A WORLD LEADER IN TESTING, INSPECTION & CERTIFICATION SERVICES

Bureau Veritas offers dynamic, exciting employment opportunities with an attractive salary/benefit package and an opportunity to play a vital role with a global organization. If you would enjoy working in a dynamic environment and are looking for an opportunity to become part of a stellar team of professionals, we invite you to apply online today.

Bureau Veritas is an Equal Opportunity Employer, and as such we recruit, hire, train, and promote persons in all job classifications without regard to race, color, religion, sex, national origin, disability, age, marital status, citizen status, sexual orientation, gender identity, genetics, status as a protected veteran, or any other non-job-related characteristics.

This position is responsible to ensure equal opportunity in employment in that all persons are treated equally and on the basis of merit, in decisions regarding selection, placement, promotions, training, work assignments, transfers and other personnel actions.

City: Remote

State: Remote

Job Summary:

Bureau Veritas Cyber Physical Security is seeking an experienced Oil & Gas Cybersecurity Assessment & Audit Lead to support and grow our Assessment & Audit service pillar.

The role will primarily lead cybersecurity assessments and audits across Oil & Gas environments, including upstream, midstream, downstream, offshore, and associated industrial operations. The individual will bring a strong understanding of Oil & Gas operations, safety culture, operational technology (OT), industrial control systems (ICS), cybersecurity, and risk.

While Oil & Gas will be the primary sector focus, the Lead will operate as part of the broader Assessment & Audit service pillar and may support comparable engagements across critical infrastructure and industrial sectors, including energy, utilities, manufacturing, data centers, transportation, and other operationally or safety-critical environments.

This role sits at the intersection of operations, safety, OT/ICS cybersecurity, technical assurance, and governance, risk and compliance (GRC). It requires an individual who can translate cybersecurity and control requirements into practical assessment activities appropriate for live industrial environments.

The Lead will be responsible for planning and executing assessments, leading field activities, evaluating evidence, developing defensible findings, managing client interactions, and producing high-quality deliverables while maintaining a strong safety and operational-risk mindset.

Essential Duties and Responsibilities

Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.

Oil & Gas Cybersecurity Assessments & Audits

• Lead cybersecurity assessments and audits across Oil & Gas facilities, including offshore assets, production environments, pipelines, processing facilities, terminals, and supporting infrastructure.

• Plan and execute onsite and remote assessment activities including document review, stakeholder interviews, technical walkthroughs, control verification, and evidence collection.

• Evaluate the implementation and effectiveness of cybersecurity controls within operational environments.

• Assess cybersecurity risk in the context of asset criticality, safety, environmental impact, operational availability, reliability, and production requirements.

• Develop clear, evidence-based findings, observations, recommendations, and executive-level reporting.

• Lead client kickoff meetings, field activities, daily readouts, debriefs, and final report discussions.

OT / ICS and Control Systems

• Assess cybersecurity controls associated with OT and industrial control environments, including DCS, PLC, SIS, SCADA, HMI, engineering workstations, historians, industrial networks, and supporting infrastructure.

• Understand the relationships between process control, safety systems, enterprise infrastructure, remote access, vendors, third-party connectivity, and supporting networks.

• Evaluate technical and procedural controls associated with asset management, identity and access, network segmentation, remote access, system hardening, backup and recovery, change management, vulnerability management, logging and monitoring, and incident preparedness.

• Understand the operational and safety implications of interacting with live industrial control environments.

• Adapt technical assessment methods to the criticality, operating state, safety constraints, and risk profile of the systems being assessed.

Safety and Operational Assurance

• Maintain a strong safety-first mindset for all field and assessment activities.

• Understand the relationship between cybersecurity, process safety, functional safety, operational reliability, and safety-critical systems.

• Work effectively within client HSE requirements, site-access requirements, permit-to-work processes, and offshore or industrial operating procedures.

• Recognize when cybersecurity assessment or testing activities could introduce operational or safety risk and adapt the assessment approach accordingly.

• Engage effectively with Operations, HSE, Engineering, Maintenance, Automation/Controls, IT, OT, and cybersecurity stakeholders.

Cybersecurity Risk, Governance and Compliance

• Lead cybersecurity maturity, risk, gap, control-effectiveness, and compliance assessments.

• Assess client environments against recognized cybersecurity standards, frameworks, regulatory requirements, and client-specific policies and control frameworks.

• Translate policies and control requirements into practical technical and operational verification activities.

• Evaluate both design and implementation of controls, using appropriate documentation, interviews, technical evidence, and field observations.

• Develop defensible findings supported by objective evidence and clearly articulate associated operational and cybersecurity risk.

• Support development and review of cybersecurity policies, standards, procedures, risk registers, remediation plans, and control frameworks, where included within engagement scope.

Cross-Sector Critical Infrastructure Assessments

While Oil & Gas will be the Lead's primary sector responsibility, the individual will also:

• Support OT cybersecurity assessments and audits across other critical infrastructure and industrial environments, such as energy, utilities, manufacturing, data centers, transportation, and other cyber-physical environments.

• Apply common OT/ICS cybersecurity assessment principles across sectors while recognizing differences in operating processes, technologies, safety requirements, regulatory obligations, and business risk.

• Work alongside sector-specific subject matter experts where specialized operational knowledge is required.

• Transfer relevant lessons learned, methodologies, and assessment practices between industrial sectors without applying a one-size-fits-all approach.

• Contribute to building a scalable, cross-sector Assessment & Audit methodology while maintaining sector-specific assessment requirements.

Delivery Leadership

• Serve as the technical and delivery lead for assigned cybersecurity assessment and audit engagements.

• Develop assessment plans, evidence requirements, interview plans, fieldwork schedules, and assessment procedures based on the engagement scope.

• Coordinate multidisciplinary teams involving cybersecurity specialists, auditors, control-system engineers, HSE personnel, operations personnel, and other subject matter experts.

• Manage assessment activities from kickoff through fieldwork, reporting, client review, and closeout.

• Review assessment evidence and ensure findings are technically sound, clearly supported, and appropriate for the environment being assessed.

• Perform technical and quality reviews of reports before client delivery.

• Mentor junior auditors, consultants, and technical specialists.

• Help develop repeatable methodologies, checklists, evidence requirements, templates, and field procedures for the Assessment & Audit practice.

Client and Practice Development

• Act as a trusted advisor to Oil & Gas and critical infrastructure clients.

• Participate in client discussions, technical workshops, proposal development, scoping, and assessment planning.

• Help determine appropriate assessment approaches based on client objectives, asset characteristics, operational constraints, and risk.

• Identify opportunities for broader services based on client needs while maintaining appropriate boundaries between independent assessment and other services.

• Contribute Oil & Gas and operational cybersecurity expertise to the continued development of Bureau Veritas' cyber-physical assurance capabilities.

• Support development of new assessment offerings and methodologies that can scale across multiple critical infrastructure sectors.

Supervisory Responsibilities

No supervisory responsibilities

Skills

The requirements listed below are representative of acquired skills required.

• Operational Technology (OT) Cybersecurity:

  • In-depth knowledge of OT systems, including DCS, PLC, SIS, SCADA, HMI, engineering workstations, and industrial networks.
  • Understanding of OT cybersecurity standards and frameworks such as ISA/IEC 62443, NIST CSF, NIST SP 800-82, API 1164, and ISA84.00.09 v3.
  • Experience with cybersecurity maturity, risk, compliance, gap, or control-effectiveness assessments.

• Industrial Control Systems (ICS):

  • Hands-on experience with industrial control systems and automation environments.
  • Familiarity with asset management, identity and access, network segmentation, remote access, system hardening, backup and recovery, change management, vulnerability management, logging and monitoring, and incident preparedness.

• Cybersecurity Risk Management:

  • Ability to assess and evaluate cybersecurity risk in the context of asset criticality, safety, environmental impact, operational availability, reliability, and production requirements.
  • Experience with governance, risk, and compliance (GRC) in cybersecurity.

• Industry-Specific Knowledge:

  • Oil & Gas Operations:
    • Comprehensive understanding of Oil & Gas operations, including upstream, midstream, downstream, offshore, and associated industrial operations.
    • Knowledge of the operational constraints associated with production environments.
  • Safety and Operational Assurance:
    • Strong safety mindset and understanding of safe working practices in industrial facilities.
    • Familiarity with process safety, functional safety, and operational reliability.

• Soft Skills:

  • Communication:
    • Strong written and verbal communication skills.
    • Ability to develop professional technical reports, findings, recommendations, and executive summaries.
  • Client Interaction:
    • Act as a trusted advisor to Oil & Gas and critical infrastructure clients.
    • Participate in client discussions, technical workshops, proposal development, scoping, and assessment planning.
  • Team Leadership:
    • Ability to lead and coordinate multidisciplinary teams involving cybersecurity specialists, auditors, control-system engineers, HSE personnel, operations personnel, and other subject matter experts.
    • Mentor junior auditors, consultants, and technical specialists.

Competency

The requirements listed below are competencies required to perform the job successfully.

• Project Management:

  • Develop assessment plans, evidence requirements, interview plans, fieldwork schedules, and assessment procedures based on the engagement scope.
  • Manage assessment activities from kickoff through fieldwork, reporting, client review, and closeout.

• Adaptability:

  • Ability to adapt technical assessment methods to the criticality, operating state, safety constraints, and risk profile of the systems being assessed.
  • Capability to apply common OT/ICS cybersecurity assessment principles across different sectors while recognizing sector-specific differences.

• Professional Certifications:

  • Relevant professional certifications such as CISSP, CISM, CISA, CRISC, GICSP, ISA/IEC 62443, or equivalent.
  • Relevant Oil & Gas, control systems, functional safety, HSE, or offshore safety qualifications.
  • These skills and competencies will enable the candidate to effectively perform the duties and responsibilities outlined

Education, Certifications, and Experience (required)

• 10+ years of professional experience within the Oil & Gas industry, with meaningful experience in operational, engineering, technical assurance, cybersecurity, controls, safety, or industrial environments.

• Demonstrated cybersecurity experience involving OT, ICS, industrial, or critical infrastructure environments.

• Strong understanding of Oil & Gas operations and the operational constraints associated with production environments.

• Working knowledge of industrial control and automation environments.

• Understanding industrial network and control system architectures.

• Strong safety mindset and understanding of the importance of safe working practices in operating industrial facilities.

• Ability to assess technical, procedural, and governance of cybersecurity controls.

• Ability to engage effectively with operational personnel, engineers, HSE teams, cybersecurity teams, IT teams, management, and executives.

• Experience developing professional technical reports, findings, recommendations, and executive summaries.

• Strong written and verbal communication skills.

• Ability and willingness to travel to client facilities, including offshore or remote locations where required.

• Preferred Qualifications

• Previous cybersecurity audit, assurance, inspection, risk assessment, or compliance assessment experience.

• Offshore Oil & Gas experience.

• Safety, HSE, process safety, or operational assurance experience.

• Control System engineering or automation experience.

• Hands-on experience with DCS, SIS, PLC, SCADA, industrial networks, or associated OT systems.

• OT cybersecurity architecture or engineering experience.

• Cybersecurity GRC experience within regulated or critical infrastructure environments.

• Experience with recognized OT/ICS cybersecurity standards and frameworks such as ISA/IEC 62443, NIST CSF, NIST SP 800-82, API 1164, ISA84.00.09 v3 (2024) or comparable requirements.

• Experience performing cybersecurity maturity, risk, compliance, gap, or control-effectiveness assessments.

• Experience working in another critical infrastructure sector in addition to Oil & Gas.

• Relevant professional certifications such as CISSP, CISM, CISA, CRISC, GICSP, ISA/IEC 62443, or equivalent.

• Relevant Oil & Gas, control systems, functional safety, HSE, or offshore safety qualifications.

Physical and Environmental Conditions

The physical demands and work environment characteristics described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Fieldwork:

  • Conduct onsite assessments and audits in various industrial settings.
  • Work in potentially hazardous environments, including oil rigs, refineries, and processing facilities.

• Physical Activity:

  • Ability to walk, stand, and move around for extended periods.
  • May require climbing stairs, ladders, or other elevated structures.
  • Ability to lift and carry equipment and documentation (up to 25 pounds) as needed.

• Safety Requirements:

  • Adhere to all safety protocols and procedures at client sites.
  • Wear personal protective equipment (PPE) as required.

• Work Environment:

  • Industrial Settings:
    • Work in oil and gas facilities, which may include noisy, dusty, or otherwise challenging conditions.
    • Exposure to extreme temperatures, both hot and cold.
  • Office Environment:
    • Balance between fieldwork and office-based activities.
    • Use of computers, phones, and other standard office equipment.
  • Client Interactions:
    • Regular interaction with clients, which may include meetings, presentations, and discussions.
    • Ability to work in a team environment with colleagues and subject matter experts.
  • Remote Work:
    • Potential for remote work, including virtual assessments and audits where feasible.
    • Use of video conferencing and collaboration tools.

• Additional Considerations:

  • Safety-First Mindset:
    • Maintain a strong safety-first mindset for all field and assessment activities.
    • Understand the relationship between cybersecurity, process safety, functional safety, operational reliability, and safety-critical systems.
  • Adaptability:
    • Ability to adapt to changing environments and conditions.
    • Flexibility to work in various time zones and adjust to client schedules.

Note: This job description is intended to provide a general overview of the position. It is not an exhaustive list of duties, responsibilities, or skills required.

Travel Requirements

1. Travel:
   • Regular client-site travel, including offshore, remote, and industrial environments.
   • Ability to travel domestically and internationally as required.

This job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required. Duties, responsibilities and activities may change, or new ones may be assigned at any time with or without notice.

If you are an individual with a disability and you would like us to assist you with searching the Careers Page site for employment opportunities and/or assistance with completing your profile and application, please contact us at 1-888-357-7020 or email us with your request to NorthAmericaTA@bureauveritas.com.

We are happy to assist you and encourage you to consider Bureau Veritas for your next great career opportunity!

If you would like additional information regarding Bureau Veritas' federal obligations in regards to equal employment opportunity, please click the link below:

https://www.dol.gov/agencies/ofccp/posters