Critical Systems Manager - Smart Building Automation

CBRE is the world’s largest full-servicecommercial real estate and investment organization offering a broad range of integrated services, including; facilities, transaction and project management, property management, investment management, appraisal and valuation, property leasing, strategic consulting, property sales, mortgage services and development services. CBRE, Global Workplace Solutions is a division of CBRE that focuses on the design and implementation for workplace technologies across North American office portfolios. Through our Consulting, Design, and Project Management services, we bridge the gap between Real Estate & IT departments to deliver product-agnosticsolutions as the “Single Point of Contact” for all workplace scopes. We specialize in helping clients think strategically about technology utilization and implementation within their workplace. SmartBuilding and Operational Technology (OT) Manager will own facilities related technology delivery and readiness for all client stakeholders. Client site/s will have converged networks and isolated remote networks containing all OT systems. Representative systems include, but not limited to, Building Management Systems (BMS), Lighting Control systems, Energy Management Systems, IAQ sensors, Rest Room Management Systems, Occupancy Detection, Occupant Call systems, Room Scheduling Systems and other IoT devices. The role will ensure technology enhances the occupant experiences, influences cost savings / avoidance energysavings, and increases system reliability. The role will supervise the operational technology Managed Services Provider (MSP) and it’s delivery to their assigned Service Level Agreement metrics. The MSP performs the hands-on network and server work; you influence and define what excellence looks like, approve it before it happens and verify it afterward. This role will also act as administrator of the smart building data platform and as a site subject matter expert on building data and analytics, driving the operation toward data-led decisions on maintenance, energy and capital spend. In-depth platform training will support the right candidate’s transition into the role. What You'll Do Strategy and Governance Member of team which owns smart building and OT strategy, roadmap and standards for the client site/s, leveraging best in class experience written so they scale to further sites in the portfolio. Own change management for OT network. Hold the permit to work (PTW) approval gate and review every method of procedure (MOP) before approval, including pre-deployment backup verification and a documented rollback plan. Comply with break-fix policies within the clients change management processes for immediate corrections and elevate as required to ensure cyber security compliance with critical vulnerability and Exposures (CVE). Own lifecycle planning and access control policy for OT assets, and feed technology needs into the capital plan. OT Systems Management Own the network architecture standard for the site/s, Cisco Catalyst are the primary networking tools to include a Catalyst appliance running Identity Security Engine for endpoint security, Catalyst core switches with failover, WAN aggregation for vendor ISP circuits, Catalyst Power over Ethernet (PoE) Access switches with Palo Alto Firewalls, and Catalyst Industrial Core Switches for remote sites. Own the application virtualization platform standard on Microsoft Hyper-V: redundant Dell Hypervisors running in fail over capacity across physically separated OT closets, supporting multiple vendor and OT systems. Hold master asset inventory: every connected device with firmware version, owner, network location, warranty status and support contract. Keep documentation current and version-controlled: topology drawings, IP schedules, virtual local area network (VLAN) and access control list (ACL) records, point lists and integration interfaces. Review MSP updates rather than accepting them. Own uptime and resilience against agreed service levels. Lead escalation on OT incidents, and accept or reject the MSP root cause analysis on the evidence. Monitor critical systems during emergency response, and categorize events by operational impacts so the site team can prioritize its response. Data Platform, Integration and Administration Act as system administrator for the smart building data platform. Configure end-users, assign accounts, roles and access levels, and review them based on least privileged access on a set cycle. Support and troubleshoot day-to-day platform issues and anomalies, and initiate corrective action with site teams or third-party vendors. Identify gaps in platform configuration and capability, and act as the liaison between end-users and vendors to specify and introduce new functionality. Lead integration efforts with stakeholder OT systems and enterprise applications, including the computerized maintenance management system (CMMS), workplace systems and reporting tools. Work with the SaaS platform vendor to ensure adherence to the common data model in the SaaS platform for analytic purposes. Enable standards-based integration: BACnet/IP, Modbus/IP & Modbus RTU, MQTT and REST APIs. Work with account leadership and business intelligence teams to define reporting and key performance indicator requirements, and identify the additional data sources needed to support agreed metrics. Cybersecurity and Compliance Own ISE policy onsite. Ensure unknown endpoints are routed to an isolated VLAN with no communication path to other devices and RCA for devices are documented. Maintain the known endpoint register and monitor the demilitarized zone (DMZ) for unknown assets. Own the OT asset visibility platform, such as Armis, for continuous asset discovery, vulnerability monitoring and threat detection. Triage findings, set remediation priorities and track closure with the OT Network MSP. Approve and audit the patching plan. Hold the MSP to patch service levels by common vulnerabilities and exposures (CVE) severity, and confirm sandbox testing happened before anything reached production. Ensure deployments of patches and upgrades are completed in client development environments, where provided, prior to implementation in production environments. Enforce system hygiene with the MSP: antivirus scanning of all media and secure file transfer before anything connects to the OT network. Control vendor access with named, time-bound accounts and session logging, and no shared credentials. Own the disaster recovery plan and the backup regime. Testing with the MSP for by dry tests and live testing to be documented annually. Verify switch and hypervisor backups land as scheduled, run the semi-annual failover dry run and the annual full failover with redundancy testing, and document what failed. Run regular risk assessments and vulnerability reviews, and keep audit evidence current: access reviews, patch records, backup restore tests and change logs. Maintain compliance with IEC 62443 and adhere for ISO 27001 standards for OT security, and with corporate information security standards where the site falls in scope. Building Performance, Energy and Sustainability Use the site metering and controls data to reduce energy use, carbon emissions and operating cost. Run fault detection and diagnostics program and inform the operators for improvements. Tune the rules, review alerts daily, and route confirmed faults into the CMMS as work orders with a named owner and a close-out date. Work with site engineers, technicians and facility managers to triage incoming issues, and verify that remediation holds rather than closing on the first fix, identify issues for improvement. Drive the site teams from schedule-driven to condition-driven maintenance, using platform data to set preventive maintenance intervals and to build the capital plan. Implement and monitor optimization strategies: scheduling, setpoint tuning, demand response and equipment sequencing. Produce a monthly list of energy and maintenance actions ranked by value, each with expected savings and payback. Identify and build the business case for improvement projects: return on investment calculations, budget submissions, and measurement and verification of delivered savings against an agreed baseline. Support certification and sustainability reporting (LEED, ENERGY STAR, WELL) with data and analysis from building systems. Benchmark performance and run a continuous improvement program against it. Occupant Experience And Workplace Enablement Use IAQ, occupancy, restroom management and occupant call data to improve comfort, cleaning response and space performance with the client stakeholder. Support smart workplace capability where deployed: booking, wayfinding and environmental comfort control. Work with workplace and real estate teams on utilization and experience decisions grounded in occupant sensor building data. Collect occupant and stakeholder feedback and use it to prioritize the roadmap. MSP Governance, Vendors and Projects Act as the single point of contact for the OT MSP across all contracted service components: reactive support, hardware procurement, ad-hoc support, scheduled maintenance and patching, and proactive assessment and planning. Measure and enforce the contracted service levels, typical are a a four-hour on-site response and eight-hour resolution for system-down events with graded targets below that. Log every breach and run the remedy conversation. Review and approve MSP deliverables: monthly site visit reports, switch and hypervisor backups, quarterly health assessments, and bi-annual capital expenditure recommendation memos with rough order of magnitude estimates. Challenge recommendations that lack evidence. Verify the contracted on-site presence delivers the proactive scope: physical and logical health checks, capacity trending, vulnerability report review, switch configuration and DMZ maintenance, and topology updates. Control ad-hoc time and materials spend against the master rate card. Approve scope before work starts and check invoices against the L1, L2 and L3 rates by hour band. Govern hardware procurement: validate pass-through pricing, confirm the markup matches contract, and check that manufacturer warranties register in the Owner’s name. Manage original equipment manufacturers, system integrators and technology providers, and define technical requirements and scopes of work for new projects and retrofits. Review controls and network specifications against the site standard, witness commissioning, and decline handover of any system that does not comply. Evaluate new technology through proofs of concept. Scale what works, stop what does not, and say why. Contribute to MSP service reviews and re-tender with performance data rather than impressions. Additional Responsibilities Facilitate site technology, project and vendor meetings effectively, and keep minutes and actions. Hold regular status meetings with the MSP and the site team, communicating relevant information. Resolve orescalate issues in a timely fashion. Ensure project and system documents are complete, current, and stored appropriately. Suggest areas for improvement in internal processes along with possible solutions. Comply with and help to enforce standard policies and procedures. Experience What You'll Need and Ideal Candidate Profile: Bachelor's degree in engineering (mechanical, electrical, controls or building services), computer science or a related field, or equivalent site experience. 10 or more years in building systems, OT, building automation or a related field, including atleast two years leading people or a technical workstream. Demonstrated experience with BMS and building controls (Schneider, Siemens, JohnsonControls, Lynxspring, Honeywell or equivalent). Experience in building systems design, commissioning, retro-commissioning, optimization and analysis. Experience using time-series data to identify performance deficiencies and anomalies, determine root cause, and verify that remediation worked. Experience administering a software platform, including user roles and access management. Experience integrating OT systems with enterprise applications inside a segmented client managed network. Experience managing a service provider against service levels, including formal change control through MOP and PTW processes. Track record delivering complex technical projects and managing vendors. Preferred Master's degree in engineering, smart buildings or a related field. CCNA or CCNP; GICSP or IEC 62443 for OT security; Palo Alto or equivalent firewall credential; a controls platform certification (Tridium Niagara, KNX, Siemens, Schneider or Johnson Controls); Certified Energy Manager; LEED AP; PMP. Windows Server and Hyper-V administration experience. Experience with an OT asset visibility or network detection and response platform such as Armis. Experienced deploying, tuning and operationalizing fault detection and diagnostics software in occupied buildings. Experience with utility metering design, installation, integration and maintenance across electrical, gas and water. Experienced deploying or upgrading building automation and direct digital control systems. Experience in commercial or corporate real estate, facility operations or property management. Skills Strong grounding in building systems: HVAC, lighting, security, metering and life safety. Knowledge of OT protocols: BACnet, Modbus, SNMP, and MQTT. Hands-on knowledge of enterprise switching in an OT context: VLANs, ACLs, segmentation, routing fundamentals and firewall policy, Working IT networking knowledge: TCP/IP, DNS, DHCP and firewall administration. Understanding of OT security practice: segmentation, identity-based access control, patch management and incident response. Experience with data platforms and business intelligence tools. Ability to read and interpret control drawings, schematics, one-line diagrams and building plans. Strong empirical analysis: processes and understands unfamiliar data quickly when troubleshooting. Produces client-ready reports, materials and visualizations. Communicates clearly with audiences from technicians to senior leadership, and adjusts to each. Learns a new software platform quickly and to a working depth. Works autonomously and delivers results without close supervision. Persistent: keeps working a problem until the system works properly, including when the obstacle is organizational rather than technical. Explain technical risk to people who do not work in technology, and holds a position when challenged by a project team or a vendor. Manages contracts and vendors on evidence, and makes decisions from data. Manages pressure, critical response, vendors and supporting personnel with professionalism. Key Performance Indicators Energy use per square foot, year-over-year reduction against target. Unplanned downtime of critical building systems. OT security incidents, and mean time to remediate confirmed #J-18808-Ljbffr CBRE