Operational Technology Cybersecurity Consultant

Transit Safety & Security Solutions

About The Position

Transit Safety & Security Solutions, Inc. seeks one or more independent contractor Operational Technology Cybersecurity Consultants to provide cybersecurity consulting, assessment, risk management, and technical advisory services for operational technology (OT), enterprise control systems (ECS), and associated IT environments. Engagements are as-needed and project-based. The consultant will help identify, assess, and mitigate cybersecurity risks affecting critical operational systems and infrastructure while supporting operational availability, safety, and reliability. Work may involve communications infrastructure, SCADA systems, and other critical infrastructure. Depending on project assignments, services may include OT/ICS cybersecurity assessments; architecture and design reviews; security controls and risk-management advice; policy, procedure, governance, and compliance support; incident preparedness and response support; and training and awareness. The consultant will collaborate with engineering, IT, cybersecurity, safety, operations, project management, client stakeholders, vendors, contractors, and other relevant teams. The contractor reports to the Project Manager or a Company Designee. Project priorities, milestones, meeting cadence, acceptance criteria, and communication protocols will be defined in the applicable contract or statement of services. This is an independent contractor engagement, not an offer of employment. Engagement terms, including compensation and deliverables, will be specified in a written agreement. The selected contractor may be subject to background checks, identity verification, and project-specific screening. The contractor must follow applicable confidentiality, information-security, acceptable-use, access-control, data-protection, and facility-security requirements. Additional customer, facility, export-control, or security-clearance requirements may apply to certain projects.

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Computer or Electrical Engineering, Systems Engineering, or a related technical discipline.
Approximately 5 or more years of cybersecurity experience, preferably including direct OT/ICS experience.
Knowledge of OT/ICS architectures and protocols.
Knowledge of network security and segmentation.
Knowledge of vulnerability and risk assessment.
Knowledge of firewalls and secure remote access.
Knowledge of cybersecurity incident response.
Knowledge of cybersecurity frameworks applicable to transit critical infrastructure.
Comply with applicable confidentiality, information-security, acceptable-use, access-control, data-protection, and facility-security requirements.
Complete background checks, identity verification, and other project-appropriate screening if required.

Nice To Haves

Experience in public transportation, rail, utilities, energy, manufacturing, industrial automation, or other critical-infrastructure environments.
Certifications such as CISSP, GICSP, Security+, CISA, CISM, GIAC certifications, ISA/IEC 62443 certifications, or equivalent cybersecurity/OT credentials.
Experience with SCADA, PLC, DCS, HMI, historian, and engineering workstation technologies.
Experience with industrial protocols such as Modbus, DNP3, OPC, EtherNet/IP, PROFINET, and other environment-specific protocols.
Experience with OT asset-discovery, network-monitoring, intrusion-detection, SIEM, and endpoint-security platforms.
Experience with firewalls, data diodes, jump hosts, privileged-access management, multifactor authentication, VPNs, and other secure remote-access technologies.
Experience with packet-capture, network-analysis, vulnerability-management, configuration-assessment, and incident-response tools.
Experience with governance, risk, compliance, ticketing, documentation, and reporting platforms.

Responsibilities

Conduct cybersecurity risk assessments of OT, ICS, SCADA, networks, and associated IT/OT environments.
Identify cybersecurity vulnerabilities, threats, control deficiencies, and operational risks, and recommend mitigation strategies.
Conduct or support cybersecurity gap, maturity, and vulnerability assessments and security-control reviews.
Support implementation and assessment of applicable cybersecurity frameworks and standards, including NIST CSF, NIST SP 800-82, NIST SP 800-53, and ISA/IEC 62443.
Develop risk registers, prioritized remediation plans, and recommendations suited to client OT environments and operational constraints.
Prepare cybersecurity assessment reports, technical memoranda, risk analyses, findings, recommendations, and executive presentations.
Support cybersecurity requirements throughout system development and project lifecycles.
Coordinate with system engineers, IT and operations personnel, vendors, contractors, and client cybersecurity teams.
Perform OT cybersecurity architecture and design reviews for existing systems and new projects.
Review OT network architecture, zoning, conduits, segmentation, remote access, authentication, asset management, monitoring, logging, patch management, vulnerability management, and incident-response capabilities.
Recommend and advise on hardening OT assets and supporting infrastructure, including secure baselines and operationally appropriate patching strategies.
Assist with OT/ICS asset inventories, system categorization, risk registers, and remediation plans.
Provide guidance on secure remote access and vendor connectivity, identity and access management for OT operators and engineers, and OT-event monitoring and logging integration with SOC/SIEM systems.
Review system designs, specifications, network diagrams, cybersecurity documentation, vendor submissions, and technical requirements.
Collaborate with and evaluate third-party and supply-chain cybersecurity risks associated with OT systems, vendors, and equipment.
Assist clients in developing and implementing cybersecurity programs, policies, standards, procedures, and technical controls.
Develop cybersecurity requirements for procurements, contracts, system implementations, upgrades, and capital projects.
Advise on applicable cybersecurity and privacy laws, regulations, and contractual or insurance-driven cybersecurity obligations.
Support client meetings, workshops, technical reviews, audits, and cybersecurity compliance activities.
Assist clients in developing OT incident-response and recovery procedures and participate in tabletop exercises when required.
Track identified vulnerabilities and cybersecurity risks through remediation and closure.
Maintain awareness of emerging OT cybersecurity threats, vulnerabilities, attack techniques, technologies, regulatory requirements, and industry best practices.
Develop OT incident-response playbooks and incident-severity classifications.
Provide incident-containment consulting, including triage, attack-vector identification, recommendations for immediate containment or mitigation within operational and safety constraints, and coordination with client teams and third-party responders.
Develop and deliver remote training content for OT engineers, maintenance personnel, control-room operators, management, and executive stakeholders.
Perform additional cybersecurity consulting duties as assigned based on project and client requirements.