Lead Consultant, Oil & Gas Cybersecurity Assessment & Audit

Bureau Veritas•Remo, VA

3d•Remote

About The Position

Bureau Veritas Cyber Physical Security is seeking an experienced Oil & Gas Cybersecurity Assessment & Audit Lead to support and grow its Assessment & Audit service pillar. The role primarily leads cybersecurity assessments and audits across upstream, midstream, downstream, offshore, and associated industrial operations. It requires a strong understanding of Oil & Gas operations, safety culture, operational technology (OT), industrial control systems (ICS), cybersecurity, and risk. The Lead may also support comparable engagements across other critical infrastructure and industrial sectors, including energy, utilities, manufacturing, data centers, and transportation. The position sits at the intersection of operations, safety, OT/ICS cybersecurity, technical assurance, and governance, risk, and compliance. The Lead translates cybersecurity and control requirements into practical assessment activities appropriate for live industrial environments. The role plans and executes assessments, leads field activities, evaluates evidence, develops defensible findings, manages client interactions, and produces high-quality deliverables while maintaining a strong safety and operational-risk mindset. The Lead serves as the technical and delivery lead for assigned engagements, coordinating assessment work from kickoff through fieldwork, reporting, client review, and closeout. The role also mentors junior team members, contributes to repeatable methodologies and assessment offerings, and supports client and practice development. Work includes a balance of onsite fieldwork and office-based activities, with potential remote assessments where feasible. Regular domestic and international travel to client sites, including offshore, remote, and industrial locations, is required as needed.

Requirements

At least 10 years of professional experience within the Oil & Gas industry, including meaningful experience in operational, engineering, technical assurance, cybersecurity, controls, safety, or industrial environments.
Demonstrated cybersecurity experience involving OT, ICS, industrial, or critical infrastructure environments.
Strong understanding of Oil & Gas operations, including upstream, midstream, downstream, offshore, and the operational constraints of production environments.
Working knowledge of industrial control and automation environments and industrial network and control-system architectures.
In-depth knowledge of OT systems, including DCS, PLC, SIS, SCADA, HMI, engineering workstations, and industrial networks.
Understanding of OT cybersecurity standards and frameworks such as ISA/IEC 62443, NIST CSF, NIST SP 800-82, API 1164, and ISA84.00.09 v3.
Experience with cybersecurity maturity, risk, compliance, gap, or control-effectiveness assessments.
Familiarity with cybersecurity controls including asset management, identity and access, network segmentation, remote access, system hardening, backup and recovery, change management, vulnerability management, logging and monitoring, and incident preparedness.
Ability to assess cybersecurity risk in the context of asset criticality, safety, environmental impact, operational availability, reliability, and production requirements.
Experience with cybersecurity governance, risk, and compliance (GRC).
Strong safety mindset and understanding of safe working practices in industrial facilities, including process safety, functional safety, and operational reliability.
Ability to assess technical, procedural, and governance cybersecurity controls.
Ability to engage effectively with operational personnel, engineers, HSE teams, cybersecurity teams, IT teams, management, and executives.
Strong written and verbal communication skills, including the ability to develop professional technical reports, findings, recommendations, and executive summaries.
Ability to lead and coordinate multidisciplinary teams and mentor junior auditors, consultants, and technical specialists.
Ability to develop assessment plans, evidence requirements, interview plans, fieldwork schedules, and assessment procedures, and manage engagements through closeout.
Ability to adapt assessment methods to system criticality, operating state, safety constraints, risk profile, and sector-specific differences.
Ability and willingness to travel to client facilities, including offshore or remote locations, as required.

Nice To Haves

Previous cybersecurity audit, assurance, inspection, risk assessment, or compliance assessment experience.
Offshore Oil & Gas experience.
Safety, HSE, process safety, or operational assurance experience.
Control-system engineering or automation experience.
Hands-on experience with DCS, SIS, PLC, SCADA, industrial networks, or associated OT systems.
OT cybersecurity architecture or engineering experience.
Cybersecurity GRC experience within regulated or critical infrastructure environments.
Experience with recognized OT/ICS cybersecurity standards and frameworks such as ISA/IEC 62443, NIST CSF, NIST SP 800-82, API 1164, ISA84.00.09 v3 (2024), or comparable requirements.
Experience performing cybersecurity maturity, risk, compliance, gap, or control-effectiveness assessments.
Experience working in another critical infrastructure sector in addition to Oil & Gas.
Relevant professional certifications such as CISSP, CISM, CISA, CRISC, GICSP, ISA/IEC 62443, or equivalent.
Relevant Oil & Gas, control systems, functional safety, HSE, or offshore safety qualifications.

Responsibilities

Lead cybersecurity assessments and audits across Oil & Gas facilities, including offshore assets, production environments, pipelines, processing facilities, terminals, and supporting infrastructure.
Plan and execute onsite and remote assessment activities, including document review, stakeholder interviews, technical walkthroughs, control verification, and evidence collection.
Evaluate the implementation and effectiveness of cybersecurity controls in operational environments, considering asset criticality, safety, environmental impact, availability, reliability, and production requirements.
Develop evidence-based findings, observations, recommendations, and executive-level reports.
Lead client kickoff meetings, field activities, daily readouts, debriefs, and final report discussions.
Assess OT and ICS cybersecurity controls associated with DCS, PLC, SIS, SCADA, HMI, engineering workstations, historians, industrial networks, and supporting infrastructure.
Evaluate technical and procedural controls for asset management, identity and access, network segmentation, remote access, system hardening, backup and recovery, change management, vulnerability management, logging and monitoring, and incident preparedness.
Adapt technical assessment methods to system criticality, operating state, safety constraints, and risk profile; recognize and mitigate potential operational or safety risks from assessment activities.
Work within client HSE and site-access requirements, permit-to-work processes, and offshore or industrial operating procedures, engaging Operations, HSE, Engineering, Maintenance, Automation/Controls, IT, OT, and cybersecurity stakeholders.
Lead cybersecurity maturity, risk, gap, control-effectiveness, and compliance assessments against recognized standards, regulatory requirements, and client-specific policies and frameworks.
Translate policies and control requirements into practical technical and operational verification activities; evaluate control design and implementation using documentation, interviews, technical evidence, and field observations.
Support the development and review of cybersecurity policies, standards, procedures, risk registers, remediation plans, and control frameworks when included in engagement scope.
Support OT cybersecurity assessments and audits across other critical infrastructure and industrial sectors, adapting common principles to sector-specific processes, technologies, safety needs, regulatory obligations, and business risks.
Work with sector-specific subject matter experts and contribute lessons learned and practices to a scalable, cross-sector Assessment & Audit methodology.
Serve as technical and delivery lead for assigned engagements; develop assessment plans, evidence requirements, interview plans, fieldwork schedules, and procedures.
Coordinate multidisciplinary teams involving cybersecurity specialists, auditors, control-system engineers, HSE and operations personnel, and other subject matter experts.
Manage assessment engagements from kickoff through fieldwork, reporting, client review, and closeout; review evidence and perform technical and quality reviews of reports before delivery.
Mentor junior auditors, consultants, and technical specialists, and help develop repeatable methodologies, checklists, templates, evidence requirements, and field procedures.
Act as a trusted advisor to Oil & Gas and critical infrastructure clients; participate in client discussions, workshops, proposals, scoping, and assessment planning.
Identify opportunities for broader services based on client needs while maintaining appropriate boundaries between independent assessment and other services.
Contribute Oil & Gas and operational cybersecurity expertise to Bureau Veritas' cyber-physical assurance capabilities and support development of scalable assessment offerings and methodologies.
Conduct onsite assessments in industrial settings, comply with client-site safety protocols, and wear required PPE.
Travel regularly to client sites, including offshore, remote, and industrial environments, domestically and internationally as required.