber-physical environments.
- Practical experience working with industrial control systems and associated infrastructure.
- Experience executing technical testing, commissioning, verification, validation, assurance, or system acceptance activities.
- Experience working directly with technical teams in industrial, critical infrastructure, data center, manufacturing, utility, Oil & Gas, or comparable operational environments.
- Experience reviewing engineering documentation, architecture diagrams, system configurations, technical requirements, and implementation evidence.
- Experience documenting technical findings and developing practical remediation recommendations.
- Ability to develop structured test procedures and objectively determine whether requirements have been successfully implemented.
- Understanding of industrial cybersecurity architecture and security control implementation.
- Familiarity with relevant cybersecurity standards, practices and guidelines, including:
- ISA/IEC 62443 (2-1, 3-3, 3-2, 4-2)
- NIST SP 800-82
- ISA84.00.09 v3 (2024)
- PLC Top 20 Secure Programming Practices
- Cyber-informed engineering principles
- Understanding of how cybersecurity activities interact with engineering, construction, integration, commissioning, operations, and system lifecycle processes.
- Ability to travel to client sites as required for commissioning and validation activities.
- Preferred Experience
- Experience in one or more of the following is beneficial:
- Industrial or OT commissioning
- Cybersecurity commissioning
- Factory Acceptance Testing (FAT)
- Site Acceptance Testing (SAT)
- Integrated Systems Testing
- Systems integration
- Systems Validation
- Control system engineering
- OT network engineering
- Security architecture
- Technical cybersecurity assessments
- OT penetration testing or security validation
- Control-system retrofit or modernization projects
- Greenfield industrial or infrastructure projects
- Brownfield operational environments
- Certifications are not required but may be beneficial:
- ISA/IEC 62443 certifications
- GIAC industrial cybersecurity certifications (GICSP)
- CISSP
- Industrial automation or control-system vendor certifications
- Relevant commissioning, engineering, networking, or cybersecurity certifications
- Safety Certifications (OSHA, ISA84)
Physical and Environmental Conditions
The physical demands and work environment characteristics described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
Fieldwork:
Conduct onsite assessments and audits in various industrial settings.
Work in potentially hazardous environments, including oil rigs, refineries, and processing facilities.
Physical Activity:
Ability to walk, stand, and move around for extended periods.
May require climbing stairs, ladders, or other elevated structures.
Ability to lift and carry equipment and documentation (up to 25 pounds) as needed.
Safety Requirements:
Adhere to all safety protocols and procedures at client sites.
Wear personal protective equipment (PPE) as required.
Work Environment:
Industrial Settings:
Work in oil and gas facilities, which may include noisy, dusty, or otherwise challenging conditions.
Exposure to extreme temperatures, both hot and cold.
Office Environment:
Balance between fieldwork and office-based activities.
Use of computers, phones, and other standard office equipment.
Client Interactions:
Regular interaction with clients, which may include meetings, presentations, and discussions.
Ability to work in a team environment with colleagues and subject matter experts.
Remote Work:
Potential for remote work, including virtual assessments and audits where feasible.
Use of video conferencing and collaboration tools.
Additional Considerations:
Safety-First Mindset:
Maintain a strong safety-first mindset for all field and assessment activities.
Understand the relationship between cybersecurity, process safety, functional safety, operational reliability, and safety-critical systems.
Adaptability:
Ability to adapt to changing environments and conditions.
Flexibility to work in various time zones and adjust to client schedules.
Note: This job description is intended to provide a general overview of the position. It is not an exhaustive list of duties, responsibilities, or skills required.
Travel Requirements
- Travel:
- Regular client-site travel, including offshore, remote, and industrial environments.
- Ability to travel domestically and internationally as required.
This job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required. Duties, responsibilities and activities may change, or new ones may be assigned at any time with or without notice.
If you are an individual with a disability and you would like us to assist you with searching the Careers Page site for employment opportunities and/or assistance with completing your profile and application, please contact us at 1-888-357-7020 or email us with your request to NorthAmericaTA@bureauveritas.com.
We are happy to assist you and encourage you to consider Bureau Veritas for your next great career opportunity!
If you would like additional information regarding Bureau Veritas' federal obligations in regards to equal employment opportunity, please click the link below: