Lead Consultant, Oil & Gas Cybersecurity Assessment & Audit

Job Summary:

Bureau Veritas Cyber Physical Security is seeking an experienced Oil & Gas Cybersecurity Assessment & Audit Lead to support and grow our Assessment & Audit service pillar.

The role will primarily lead cybersecurity assessments and audits across Oil & Gas environments, including upstream, midstream, downstream, offshore, and associated industrial operations. The individual will bring a strong understanding of Oil & Gas operations, safety culture, operational technology (OT), industrial control systems (ICS), cybersecurity, and risk.

While Oil & Gas will be the primary sector focus, the Lead will operate as part of the broader Assessment & Audit service pillar and may support comparable engagements across critical infrastructure and industrial sectors, including energy, utilities, manufacturing, data centers, transportation, and other operationally or safety-critical environments.

This role sits at the intersection of operations, safety, OT/ICS cybersecurity, technical assurance, and governance, risk and compliance (GRC). It requires an individual who can translate cybersecurity and control requirements into practical assessment activities appropriate for live industrial environments.

The Lead will be responsible for planning and executing assessments, leading field activities, evaluating evidence, developing defensible findings, managing client interactions, and producing high-quality deliverables while maintaining a strong safety and operational-risk mindset.

Essential Duties and Responsibilities

Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.

Supervisory Responsibilities

No supervisory responsibilities

Skills

The requirements listed below are representative of acquired skills required.

• Operational Technology (OT) Cybersecurity:
• In-depth knowledge of OT systems, including DCS, PLC, SIS, SCADA, HMI, engineering workstations, and industrial networks.
• Understanding of OT cybersecurity standards and frameworks such as ISA/IEC 62443, NIST CSF, NIST SP 800-82, API 1164, and ISA84.00.09 v3.
• Experience with cybersecurity maturity, risk, compliance, gap, or control-effectiveness assessments.
• Industrial Control Systems (ICS):
• Hands-on experience with industrial control systems and automation environments.
• Familiarity with asset management, identity and access, network segmentation, remote access, system hardening, backup and recovery, change management, vulnerability management, logging and monitoring, and incident preparedness.
• Cybersecurity Risk Management:
• Ability to assess and evaluate cybersecurity risk in the context of asset criticality, safety, environmental impact, operational availability, reliability, and production requirements.
• Experience with governance, risk, and compliance (GRC) in cybersecurity.
• Industry-Specific Knowledge:
• Oil & Gas Operations:
• Comprehensive understanding of Oil & Gas operations, including upstream, midstream, downstream, offshore, and associated industrial operations.
• Knowledge of the operational constraints associated with production environments.
• Safety and Operational Assurance:
• Strong safety mindset and understanding of safe working practices in industrial facilities.
• Familiarity with process safety, functional safety, and operational reliability.
• Soft Skills:
• Communication:
• Strong written and verbal communication skills.
• Ability to develop professional technical reports, findings, recommendations, and executive summaries.
• Client Interaction:
• Act as a trusted advisor to Oil & Gas and critical infrastructure clients.
• Participate in client discussions, technical workshops, proposal development, scoping, and assessment planning.
• Team Leadership:
• Ability to lead and coordinate multidisciplinary teams involving cybersecurity specialists, auditors, control-system engineers, HSE personnel, operations personnel, and other subject matter experts.
• Mentor junior auditors, consultants, and technical specialists.

Competency

The requirements listed below are competencies required to perform the job successfully.

• Project Management:
• Develop assessment plans, evidence requirements, interview plans, fieldwork schedules, and assessment procedures based on the engagement scope.
• Manage assessment activities from kickoff through fieldwork, reporting, client review, and closeout.
• Adaptability:
• Ability to adapt technical assessment methods to the criticality, operating state, safety constraints, and risk profile of the systems being assessed.
• Capability to apply common OT/ICS cybersecurity assessment principles across different sectors while recognizing sector-specific differences.
• Professional Certifications:
• Relevant professional certifications such as CISSP, CISM, CISA, CRISC, GICSP, ISA/IEC 62443, or equivalent.
• Relevant Oil & Gas, control systems, functional safety, HSE, or offshore safety qualifications.
• These skills and competencies will enable the candidate to effectively perform the duties and responsibilities outlined

Education, Certifications, and Experience (required)

• 10+ years of professional experience within the Oil & Gas industry, with meaningful experience in operational, engineering, technical assurance, cybersecurity, controls, safety, or industrial environments.
• Demonstrated cybersecurity experience involving OT, ICS, industrial, or critical infrastructure environments.
• Strong understanding of Oil & Gas operations and the operational constraints associated with production environments.
• Working knowledge of industrial control and automation environments.
• Understanding industrial network and control system architectures.
• Strong safety mindset and understanding of the importance of safe working practices in operating industrial facilities.
• Ability to assess technical, procedural, and governance of cybersecurity controls.
• Ability to engage effectively with operational personnel, engineers, HSE teams, cybersecurity teams, IT teams, management, and executives.
• Experience developing professional technical reports, findings, recommendations, and executive summaries.
• Strong written and verbal communication skills.
• Ability and willingness to travel to client facilities, including offshore or remote locations where required.
• Preferred Qualifications
• Previous cybersecurity audit, assurance, inspection, risk assessment, or compliance assessment experience.
• Offshore Oil & Gas experience.
• Safety, HSE, process safety, or operational assurance experience.
• Control System engineering or automation experience.
• Hands-on experience with DCS, SIS, PLC, SCADA, industrial networks, or associated OT systems.
• OT cybersecurity architecture or engineering experience.
• Cybersecurity GRC experience within regulated or critical infrastructure environments.
• Experience with recognized OT/ICS cybersecurity standards and frameworks such as ISA/IEC 62443, NIST CSF, NIST SP 800-82, API 1164, ISA84.00.09 v3 (2024) or comparable requirements.
• Experience performing cybersecurity maturity, risk, compliance, gap, or control-effectiveness assessments.
• Experience working in another critical infrastructure sector in addition to Oil & Gas.
• Relevant professional certifications such as CISSP, CISM, CISA, CRISC, GICSP, ISA/IEC 62443, or equivalent.
• Relevant Oil & Gas, control systems, functional safety, HSE, or offshore safety qualifications.

Physical and Environmental Conditions

The physical demands and work environment characteristics described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Fieldwork:
• Conduct onsite assessments and audits in various industrial settings.
• Work in potentially hazardous environments, including oil rigs, refineries, and processing facilities.
• Physical Activity:
• Ability to walk, stand, and move around for extended periods.
• May require climbing stairs, ladders, or other elevated structures.
• Ability to lift and carry equipment and documentation (up to 25 pounds) as needed.
• Safety Requirements:
• Adhere to all safety protocols and procedures at client sites.
• Wear personal protective equipment (PPE) as required.

• Work Environment:

• Industrial Settings:
• Work in oil and gas facilities, which may include noisy, dusty, or otherwise challenging conditions.
• Exposure to extreme temperatures, both hot and cold.
• Office Environment:
• Balance between fieldwork and office-based activities.
• Use of computers, phones, and other standard office equipment.
• Client Interactions:
• Regular interaction with clients, which may include meetings, presentations, and discussions.
• Ability to work in a team environment with colleagues and subject matter experts.
• Remote Work:
• Potential for remote work, including virtual assessments and audits where feasible.
• Use of video conferencing and collaboration tools.

• Additional Considerations:

• Safety-First Mindset:
• Maintain a strong safety-first mindset for all field and assessment activities.
• Understand the relationship between cybersecurity, process safety, functional safety, operational reliability, and safety-critical systems.
• Adaptability:
• Ability to adapt to changing environments and conditions.
• Flexibility to work in various time zones and adjust to client schedules.

Note: This job description is intended to provide a general overview of the position. It is not an exhaustive list of duties, responsibilities, or skills required.

Travel Requirements

1. Travel:
   • Regular client-site travel, including offshore, remote, and industrial environments.
   • Ability to travel domestically and internationally as required.