Water Utility Cyber-Physical Exercise Director — Metropolitan Water Services

The mandate

The utility has exercised ransomware recovery and water-quality incidents separately, yet operators have never faced a scenario where trusted telemetry, laboratory results and remote commands disagree. Existing playbooks assume SCADA is either available or unavailable, overlooking plausible manipulation that leaves screens functional while reservoir levels, pump state or chemical dosing values are false. The defined problem is to test how public-health and operational decisions work before any unsafe field action occurs.

The deliverables are a consequence-led scenario, protected simulation environment, controller and telemetry inject library, exercise-control plan, participant briefings, safety envelope, evidence pack, executive debrief and prioritised remediation portfolio. The design must include treatment operators, laboratories, field crews, security, public-health officials and communications. It must test manual sampling and local control realistically without changing live dosing setpoints or weakening production safeguards.

Three milestones govern the assignment: approved scenario, safety controls and success measures by 16 October 2026; witnessed full-day exercise plus hot debrief by 20 November; and accepted findings, retest demonstrations and funded remediation decisions by 18 December. The exercise will include manipulated reservoir telemetry, delayed laboratory confirmation, an unavailable remote site and conflicting public-message pressures, with pause criteria controlled by the water safety owner.

Acceptance requires operators to recognise unreliable process views, shift to authorised manual evidence, preserve safe treatment boundaries and make a defensible public-health escalation. Each critical finding must be reproduced or supported by exercise evidence, assigned to an executive owner and paired with a verification date. The client sponsor has five working days after each milestone to accept or issue one consolidated defect list; participant satisfaction is not an acceptance measure.

The client provides current water safety plans, process diagrams, alarm philosophy, representative SCADA logic, laboratory procedures, communications protocols, safe simulation facilities, named exercise participants and authorised controller access. It arranges public-health participation and declares all live-system boundaries before design. The director cannot inject production commands, change operational limits or simulate public notification outside the controlled communications plan.

Why this is external work

Internal teams know the treatment process but are too embedded in familiar displays, escalation routes and organisational assumptions to design an impartial test. A specialist exercise director can combine adversarial manipulation with water-safety discipline while protecting live operations. The work ends when evidence-backed findings and retests are accepted, not when a dramatic scenario has merely been played.

What you will own

• Translate treatment hazards into cyber injects affecting telemetry, alarms, remote commands, laboratory confidence and operator decision timing.
• Build a simulation boundary that reproduces operational behaviour without permitting unsafe changes to production treatment or distribution.
• Define exercise control, safety pauses, observer evidence, participant permissions and communications containment with the water safety owner.
• Direct operators through contradictory process views, manual sampling constraints, remote-site loss and escalating public-health uncertainty.
• Test coordination among control room, field maintenance, laboratory, security, leadership, public health and customer communications.
• Trace every material finding to observed behaviour, process evidence, accountable ownership, remediation action and objective retest.
• Deliver the executive debrief, sequenced investment portfolio, updated playbook decisions and witnessed closure of priority gaps.

Candidate qualifications

• Directed cyber-physical exercises for water, energy, chemicals, food processing or another safety-critical continuous operation.
• Can evidence a simulation where manipulated-but-plausible telemetry changed the expected operator or executive decision path.
• Understands treatment process safety, SCADA control, laboratory confirmation, alarm management and disciplined manual operation.
• Has designed realistic adversarial injects while maintaining permits, safety envelopes and stop authority around live facilities.
• Brought public-health, engineering, security and communications leaders into one evidence-based consequence and escalation model.
• Converts exercise observations into funded, retestable improvements rather than generic lessons or maturity recommendations.

Non-negotiables

• Will be onsite for Auckland design and exercise weeks and attend both external review sessions.
• Has personally controlled an exercise where a mistaken participant action could affect physical-process safety.
• Accepts immediate exercise stop authority held by the client’s water safety plan owner.
• Will not use live chemical-dosing commands or uncontrolled public communications as realism devices.

1. 49 words maximum. Which false process signal produced the hardest safe-operation decision in an exercise you directed?
2. 49 words maximum. How would you test manual water-quality assurance without creating risk to live treatment?
3. 49 words maximum. What observed behaviour merits a funded finding rather than another exercise lesson?