Joining ArupArup’s purpose, shared values, and collaborative approach has set us apart for over 80 years, guiding how we shape a better world.We are hiring a Cybersecurity Consultant (G4) to support a portfolio of major rail, transit, and critical infrastructure programs. This role is OT/ICS‑forward and will work across delivery and pursuits, helping teams assess cyber risk, translate requirements into pragmatic controls, and support implementation planning across operational environments.The opportunityOT/ICS cybersecurity deliverySupport cybersecurity assessments for Operational Technology (OT) environments (e.G., SCADA, PLC/DCS, wayside systems, tunnel systems, power/traction power, facilities/industrial controls, communications networks supporting operations).Contribute to OT security architecture and requirements baselining aligned to applicable standards (e.G., IEC 62443, ISO 27001, NIST guidance as applicable).Perform asset and data‑flow discovery support, basic threat modelling, and segmentation / zoning‑conduit analysis under senior guidance.Help develop security deliverables such as:Cybersecurity requirements registers / traceability matricesHigh‑level security architecture diagrams (IT/OT boundaries, zones, remote access)Risk registers and treatment plansSecurity validation approaches (e.G., FAT/SAT cyber considerations, supplier assurance)Policies/procedures (remote access, patching, removable media, logging/monitoring)Consulting‑style engagement supportParticipate in workshops and stakeholder interviews; capture decisionsand translate them into clear, client‑ready outputs.Contribute to presentations, memos, and reports with strong structure, visuals, and executive‑ready wording.Support proposals/pursuits: scope drafting, assumptions, fee build‑ups, and risk/mitigation inputs.Governance, assurance, and third‑party/supplier assuranceSupport vendor/security documentation reviews (OT supplier security posture, system integrator materials, design packages).Help translate contractual, design, and governance obligations into actionable cyber requirements for delivery teams.Assist with assurance planning and evidence collection approaches for audits/independent reviews.Collaboration & ways of workingWork closely with cyber leads, systems engineering, OT SMEs, IT teams, and physical security counterparts to ensure unified security outcomes.Maintain strong documentation hygiene: version control, traceability, and clear decision logs.At Arup, you belong to an extraordinary collective – in which we encourage individuality to thrive. Our strength comes from how we respect, share and connect our diverse experiences,



perspectives and ideas. You will have the opportunity to do socially useful work that has meaning – to Arup, to your career, to our members and to the clients and communities we serve.Is this role right for you?Required2‑5 years in cybersecurity, with demonstrated exposure to OT/ICS environments (rail/transit, utilities, manufacturing, energy, or similar critical infrastructure).Practical knowledge of OT concepts: SCADA/ICS components, Purdue model, segmentation, remote access, industrial protocols (high level), and operational constraints (availability, safety, maintainability).Experience producing structured cybersecurity deliverables (risk registers, requirements, assessments, architecture diagrams).Strong written and verbal communication; able to turn ambiguity into clear, professional outputs.Ability to operate in a multi‑project consulting environment (prioritisation, time management, stakeholder communication).Strong assetsFamiliarity with rail/tran‑it programs and system delivery lifecycle (requirements, design, implementation, testing/commissioning).Working knowledge of IEC 62443 (zones/conduits, foundational requirements), ISO 27001, NIST CSF/800‑82, and/or relevant Canadian frameworks.Exposure to OT‑relevant security practices (logging/monitoring patterns, secure remote access, vulnerability management constraints).Relevant certifications (one or more): GICSP, GRID, CISSP/SSCP, Security+, ISA/IEC 62443 training, Azure/AWS security fundamentals.What Success Looks Like (first 90–180 Days)Ramp up on major programmes and produce high‑quality deliverables with minimal rework.Build repeatable templates (requirements register, risk register, workshop notes, architecture visuals) to accelerate delivery.Demonstrate sound OT judgement: pragmatic, operations‑aware recommendations (not IT‑only thinking).Support at least one security workshop end‑to‑end (planning, facilitation support, outputs).What We Offer YouAt Arup, we care about each member’s success, so we grow together. Guided by our values, we provide an attractive total reward package that recognises the contribution of each member to our shared success. We offer a career in which all members can belong,



grow and thrive – through benefits that support health and wellbeing, learning opportunities and many possibilities to have an impact through the work they do.Benefits at Work – 100% paid by Arup except optional life insurance. Health and welfare security, paid time off for rest and renewal, Global Profit Share Plan (paid bi‑annually), optional GRRSP 5% company match to help you save for the future.Flexible Working – We believe versatile arrangements create a more inclusive way of working that supports our diversity and the wellbeing of our people. Options for alternative schedules and the ability to work outside the office are available.Toronto Hiring Range – The good faith base salary hiring range for this job in Toronto is 95,000 to 105,000 per year. Benefits are not included in the base salary. Hiring ranges for candidates performing work outside Toronto will differ.Different people, shared valuesArup is an equal‑opportunity employer that actively promotes and nurtures a diverse and inclusive workforce. We welcome applications from individuals of all backgrounds, including age, gender identity or expression, marital status, disability, neurotype or mental health, race or ethnicity, faith or belief, sexual orientation, socio‑economic background, and those who are pregnant or on family leave. We embrace diverse experiences, perspectives and ideas – this drives our excellence.Guided by our values and alignment with the UN Sustainable Development Goals, we create and contribute to equitable spaces and systems, while cultivating a sense of belonging for all. Our internal employee networks support our inclusive culture from race, ethnicity and cross‑cultural working to gender equity, and LGBTQ+ and disability inclusion. Discover more about life at Arup at www.Arup.Com/careers/your-life-at-arup.Our Application ProcessWe will review candidates on a rolling basis. Once you have applied, you will be evaluated and may be moved to the next round, at which point a member of the talent resourcing team will reach out to you directly.EEO StatementArup is an equal‑opportunity employer and will consider applications from all qualified individuals. Every job applicant will be treated equally, fairly and with respect regarding race, colour, ancestry, sex, gender identity or expression, sexual orientation, pregnancy, civil status, creed/religion, political convictions, language, ethnic or national origin, disability, pardoned record of offences, social condition (marital or family status, receipt of social assistance), and any other ground protected by the applicable human rights legislation.#J-18808-Ljbffr

📌 Cybersecurity Consultant - C$95,000 - C$105,000 A Year (Winnipeg)
🏢 Arup
📍 Winnipeg