OnSite Cybersecurity Custodian
Date: Apr 24, 2026
Location:
Ann Arbor, MI, US South Jordan, UT, US Orlando, FL, US Houston, TX, US Phoenix, AZ, US Dallas, TX, US Atlanta, GA, US Kansas City, MO, US Tampa, FL, US Jacksonville, FL, US Cary, NC, US Phoenix, AZ, US Austin, TX, US Tualatin, OR, US
Company: Black & Veatch Family of Companies
Together, we own our company, our future, and our shared success.
As an employee-owned company, our people are Black & Veatch. We put them at the center of everything we do and empower them to grow, explore new possibilities and use their diverse talents and perspectives to solve humanity's biggest challenges in an ever-evolving world. With over 100 years of innovation in sustainable infrastructure and our expertise in engineering, procurement, consulting and construction, together we are building a world of difference.
Company : Black & Veatch Corporation
Req Id : 114649
Opportunity Type : Staff
Relocation eligible : Yes
Full time/Part time : Full-Time
Project Only Hire : Yes
Visa Sponsorship Available: No
Why Black & Veatch?
Black & Veatch allows you to lend your talent and perspective to humanity's biggest challenges in a flexible environment where you are empowered to grow and explore new possibilities. We offer competitive compensation, 401k match and benefits that start day one.
Our hybrid environment allows you to balance your work and personal life. At Black & Veatch, you own your career with purpose and meaning. You are empowered to grow and explore new possibilities at every step of your career journey. Bring your big ideas knowing you are safe to be who you are and speak up with concerns or questions and put your diverse talents and perspectives to use.
The Opportunity
Black & Veatch (BV) is seeking a?direct-hire, full-timeon-siteCybersecurityCustodian?to support cybersecurity execution for a newPower Plant?project in?BeechIsland, South Carolina.Supported andledby BV Senior Cybersecurity Consultants, this individual will be the day-to-day on-sitecustodianfor?Operational Technology(OT)/ Industrial Control Systems (ICS)cybersecurity activities, coordinating with EPC, Owner,and vendors to ensure systems are secured, cybersecurityrequirements are met, and all work is documented in a complete, audit-ready evidence package.
This role is perfect for individuals experienced with power plant control systems (DCS/PLC/SCADA/HMI) who are enthusiastic about applying cybersecurity in practical construction and commissioning settings.
The role begins?no later than November 2026?to support readiness activities ahead of?Distributed Control System (DCS)Factory Acceptance Testing (FAT)in March 2027, includes?travel to vendor FAT/CyberFAT(CFAT)locations, andremainson-site through installation, commissioning, and turnover. After completion of the BeechIslandproject, the role is expected to continue as a?full-timeICS Cybersecurity Consultantposition?supporting B&V's?Infrastructure Advisory (IA)IndustrialCybersecurity team?acrossadditionalOT/ICS projects.Thepost-projectrole can be based at the BV office in Columbia,SCor any other BV office location.
Reporting & Teaming
Report operationally to the project leadershipteam,while working closely with B&V cybersecuritystakeholders.
Work closely with theIA ICSCybersecurityteamwhoprovides?back-office support?including:Project planning and cybersecurity execution roadmap,Standards, templates, and evidence packages,Requirements interpretation and technical guidanceandAction-item tracking support and cadence facilitation
Execute the on-site work, coordinate vendors, and ensure evidence is captured and organized.
Key Responsibilities
Cybersecurity Program Execution & Evidence Ownership
Supported and lead by BV Senior Cybersecurity Consultantsfrom Home Office, manageday-to-day execution of the on-site OT cybersecurityprogram, including tracking requirements, planned actions, and completion statusand report status of activities to BV Senior Cybersecurity Consultantsfor review and approvals
Build andmaintainan?organized evidence repository?(audit-ready), ensuring deliverables are properly dated, labeled, and attributable.
Maintain logs, checklists, procedures, forms, test results, scan outputs, approvals, andsign-offsasrequired.
CFAT / CyberSiteAcceptanceTesting (CSAT)Support
Support pre-CFAT readiness andparticipatein?vendor CFAT?activities asrequired(travelrequired).
Validate cybersecurity controls prior to shipment (where applicable), including accounts, logging, backups, malware controls, and baseline configurations.
Track and close cyber-related FAT punch items; ensure retests andfinal evidenceare captured and filed.
Identity, Credential, and Access Control
Verify and document required access controls including?MFA for remote access, least privilege, and role-based access models.
Support account management documentation: default credential changes, service account controls, privilege verification, termination/role-change access actions, and secure credential handover processes.
Asset Inventory, Configuration Baselines & Change Tracking
Maintain support for hardware/software inventory requirements (including OS/firmware versions, asset tags, locations, network references).
Track configuration baselines, redlines, and as-built updates throughout construction and commissioning.
Coordinatechangedocumentation andevidence, including post-change backup capture and validation.
Removable Media & Transient Cyber Assets (TCA) Controls
Enforce and document removable media and transient device controls in line with Owner policies and site procedures.
Oversee malware scanning workflows, authorization forms, encrypted media handling, quarantine steps, and scanning evidence retention.
Coordinate vendor site visit preparations (e.g., ensuring vendor laptop/TCA scanning expectations are met).
Monitoring, Logging, and Detection Enablement
Coordinate and document OT log onboarding to?Splunk/SIEM, including log sources, retention requirements, andforwardingarchitecture.
Support readiness for NIDS/span port configuration and eventforwardingrequirements.
Validate and document that logging is enabled, time-synchronized, and functioning withoutimpactingsystem performance.
Additional Key Responsibilities
Backup, Recovery, and Resilience
Verify backup procedures are in place for OTassetsand that backups are created after major changes (patching, configuration updates).
Support restorationtesting whererequired; ensure offline backup handling meets custody and storage requirements.
Track encrypted portable hard drives / backup media custody and handover documentation where applicable.
Incident Reporting & Response Support
Maintain cyber escalation contacts and on-site reporting procedures.
Support documentation of cybersecurityevents, policy violations, corrective actions, and evidence of remediation steps.
Coordinate with ICS Cybersecurity and Owner stakeholders for incident-related communications and records.
Training, Workforce Security & Compliance Documentation
Track andmaintainevidence for required cybersecurityawareness training completion.
Support workforce security evidence collection (e.g., authorization logs, background check logs, access revocations).
Conduct periodic verification that access authorizationsremaincurrent and justified.
A successful CybersecurityCustodian will:
Maintain a complete, well-organized cyber evidence repository that maps activities to requirements and stands up to Owner and compliance scrutiny.
Enable smooth FAT/CFAT/commissioning progress byidentifyingcybersecuritygaps early and driving closure without schedule disruption.
Demonstrate strong coordination across vendors, EPC, site teams, and theback-officecyberteam.
Establish consistent cyber processes on-site that improve repeatabil
