Cyber Security Consultant – Critical Infrastructure

About the role

Arup is seeking a Cyber Security Consultant to protect digital systems, infrastructure and data across the built environment. You will work on essential sectors such as transport, utilities, energy and communications, helping to safeguard critical services for communities.

Key responsibilities

• Conduct cyber security risk assessments to identify vulnerabilities, threats and mitigation strategies for built‑environment projects.
• Develop and implement security strategies, policies and assurance frameworks aligned with industry standards and regulatory obligations.
• Review, design and strengthen security architecture, supporting penetration testing, vulnerability assessments and remediation activities.
• Evaluate business continuity, disaster recovery and resilience measures to ensure effective incident response.
• Provide guidance to project teams and clients on best practices, emerging threats and compliance requirements.

Required profile

• Relevant tertiary qualification in Computer Science, Information Security or Operational Technology.
• Minimum 5 years of experience in cyber security, preferably within critical infrastructure or built‑environment projects.
• Knowledge of regulations and standards such as NIST Cybersecurity Framework, ISO 27001 and IEC 62443.
• Familiarity with industrial control systems (ICS) and operational technology environments.
• Relevant certifications (CISSP, CISM, CCSP, IEC 62443) are preferred.

Required skills

• NIST Cybersecurity Framework
• ISO 27001
• IEC 62443
• Risk assessment methodology
• Vulnerability assessment
• Penetration testing
• Industrial Control Systems (ICS) security practices
• CISSP, CISM, CCSP certifications

What we offer

• Competitive, fair and equitable remuneration.
• Opportunities to work on socially useful projects with global impact.
• Supportive, diverse and collaborative work environment.