Lead Consultant - Cybersecurity Commissioning, Verification & Validation

A WORLD LEADER IN TESTING, INSPECTION & CERTIFICATION SERVICES

Bureau Veritas offers dynamic, exciting employment opportunities with an attractive salary/benefit package and an opportunity to play a vital role with a global organization. If you would enjoy working in a dynamic environment and are looking for an opportunity to become part of a stellar team of professionals, we invite you to apply online today.

Bureau Veritas is an Equal Opportunity Employer, and as such we recruit, hire, train, and promote persons in all job classifications without regard to race, color, religion, sex, national origin, disability, age, marital status, citizen status, sexual orientation, gender identity, genetics, status as a protected veteran, or any other non-job-related characteristics.

This position is responsible to ensure equal opportunity in employment in that all persons are treated equally and on the basis of merit, in decisions regarding selection, placement, promotions, training, work assignments, transfers and other personnel actions.

City: Remote State: Remote

Job Summary:

The Lead Consultant, Cybersecurity Commissioning, Verification & Validation is a senior technical delivery role responsible for executing and leading cybersecurity commissioning, verification, validation, and assurance activities across industrial and cyber-physical environments.

The role focuses primarily on delivery. The individual will lead technical assessments, develop and execute verification procedures, review engineering and cybersecurity evidence, perform field and remote validation activities, document findings, support remediation, and ensure cybersecurity requirements are implemented and operating as intended.

The Lead Consultant works directly with client engineering, operations, commissioning, construction, security, system integrators, OEMs, and other project stakeholders to integrate cybersecurity verification into the broader engineering and commissioning lifecycle.

The role requires a practical understanding of operational technology, industrial control systems, cybersecurity architecture, commissioning practices, and technical assurance. The individual must be capable of translating cybersecurity requirements and design intent into executable test procedures, objective evidence, technical findings, and actionable remediation.

Essential Duties and Responsibilities

Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.

Cybersecurity Commissioning Leadership

• Lead cybersecurity commissioning activities for new and existing industrial and cyber-physical environments.

• Translate cybersecurity requirements, specifications, standards, and design requirements into executable commissioning and verification procedures.

• Develop commissioning plans, verification checklists, test scripts, evidence requirements, and acceptance criteria.

• Coordinate cybersecurity commissioning activities with broader engineering, construction, integration, and operational readiness activities.

• Verify that cybersecurity requirements have been implemented as intended prior to operational acceptance.

• Identify incomplete, incorrectly implemented, or unverified cybersecurity requirements and document associated technical risks.

• Support retesting and closure of commissioning findings following remediation.

• Maintain clear traceability between cybersecurity requirements, verification activities, evidence, findings, remediation, and closure.

Verification & Validation

• Lead cybersecurity verification and validation activities across OT and cyber-physical systems.

• Validate implemented cybersecurity controls against design documentation, specifications, approved architectures, client requirements, and applicable standards.

• Perform technical verification through configuration review, evidence inspection, system observation, targeted testing, and stakeholder walkthroughs.

• Evaluate whether implemented controls are technically effective and appropriate for the operational environment.

• Identify differences between documented design, configured implementation, and actual operating conditions.

• Develop structured V&V test procedures with defined objectives, prerequisites, test steps, expected results, evidence requirements, and acceptance criteria.

• Maintain accurate validation records and supporting evidence throughout execution.

• Support regression or repeat validation following system changes and remediation activities.

Technical Delivery Leadership

• Lead the technical execution of cybersecurity commissioning and V&V engagements from planning through final reporting.

• Review system architecture, network diagrams, control narratives, security requirements, configuration documentation, asset information, and other engineering artifacts.

• Identify technical prerequisites and evidence required before commissioning and validation activities begin.

• Coordinate execution with client representatives, engineering teams, system integrators, OEMs, and other responsible parties.

• Track technical findings, outstanding evidence, dependencies, retesting requirements, and remediation status.

• Escalate technical risks and execution blockers that may affect cybersecurity readiness or completion of validation activities.

• Ensure technical findings are supported by objective evidence and clearly communicated.

• Produce technically rigorous commissioning records, validation reports, findings, and final deliverables.

• Support effort estimation, resource planning, and scheduling for assigned engagements.

Industrial Control Systems Expertise

• Apply practical knowledge of industrial and operational technology environments, including:

  • PLC-based control systems
  • Distributed Control Systems (DCS)
  • SCADA systems
  • Building Management and Building Automation Systems (BMS/BAS)
  • Safety Instrumented Systems (SIS)
  • Industrial networks
  • Field devices and intelligent electronic devices
  • Engineering workstations and operator interfaces
  • Historians, application servers, and supporting infrastructure

• Understand industrial network architectures, segmentation, zones and conduits, firewalls, remote access, communications paths, and security boundaries.

• Assess cybersecurity controls without unnecessarily disrupting operational or safety-critical systems.

• Understand the interaction between cybersecurity controls, system availability, engineering requirements, operational constraints, and functional safety.

Cybersecurity Control Validation

Lead and perform validation activities covering areas including:

• Network segmentation and security boundaries

• Firewall and access-control implementation

• Secure remote access

• Identity and access management

• Privileged access

• Authentication and authorization

• System and device hardening

• Secure configuration

• Unnecessary services and communications

• Patch and vulnerability management

• Backup and recovery

• Logging and monitoring

• Endpoint security

• Security monitoring integration

• Time synchronization

• Configuration and change management

• Engineering workstation security

• Application and server security

• Physical and logical access controls

• Asset inventory and system documentation

• Cybersecurity recovery readiness

Engineering & Field Validation

• Conduct on-site and remote validation activities within industrial and cyber-physical environments.

• Validate security controls against actual system configurations rather than relying solely on documentation or questionnaire responses.

• Review configurations and supporting artifacts necessary to demonstrate control implementation.

• Work safely within live, operational, pre-operational, and commissioning environments.

• Coordinate testing activities to minimize potential impact to production, availability, safety, or system functionality.

• Recognize when a cybersecurity test could introduce operational risk and establish an appropriate validation approach.

• Support troubleshooting and root-cause analysis when controls cannot be successfully validated.

• Clearly distinguish between verified controls, partially verified controls, failed validation, and controls that cannot be tested because prerequisites or evidence are unavailable.

Findings, Remediation & Closure

• Develop clear technical findings supported by objective evidence.

• Translate validation failures into practical remediation actions for engineering, integration, cybersecurity, and operations teams.

• Differentiate between design issues, implementation issues, configuration issues, documentation gaps, and operational readiness issues.

• Support technical discussions with responsible stakeholders to determine practical remediation approaches.

• Validate remediation through targeted retesting and evidence review.

• Maintain traceability of findings through remediation and closure.

• Identify residual risks that cannot be resolved through technical remediation and support appropriate escalation.

Standards & Methodology

• Apply relevant cybersecurity standards, practices and guidelines to commissioning and verification activities, including:

  • ISA/IEC 62443 (2-1, 3-3, 3-2, 4-2)
  • NIST SP 800-82
  • ISA84.00.09 v3 (2024)
  • PLC Top 20 Secure Programming Practices
  • Client cybersecurity requirements and engineering standards
  • Applicable regulatory and sector-specific requirements
  • Cyber-informed engineering principles

• Translate standards and cybersecurity requirements into practical, testable engineering controls.

• Contribute to development and improvement of repeatable commissioning and V&V methodologies, procedures, checklists, templates, and technical guidance.

• Support consistency in how evidence is collected, findings are documented, and controls are validated across engagements.

Tools, Lab & Technical Capability

• Use appropriate technical tools to support cybersecurity verification and validation activities.

• Support development of representative laboratory environments for validation of test procedures and methodologies.

• Test commissioning procedures in controlled environments before applying them to sensitive operational systems where appropriate.

• Help evaluate technical tools and approaches used for OT cybersecurity validation.

• Contribute lessons learned from engagements into reusable testing procedures and internal technical guidance.

Team Leadership & Mentorship

• Provide technical guidance to consultants and engineers supporting commissioning and V&V engagements.

• Review test procedures, evidence, findings, and technical deliverables prepared by other team members.

• Help junior team members understand industrial systems, commissioning methodology, validation techniques, and safe testing practices.

• Promote strong engineering discipline, evidence-based validation, safety awareness, and structured problem solving.

• Support consistent documntation and reporting practices across engagements.

Supervisory Responsibilities

No supervisory responsibilities

Skills

The requirements listed below are representative of acquired skills required.

Operational Technology (OT) and Industrial Control Systems (ICS):

• In-depth knowledge of PLC-based control systems, Distributed Control Systems (DCS), SCADA systems, Building Management Systems (BMS), Safety Instrumented Systems (SIS), industrial networks, and field devices.

• Understanding of industrial network architectures, segmentation, zones and conduits, firewalls, remote access, and security boundaries.

Cybersecurity Standards and Frameworks:

• Familiarity with ISA/IEC 62443, NIST SP 800-82, ISA84.00.09 v3 (2024), and PLC Top 20 Secure Programming Practices.

• Ability to translate standards and cybersecurity requirements into practical, testable engineering controls.

Cybersecurity Control Validation:

• Expertise in validating network segmentation, firewall and access-control implementation, secure remote access, identity and access management, system and device hardening, patch and vulnerability management, logging and monitoring, and endpoint security.

Verification & Validation (V&V) Methodologies:

• Ability to develop structured V&V test procedures with defined objectives, prerequisites, test steps, expected results, evidence requirements, and acceptance criteria.

• Experience in conducting on-site and remote validation activities within industrial and cyber-physical environments.

Tools and Lab Environments:

• Proficiency in using technical tools to support cybersecurity verification and validation activities.

• Experience in developing representative laboratory environments for validation of test procedures and methodologies.

Industry-Specific Knowledge:

• Industrial and Cyber-Physical Environments

• Practical experience working with industrial control systems and associated infrastructure.

• Experience in industrial or OT commissioning, Factory Acceptance Testing (FAT), Site Acceptance Testing (SAT), and systems integration.

Competency

The requirements listed below are competencies required to perform the job successfully.

Communication:

• Strong written and verbal communication skills to clearly document findings, develop remediation recommendations, and communicate technical information to non-technical stakeholders.

Team Leadership & Mentorship:

• Ability to provide technical guidance to consultants and engineers, review technical deliverables, and mentor junior team members.

• Promotion of strong engineering discipline, evidence-based validation, safety awareness, and structured problem-solving.

Problem-Solving:

• Strong troubleshooting and root-cause analysis skills to identify and address implementation gaps and technical issues.

Attention to Detail:

• Strong attention to technical detail to ensure accurate validation of cybersecurity controls and documentation of findings.

Safety-First Approach:

• Demonstrated commitment to safety when working with operational systems and in industrial environments.

Project Management:

• Ability to manage multiple technical workstreams and dependencies, and support effort estimation, resource planning, and scheduling for assigned engagements.

Education, Certifications, and Experience (required)

• 7+ years of relevant experience across operational technology, industrial automation, control systems engineering, industrial cybersecurity, commissioning, systems integration, systems or component validation, engineering assurance, or related cyber-physical environments.

• Practical experience working with industrial control systems and associated infrastructure.

• Experience executing technical testing, commissioning, verification, validation, assurance, or system acceptance activities.

• Experience working directly with technical teams in industrial, critical infrastructure, data center, manufacturing, utility, Oil & Gas, or comparable operational environments.

• Experience reviewing engineering documentation, architecture diagrams, system configurations, technical requirements, and implementation evidence.

• Experience documenting technical findings and developing practical remediation recommendations.

• Ability to develop structured test procedures and objectively determine whether requirements have been successfully implemented.

• Understanding of industrial cybersecurity architecture and security control implementation.

• Familiarity with relevant cybersecurity standards, practices and guidelines, including:

• ISA/IEC 62443 (2-1, 3-3, 3-2, 4-2)

• NIST SP 800-82

• ISA84.00.09 v3 (2024)

• PLC Top 20 Secure Programming Practices

• Cyber-informed engineering principles

• Understanding of how cybersecurity activities interact with engineering, construction, integration, commissioning, operations, and system lifecycle processes.

• Ability to travel to client sites as required for commissioning and validation activities.

• Preferred Experience

• Experience in one or more of the following is beneficial:

• Industrial or OT commissioning

• Cybersecurity commissioning

• Factory Acceptance Testing (FAT)

• Site Acceptance Testing (SAT)

• Integrated Systems Testing

• Systems integration

• Systems Validation

• Control system engineering

• OT network engineering

• Security architecture

• Technical cybersecurity assessments

• OT penetration testing or security validation

• Control-system retrofit or modernization projects

• Greenfield industrial or infrastructure projects

• Brownfield operational environments

• Certifications are not required but may be beneficial:

• ISA/IEC 62443 certifications

• GIAC industrial cybersecurity certifications (GICSP)

• CISSP

• Industrial automation or control-sy