Manager Operational Technology Cyber Security Jobs in Boston, MA

Job Summary:
WSP is one of the world's leading engineering and professional services firms, and they are seeking an Operational Technology (OT) Cybersecurity Engineer to join their Critical & Emerging Technology team. This role focuses on delivering OT cybersecurity engineering, assessments, and architecture support for transit and rail systems, while ensuring compliance with cybersecurity standards and enhancing safety and reliability for clients.
Responsibilities:
• Conduct OT cybersecurity risk assessments, threat modeling, and vulnerability evaluations aligned with IEC 62443, TS 50701, NIST 800‑82/53, and relevant transit/rail standards.
• Review supplier/OEM cybersecurity documentation such as SSPs, IRAs, DCRAs, zoning/conduit models, SBOM/HBOM, and patch management plans.
• Support secure OT system and network architecture development including segmentation, DMZ design, boundary protection, and access control strategies.
• Assist with OT asset inventory, system baselining, and network visibility activities to improve cybersecurity situational awareness.
• Develop and recommend mitigation strategies, corrective actions, and cybersecurity controls for identified risks and vulnerabilities.
• Support cybersecurity testing, commissioning, and configuration validation for OT systems, including controllers, network devices, and field hardware.
• Contribute to cybersecurity procurement documentation including scopes, requirements, and acceptance criteria.
• Support development of cybersecurity master plans, monitoring strategies, and operational security documentation.
• Participate in OT tabletop exercises and incident response activities in coordination with client teams.
• Work collaboratively with engineering, systems integration, operations, and safety teams across project life cycles.
• Provide clear technical documentation and contribute to stakeholder communication as required.
Qualifications:
Required:
• Bachelor’s degree in engineering, cybersecurity, computer science, or a related field.
• 7- 10+ years of OT cybersecurity experience, including 3+ years in transit, rail, or critical infrastructure environments.
• Hands‑on experience with rail/transit OT systems (CBTC, SCADA, PLCs, traction power, tunnel ventilation, fire/life safety, fleet charging, V2I/V2X, and related systems).
• Deep knowledge of relevant cybersecurity standards including IEC 62443, TS50701, IEC 63452, NIST 800‑82/53, ISO frameworks, UNECE, TS, and APTA guidelines.
• Demonstrated expertise in threat modeling, penetration testing, and OT network security; experience securing OTA, remote diagnostics, and air‑gapped environments.
• Familiarity with OT security tools and monitoring technologies (e.g., Nozomi, Claroty, Dragos, protocol analysis tools).
• Professional certifications such as CISSP, GICSP, ISA/IEC, and/or CompTIA Security+.
• Strong communication, stakeholder engagement, and technical writing skills for client-facing environments.
• Experience supporting cybersecurity-related compliance for U.S. transit regulatory bodies (FTA, FRA, TSA).
• Ability to work independently and collaboratively across disciplines, delivering cybersecurity solutions in complex operational environments.
• Understanding of OT logging, telemetry, and secure event collection requirements used to support monitoring, detection, and incident response.
Preferred:
• Master’s degree in systems engineering or cybersecurity.
• Demonstrated success in management consulting or advisory roles.
• Long-standing experience in the cybersecurity sector with a preference within the Transportation market.
• Successful candidates will be able to confidently speak, lead client-facing meetings, and attend prominent industry committees.
• Deep experience with rail communications networks related to OT threats and vulnerabilities. Specifically, system familiarity should include SCADA, PLCs, and industrial systems used in transit infrastructure.
• Specific examples and lessons learned from cybersecurity projects showcasing understanding of the latest frameworks and standards, threat detection and prevention best practices.
• Knowledge of secure development lifecycle and supply-chain cybersecurity practices (e.g., IEC 62443‑4‑1, firmware integrity, component assurance)
Company:
What if you could shape built and natural environments – and the future of those that use them? With us, you can. Founded in 1980, the company is headquartered in New York, USA, with a team of 10001+ employees. The company is currently Late Stage.