Lead Consultant - Cybersecurity Commissioning, Verification & Validation

City: Remote State: Remote Job Summary: The Lead Consultant, Cybersecurity Commissioning, Verification & Validation is a senior technical delivery role responsible for executing and leading cybersecurity commissioning, verification, validation, and assurance activities across industrial and cyber-physical environments. The role focuses primarily on delivery. The individual will lead technical assessments, develop and execute verification procedures, review engineering and cybersecurity evidence, perform field and remote validation activities, document findings, support remediation, and ensure cybersecurity requirements are implemented and operating as intended. The Lead Consultant works directly with client engineering, operations, commissioning, construction, security, system integrators, OEMs, and other project stakeholders to integrate cybersecurity verification into the broader engineering and commissioning lifecycle. The role requires a practical understanding of operational technology, industrial control systems, cybersecurity architecture, commissioning practices, and technical assurance. The individual must be capable of translating cybersecurity requirements and design intent into executable test procedures, objective evidence, technical findings, and actionable remediation. Essential Duties and Responsibilities Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions. Cybersecurity Commissioning Leadership - Lead cybersecurity commissioning activities for new and existing industrial and cyber-physical environments. - Translate cybersecurity requirements, specifications, standards, and design requirements into executable commissioning and verification procedures. - Develop commissioning plans, verification checklists, test scripts, evidence requirements, and acceptance criteria. - Coordinate cybersecurity commissioning activities with broader engineering, construction, integration, and operational readiness activities. - Verify that cybersecurity requirements have been implemented as intended prior to operational acceptance. - Identify incomplete, incorrectly implemented, or unverified cybersecurity requirements and document associated technical risks. - Support retesting and closure of commissioning findings following remediation. - Maintain clear traceability between cybersecurity requirements, verification activities, evidence, findings, remediation, and closure. Verification & Validation - Lead cybersecurity verification and validation activities across OT and cyber-physical systems. - Validate implemented cybersecurity controls against design documentation, specifications, approved architectures, client requirements, and applicable standards. - Perform technical verification through configuration review, evidence inspection, system observation, targeted testing, and stakeholder walkthroughs. - Evaluate whether implemented controls are technically effective and appropriate for the operational environment. - Identify differences between documented design, configured implementation, and actual operating conditions. - Develop structured V&V test procedures with defined objectives, prerequisites, test steps, expected results, evidence requirements, and acceptance criteria. - Maintain accurate validation records and supporting evidence throughout execution. - Support regression or repeat validation following system changes and remediation activities. Technical Delivery Leadership - Lead the technical execution of cybersecurity commissioning and V&V engagements from planning through final reporting. - Review system architecture, network diagrams, control narratives, security requirements, configuration documentation, asset information, and other engineering artifacts. - Identify technical prerequisites and evidence required before commissioning and validation activities begin. - Coordinate execution with client representatives, engineering teams, system integrators, OEMs, and other responsible parties. - Track technical findings, outstanding evidence, dependencies, retesting requirements, and remediation status. - Escalate technical risks and execution blockers that may affect cybersecurity readiness or completion of validation activities. - Ensure technical findings are supported by objective evidence and clearly communicated. - Produce technically rigorous commissioning records, validation reports, findings, and final deliverables. - Support effort estimation, resource planning, and scheduling for assigned engagements. Industrial Control Systems Expertise - Apply practical knowledge of industrial and operational technology environments, including: - PLC-based control systems - Distributed Control Systems (DCS) - SCADA systems - Building Management and Building Automation Systems (BMS/BAS) - Safety Instrumented Systems (SIS) - Industrial networks - Field devices and intelligent electronic devices - Engineering workstations and operator interfaces - Historians, application servers, and supporting infrastructure - Understand industrial network architectures, segmentation, zones and conduits, firewalls, remote access, communications paths, and security boundaries. - Assess cybersecurity controls without unnecessarily disrupting operational or safety-critical systems. - Understand the interaction between cybersecurity controls, system availability, engineering requirements, operational constraints, and functional safety. Cybersecurity Control Validation Lead and perform validation activities covering areas including: - Network segmentation and security boundaries - Firewall and access-control implementation - Secure remote access - Identity and access management - Privileged access - Authentication and authorization - System and device hardening - Secure configuration - Unnecessary services and communications - Patch and vulnerability management - Backup and recovery - Logging and monitoring - Endpoint security - Security monitoring integration - Time synchronization - Configuration and change management - Engineering workstation security - Application and server security - Physical and logical access controls - Asset inventory and system documentation - Cybersecurity recovery readiness Engineering & Field Validation - Conduct on-site and remote validation activities within industrial and cyber-physical environments. - Validate security controls against actual system configurations rather than relying solely on documentation or questionnaire responses. - Review configurations and supporting artifacts necessary to demonstrate control implementation. - Work safely within live, operational, pre-operational, and commissioning environments. - Coordinate testing activities to minimize potential impact to production, availability, safety, or system functionality. - Recognize when a cybersecurity test could introduce operational risk and establish an appropriate validation approach. - Support troubleshooting and root-cause analysis when controls cannot be successfully validated. - Clearly distinguish between verified controls, partially verified controls, failed validation, and controls that cannot be tested because prerequisites or evidence are unavailable. Findings, Remediation & Closure - Develop clear technical findings supported by objective evidence. - Translate validation failures into practical remediation actions for engineering, integration, cybersecurity, and operations teams. - Differentiate between design issues, implementation issues, configuration issues, documentation gaps, and operational readiness issues. - Support technical discussions with responsible stakeholders to determine practical remediation approaches. - Validate remediation through targeted retesting and evidence review. - Maintain traceability of findings through remediation and closure. - Identify residual risks that cannot be resolved through technical remediation and support appropriate escalation. Standards & Methodology - Apply relevant cybersecurity standards, practices and guidelines to commissioning and verification activities, including: - ISA/IEC 62443 (2-1, 3-3, 3-2, 4-2) - NIST SP 800-82 - ISA84.00.09 v3 (2024) - PLC Top 20 Secure Programming Practices - Client cybersecurity requirements and engineering standards - Applicable regulatory and sector-specific requirements - Cyber-informed engineering principles - Translate standards and cybersecurity requirements into practical, testable engineering controls. - Contribute to development and improvement of repeatable commissioning and V&V methodologies, procedures, checklists, templates, and technical guidance. - Support consistency in how evidence is collected, findings are documented, and controls are validated across engagements. Tools, Lab & Technical Capability - Use appropriate technical tools to support cybersecurity verification and validation activities. - Support development of representative laboratory environments for validation of test procedures and methodologies. - Test commissioning procedures in controlled environments before applying them to sensitive operational systems where appropriate. - Help evaluate technical tools and approaches used for OT cybersecurity validation. - Contribute lessons learned from engagements into reusable testing procedures and internal technical guidance. Team Leadership & Mentorship - Provide technical guidance to consultants and engineers supporting commissioning and V&V engagements. - Review test procedures, evidence, findings, and technical deliverables prepared by other team members. - Help junior team members understand industrial systems, commissioning methodology, validation techniques, and safe testing practices. - Promote strong engineering discipline, evidence-based validation, safety awareness, and structured problem solving. - Support consistent documntation and reporting practices across engagements. Supervisory Responsibilities No supervisory responsibilities Skills The requirements listed below are representative of acquired skills required. Operational Technology (OT) and Industrial Control Systems (ICS): - In-depth knowledge of PLC-based control systems, Distributed Control Systems (DCS), SCADA systems, Building Management Systems (BMS), Safety Instrumented Systems (SIS), industrial networks, and field devices. - Understanding of industrial network architectures, segmentation, zones and conduits, firewalls, remote access, and security boundaries. Cybersecurity Standards and Frameworks: - Familiarity with ISA/IEC 62443, NIST SP 800-82, ISA84.00.09 v3 (2024), and PLC Top 20 Secure Programming Practices. - Ability to translate standards and cybersecurity requirements into practical, testable engineering controls. Cybersecurity Control Validation: - Expertise in validating network segmentation, firewall and access-control implementation, secure remote access, identity and access management, system and device hardening, patch and vulnerability management, logging and monitoring, and endpoint security. Verification & Validation (V&V) Methodologies: - Ability to develop structured V&V test procedures with defined objectives, prerequisites, test steps, expected results, evidence requirements, and acceptance criteria. - Experience in conducting on-site and remote validation activities within industrial and cyber-physical environments. Tools and Lab Environments: - Proficiency in using technical tools to support cybersecurity verification and validation activities. - Experience in developing representative laboratory environments for validation of test procedures and methodologies. Industry-Specific Knowledge: - Industrial and Cyber-Physical Environments - Practical experience working with industrial control systems and associated infrastructure. - Experience in industrial or OT commissioning, Factory Acceptance Testing (FAT), Site Acceptance Testing (SAT), and systems integration. Competency The requirements listed below are competencies required to perform the job successfully. Communication: - Strong written and verbal communication skill