Master’s in Cybersecurity Engineering for Urban Infrastructure and ITS
Online master's programme of 1,900 hours in cybersecurity engineering for urban infrastructure and ITS, structured in 12 modules covering the regulatory framework, ITS and OT security, risk analysis, defensive architecture, detection, incident response, security testing, privacy and governance, with Directive (EU) 2022/2555 (NIS2), Royal Decree 311/2022 (ENS) and Wazuh, and an assigned technical tutor.
Master’s in Cybersecurity Engineering for Urban Infrastructure and ITS — studying from Australia
Australia's infrastructure pipeline is substantial, covering roads, rail, ports, water and urban development across major cities such as Sydney, Melbourne, Brisbane and Perth. Rail engineering is especially active, with projects including Sydney Metro and Melbourne Metro. Smart city initiatives draw on sensors, data platforms and digital twins to improve transport, utilities and public services. Employers include state transport authorities, engineering consultancies such as Aurecon and WSP, and major contractors. Engineers work on design, asset management, construction oversight and sustainability.
Fees for Australia: A$9,410 (AUD), with instalments and employer sponsorship available.
Relevant bodies in Australia
Typical roles
Questions from Australia
Does a SEIUM qualification meet Australian civil engineering registration requirements?
No. Civil engineers in Australia typically need an Engineers Australia accredited degree to pursue Chartered status, and state and territory rail and infrastructure regulators set their own requirements. SEIUM's private qualifications are not accredited by these bodies, so employers or regulators decide how much weight they carry.
Which Australian employers hire in civil, rail and smart cities?
Australia has public infrastructure agencies, rail operators, engineering consultancies and councils working on urban and smart city projects. Employers usually prioritise accredited qualifications, licensing and project experience. Ask potential employers whether a private online qualification would be considered alongside your experience.
Is the course workable alongside work, and what does it cost?
The courses are 100% online and taught in English, so you can study from anywhere in Australia without a student visa. Specialist courses take 300 hours, diplomas 800 and master's 1,900, so plan your time accordingly. Fees are payable in instalments, employer sponsorship may be possible, and you will have an assigned technical tutor.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Identify the cyber-physical threats and risks of the connected city.
Apply NIS2, the ENS and critical infrastructure regulations.
Protect ITS systems, SCADA and urban OT networks.
Analyse risk with MAGERIT, ISO/IEC 27005 and TARA.
Design defensive architectures and SOC monitoring.
Respond to incidents and ensure the continuity of services.
Govern municipal cybersecurity and privacy.
Who it's for
- Municipal information security officers.
- OT cybersecurity analysts.
- ITS systems security engineers.
- SOC analysts.
- Cybersecurity auditors.
- NIS2 and ENS compliance consultants.
- Engineering or science graduates aiming to work in local government.
What you'll work with
- Directive (EU) 2022/2555 (NIS2) (cybersecurity across the EU)
- Royal Decree 311/2022 (ENS) (Spanish National Security Framework)
- IEC 62443 (security for industrial automation and control systems)
- ISO/IEC 27001:2022 (information security management systems)
- ISO/IEC 27005:2022 (information security risk management)
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- Law 8/2011 (Spanish critical infrastructure protection)
- ISO 22301:2019 (business continuity management systems)
- Wazuh
- Wireshark
- PILAR
- Zeek
12 modules · 1900 h
1.1Attack surface of the connected city1.2Urban IT versus OT systems1.3Critical infrastructure and essential services1.4Historical attacks on municipal services1.5Threat actors and motivations1.6The NIST CSF 2.0 cybersecurity framework1.7Governance of municipal cybersecurity1.8Cyber-physical risk in the city1.9Security culture in public administrations1.10Case study: analysis of an attack on a water service
2.1The NIS2 Directive and its transposition2.2System categorisation under the ENS2.3Spain's Critical Infrastructure Protection (PIC) Law and critical operators2.4Directive (EU) 2022/2557 on resilience2.5Obligations under the Cyber Resilience Act2.6Data protection in urban systems2.7ITS Directive (EU) 2023/26612.8CCN-STIC guides for local authorities2.9European certification schemes2.10Workshop: regulatory compliance matrix for a city council
3.1Architecture of urban ITS systems3.2Urban traffic control centres3.3Traffic signal controllers and their security3.4Variable message signs3.5Cooperative C-ITS services3.6V2X communications and their protection3.7C-ITS public key infrastructure3.8Tolling and access control systems3.9Ticketing and transport operations support systems3.10Lab: traffic analysis of a signal controller
4.1The IEC 62443 series for control systems4.2The Purdue model and segmentation4.3Zones and conduits in urban environments4.4Security of urban SCADA systems4.5Protecting programmable logic controllers4.6Modbus, DNP3 and IEC 61850 protocols4.7Patch management in OT4.8Secure remote access to OT4.9Target security levels (SL)4.10Practical exercise: network segmentation of a wastewater treatment plant
5.1Risk analysis methodologies5.2The MAGERIT method and the PILAR tool5.3Risk management to ISO/IEC 270055.4TARA analysis of connected systems5.5Threat modelling with STRIDE5.6Cyber-physical attack scenarios5.7Impact on people's safety5.8Prioritisation of controls5.9Risk treatment plan5.10Case study: risk analysis of a traffic control centre
6.1Defence-in-depth strategy6.2Zero-trust architectures6.3Segmentation and micro-segmentation6.4Identity and access management6.5Encryption of urban communications6.6Protection of field devices6.7Immutable backups6.8System hardening6.9Supply chain security6.10Lab: hardening an IoT gateway
7.1Security operations centres (SOC)7.2Event correlation with SIEM7.3Intrusion detection in OT networks7.4Anomaly detection with machine learning7.5Threat intelligence7.6Log management and retention7.7Indicators of compromise7.8Proactive threat hunting7.9Detection and response metrics7.10Practical exercise: detection rules in Wazuh
8.1Incident response plan8.2Incident notification under NIS28.3Coordination with CCN-CERT and INCIBE-CERT8.4Forensic analysis in OT environments8.5Ransomware response in city councils8.6Continuity of essential services to ISO 223018.7Recovery and return to normal operations8.8Crisis simulation exercises8.9Public communication during incidents8.10Case study: ransomware in a transport service
9.1Technical security audits9.2Penetration testing in IT9.3Security testing in OT environments9.4Red team exercises9.5CVE vulnerability management9.6Responsible vulnerability disclosure9.7Legal and ethical framework for testing9.8Isolated test labs9.9Writing audit reports9.10Workshop: audit of an ITS test bench
10.1Urban video surveillance and its regulation10.2Facial recognition and the AI Act10.3Number plate recognition in low-emission zones10.4Data protection impact assessments10.5Anonymisation of video and data10.6AI-based video analytics10.7Data retention periods10.8Transparency and signage10.9Citizens' rights10.10Lab: DPIA for a traffic camera system
11.1ISO/IEC 27001 management system11.2The municipal security officer11.3Staff training and awareness11.4Management of technology suppliers11.5Security clauses in contracts11.6Budgeting and prioritisation of investments11.7Cybersecurity maturity metrics11.8ENS compliance audits11.9Continuous security improvement11.10Practical exercise: security master plan for a city council
12.1Selection of the urban infrastructure12.2Asset inventory and architecture12.3Threat and risk analysis12.4Secure architecture design12.5Detection and monitoring plan12.6Response and continuity plan12.7Applicable regulatory compliance12.8Secure implementation roadmap12.9Master's Thesis report12.10Master's Thesis: defence before a panel
How you'll learn
The programme is delivered 100% online on the SEIUM campus, with downloadable materials, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within each intake, so the programme fits around your job.
Each module combines theory, guided reading of the original standards and applied exercises. The working software is Wazuh, Wireshark, PILAR and Zeek, in free, academic or evaluation versions. Practical work is based on real procedures: risk analyses of real urban infrastructure, incident response exercises and security testing on OT and ITS test benches. Assessment is continuous, module by module, plus the final Master's Thesis.
Standards covered: Directive (EU) 2022/2555 (NIS2), Royal Decree 311/2022 (ENS), IEC 62443, ISO/IEC 27001:2022, ISO/IEC 27005:2022, Regulation (EU) 2024/2847, Law 8/2011, ISO 22301:2019.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Where this takes you
Requirements
- University degree in engineering, science or architecture, or equivalent demonstrable professional experience.
- Internet connection and a computer capable of running the programme's software.
- English sufficient to read technical standards.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 1,900 hours over 12–14 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.
You work with Wazuh, Wireshark, PILAR and Zeek, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.
A SEIUM Institute diploma, awarded on passing the continuous assessment and the Master's Thesis. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Ask about the recognition policy when you enrol.
A university degree in engineering, science or architecture (or equivalent professional experience), a computer able to run the software and English sufficient to read technical standards.
Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.
Related programmes
Master’s in Multimodal Rail-Port Logistics Engineering
Online master's programme of 1,900 hours in rail-port multimodal logistics engineering: 12 modules covering multimodal transport, ports and terminals, rail freight, intermodal terminals, port-rail integration, dry…
Master’s in Air Quality, Urban Noise and Environmental Health Engineering
Online master's programme of 1,900 hours in air quality, urban noise and environmental health engineering: 12 modules covering air pollution, air quality regulations, monitoring, dispersion modelling,…
Master’s in Unconventional Water Engineering
Online master's programme of 1,900 hours in unconventional water engineering, structured in 12 modules covering desalination, water reclamation and reuse, alternative sources, energy, plant design, operation…
More in Civil, Rail & Smart Cities
All Civil, Rail & Smart Cities programmes → · How to apply · Fees & financing · Scholarships