Lead Consultant - Cybersecurity Commissioning, Verification & Validation

Bureau Veritas•Remo, VA

3d•Remote

About The Position

The Lead Consultant, Cybersecurity Commissioning, Verification & Validation is a senior technical delivery role responsible for leading and executing cybersecurity commissioning, verification, validation, and assurance activities in industrial and cyber-physical environments. The role focuses on technical delivery: translating cybersecurity requirements and design intent into executable test procedures, reviewing engineering and cybersecurity evidence, conducting field and remote validation, documenting findings, supporting remediation, and confirming that controls are implemented and operating as intended. The Lead Consultant works with client engineering, operations, commissioning, construction, security, system integrators, OEMs, and other project stakeholders to integrate cybersecurity verification into engineering and commissioning lifecycles. The position requires practical knowledge of operational technology, industrial control systems, cybersecurity architecture, commissioning practices, and technical assurance. It also includes technical engagement leadership, deliverable review, mentoring, and contributions to reusable methodologies and laboratory validation. The role involves regular travel to client sites, including offshore, remote, and industrial environments, domestically and internationally. Work may include onsite and remote assessments in operational, pre-operational, and commissioning settings, as well as office-based work. Field environments may be noisy, dusty, hazardous, or subject to extreme temperatures. The position requires following site safety protocols and using PPE as required.

Requirements

At least 7 years of relevant experience across OT, industrial automation, control systems engineering, industrial cybersecurity, commissioning, systems integration, systems or component validation, engineering assurance, or related cyber-physical environments.
Practical experience working with industrial control systems and associated infrastructure.
Experience executing technical testing, commissioning, verification, validation, assurance, or system acceptance activities.
Experience working directly with technical teams in industrial, critical infrastructure, data center, manufacturing, utility, Oil & Gas, or comparable operational environments.
Experience reviewing engineering documentation, architecture diagrams, system configurations, technical requirements, and implementation evidence.
Experience documenting technical findings and developing practical remediation recommendations.
Ability to develop structured test procedures and objectively determine whether requirements have been successfully implemented.
Understanding of industrial cybersecurity architecture and security control implementation.
Familiarity with ISA/IEC 62443 (2-1, 3-3, 3-2, 4-2), NIST SP 800-82, ISA84.00.09 v3 (2024), PLC Top 20 Secure Programming Practices, and cyber-informed engineering principles.
Understanding of how cybersecurity activities interact with engineering, construction, integration, commissioning, operations, and system lifecycle processes.
Ability to travel to client sites as required for commissioning and validation activities.
In-depth knowledge of PLC-based control systems, DCS, SCADA, BMS, SIS, industrial networks, field devices, and industrial network architectures, including segmentation, zones and conduits, firewalls, remote access, and security boundaries.
Expertise validating cybersecurity controls such as network segmentation, firewall and access control, secure remote access, identity and access management, hardening, patch and vulnerability management, logging and monitoring, and endpoint security.
Ability to develop structured V&V procedures with defined objectives, prerequisites, test steps, expected results, evidence requirements, and acceptance criteria.
Experience conducting onsite and remote validation in industrial and cyber-physical environments.
Proficiency using technical tools for cybersecurity verification and validation.
Strong written and verbal communication skills, including documenting findings, developing remediation recommendations, and communicating technical information to non-technical stakeholders.
Ability to provide technical guidance, review deliverables, and mentor junior team members.
Strong troubleshooting and root-cause analysis skills.
Strong attention to technical detail and accurate documentation.
Demonstrated commitment to safety when working with operational systems and in industrial environments.
Ability to manage multiple technical workstreams and dependencies and support effort estimation, resource planning, and scheduling.

Nice To Haves

Experience in industrial or OT commissioning, cybersecurity commissioning, Factory Acceptance Testing (FAT), Site Acceptance Testing (SAT), Integrated Systems Testing, systems integration, systems validation, control-system engineering, OT network engineering, security architecture, technical cybersecurity assessments, OT penetration testing or security validation, control-system retrofit or modernization projects, greenfield industrial or infrastructure projects, or brownfield operational environments.
Experience developing representative laboratory environments for validating test procedures and methodologies.
ISA/IEC 62443 certifications.
GIAC industrial cybersecurity certifications (GICSP).
CISSP certification.
Industrial automation or control-system vendor certifications.
Relevant commissioning, engineering, networking, or cybersecurity certifications.
Safety certifications such as OSHA or ISA84.

Responsibilities

Lead cybersecurity commissioning activities for new and existing industrial and cyber-physical environments.
Translate cybersecurity requirements, specifications, standards, and design requirements into executable commissioning and verification procedures.
Develop commissioning plans, verification checklists, test scripts, evidence requirements, and acceptance criteria.
Coordinate cybersecurity commissioning with engineering, construction, integration, operational readiness, and other project activities.
Verify that cybersecurity requirements have been implemented as intended before operational acceptance; identify and document incomplete, incorrectly implemented, or unverified requirements and associated risks.
Support retesting and closure of commissioning findings following remediation, maintaining traceability across requirements, verification, evidence, findings, remediation, and closure.
Lead cybersecurity verification and validation across OT and cyber-physical systems, validating controls against design documentation, specifications, architectures, client requirements, and applicable standards.
Perform technical verification through configuration review, evidence inspection, system observation, targeted testing, and stakeholder walkthroughs; assess control effectiveness and suitability for the operational environment.
Identify differences between documented design, configured implementation, and actual operating conditions; develop structured V&V procedures and maintain validation records and evidence.
Lead technical execution of engagements from planning through final reporting; review architecture, network diagrams, control narratives, security requirements, configurations, asset information, and other engineering artifacts.
Identify technical prerequisites and evidence needs; coordinate with clients, engineering teams, integrators, OEMs, and other responsible parties.
Track findings, outstanding evidence, dependencies, retesting, and remediation; escalate technical risks and blockers that may affect readiness or validation completion.
Produce technically rigorous commissioning records, validation reports, findings, and final deliverables; support effort estimation, resource planning, and scheduling.
Apply practical knowledge of PLCs, DCS, SCADA, BMS/BAS, SIS, industrial networks, field devices, engineering workstations, operator interfaces, historians, application servers, and supporting infrastructure.
Assess industrial network architectures, segmentation, zones and conduits, firewalls, remote access, communications paths, and security boundaries while avoiding unnecessary disruption to operational or safety-critical systems.
Validate cybersecurity controls including segmentation, firewall and access control, remote access, identity and privileged access, authentication, hardening, secure configuration, patch and vulnerability management, backup and recovery, logging and monitoring, endpoint security, time synchronization, change management, system and application security, physical and logical access, asset documentation, and recovery readiness.
Conduct onsite and remote validation against actual system configurations; coordinate testing to minimize impact to production, availability, safety, and functionality.
Recognize potential operational risks from cybersecurity testing and select appropriate validation approaches; support troubleshooting and root-cause analysis.
Distinguish verified, partially verified, failed, and untestable controls, including cases where prerequisites or evidence are unavailable.
Develop evidence-based technical findings and practical remediation actions; distinguish design, implementation, configuration, documentation, and operational-readiness issues.
Support remediation discussions, targeted retesting, evidence review, finding traceability, and escalation of residual risks.
Apply relevant cybersecurity standards and guidance, including ISA/IEC 62443, NIST SP 800-82, ISA84.00.09 v3 (2024), PLC Top 20 Secure Programming Practices, client requirements, regulatory and sector-specific requirements, and cyber-informed engineering principles.
Contribute to repeatable commissioning and V&V methodologies, procedures, checklists, templates, and technical guidance, promoting consistent evidence collection and reporting.
Use technical tools for cybersecurity V&V; support development of representative laboratory environments and test procedures, evaluate OT validation tools and approaches, and contribute lessons learned to internal guidance.
Provide technical guidance to consultants and engineers; review procedures, evidence, findings, and deliverables; mentor junior team members in industrial systems, commissioning, validation, and safe testing practices.
Promote engineering discipline, evidence-based validation, safety awareness, structured problem solving, and consistent documentation and reporting.
Travel to client sites as required, including domestic and international travel to offshore, remote, and industrial environments.