Cyber Security Analyst

Location: Pittsburgh, PA, United States; Hybrid

Our North America Water Utilities Cybersecurity team helps communities safeguard one of their most critical assets: water. We support utilities in understanding their overall cybersecurity posture, developing risk management plans, identifying practical improvements, and/or reconceptualizing overall cybersecurity strategy to support complete re-design across the business IT, operational technology (OT), industrial control system (ICS), and Access Control / CCTV networks.

Our approach emphasizes risk-based assessments, policy and governance improvements, and program development, while integrating findings from trusted third-party technical testing providers (e.g., penetration testing, vulnerability scans, and application assessments). Coupled with our extensive experience in design, build and operation of water treatment and conveyance facilities, we help water utilities build a complete picture of their cyber risk exposure and maturity, and guide them toward sustainable improvements.

This mid-level opportunity is intended for an experienced cybersecurity, OT/ICS, SCADA, or controls professional who can contribute independently to client engagements, perform and document cybersecurity assessments, develop practical recommendations, and support implementation of cybersecurity improvements across water and wastewater environments.

Stantec is at the forefront of the water industry, delivering thousands of projects for hundreds of communities globally. Our purpose is to conceive and develop the most impactful water projects that improve the health, quality of life and sustainability of the communities we live in and serve.

You will be part of a collaborative, client-facing team that values sound technical judgment, adaptability, and continuous improvement. This role is expected to take ownership of defined workstreams, interact directly with utility stakeholders, and clearly communicate cybersecurity and OT/ICS concepts to a range of audiences—from operators and engineers to executive leadership.

• Perform and support cybersecurity risk assessments, program reviews, and governance-focused security evaluations for water utility clients. Independently execute defined portions of engagements and contribute technical judgment to project findings and recommendations. This may include:
• Collection, review, and field verification of record documents, network diagrams, asset inventories, and system configurations
• Detailed field documentation of undocumented IT/OT/ICS installations, including lifecycle, maintenance, and obsolescence considerations
• Capture, analysis, and summary of network monitoring, vulnerability scanning, and other technical assessment results
• Technical research and evaluation of cybersecurity technologies, architectures, standards, and control approaches
• Develop assessment findings, remediation recommendations, technical memoranda, and client-ready reports
• Develop, review, and harmonize cybersecurity policies, standards, procedures, incident response plans, and strategies.
• Manage assigned tasks, budgets, schedules, deliverables, and coordination activities; contribute to overall project management as needed
• Evaluate and incorporate findings from third-party penetration testing, vulnerability scanning, and other technical service providers into comprehensive client risk profiles and remediation plans.
• Participate actively in client workshops, interviews, field investigations, design reviews, and presentations; facilitate defined portions of client meetings when appropriate.
• Maintain current technical and industry knowledge and take ownership of continued professional development, including:
• Maintenance and pursuit of relevant cybersecurity, networking, OT/ICS, and vendor certifications
• Continued development of practical skills with network monitoring, vulnerability assessment, system scanning, analysis, and penetration-testing tools
• Active engagement in key manufacturer, water-sector, OT/ICS cybersecurity, and industry-sponsored user groups

About the Organization