Master’s in Cybersecurity Engineering for Urban Infrastructure and ITS
Online master's programme of 1,900 hours in cybersecurity engineering for urban infrastructure and ITS, structured in 12 modules covering the regulatory framework, ITS and OT security, risk analysis, defensive architecture, detection, incident response, security testing, privacy and governance, with Directive (EU) 2022/2555 (NIS2), Royal Decree 311/2022 (ENS) and Wazuh, and an assigned technical tutor.
Master’s in Cybersecurity Engineering for Urban Infrastructure and ITS — studying from New Zealand
Civil engineering is one of New Zealand's largest engineering employers, driven by the need for earthquake-resilient infrastructure, roading, water and wastewater systems across a seismically active country. Major projects include Auckland's City Rail Link and Wellington's transport upgrades, with rail maintained largely by KiwiRail. Engineers work for consultancies, contractors and councils, and the Ministry of Business, Innovation and Employment administers the Building Act and related standards, while Waka Kotahi manages the national land transport network.
Fees for New Zealand: NZ$11,700 (New Zealand dollar), with instalments and employer sponsorship available.
Relevant bodies in New Zealand
Typical roles
Questions from New Zealand
What is the recognition pathway for civil and rail engineers in New Zealand?
Engineering New Zealand administers Chartered Professional Engineer registration, which is the main recognised professional standard for civil engineers. Rail is regulated through the New Zealand Transport Agency Waka Kotahi and the Ministry of Transport. SEIUM's qualifications are private and not accredited by a national body, so employers or the relevant body decide how much weight to give them.
Who hires civil, rail and smart city engineers in New Zealand?
Employers include city and regional councils, central government agencies, consultancies, contractors, and rail and transport operators. Smart city roles increasingly combine infrastructure knowledge with data and digital systems. Hiring usually depends on registration, experience and project records, so a private qualification is a supporting credential rather than a guaranteed entry point.
Will I need a visa, and how do fees and employer funding work?
No student visa is needed to study from home, because all programmes are 100% online and taught in English. Each programme includes an assigned technical tutor and a final project. Fees are payable in instalments, and employer sponsorship is possible. Master's programmes take 1,900 hours, postgraduate diplomas 800 and specialist courses 300, so check the time commitment against your workload.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Identify the cyber-physical threats and risks of the connected city.
Apply NIS2, the ENS and critical infrastructure regulations.
Protect ITS systems, SCADA and urban OT networks.
Analyse risk with MAGERIT, ISO/IEC 27005 and TARA.
Design defensive architectures and SOC monitoring.
Respond to incidents and ensure the continuity of services.
Govern municipal cybersecurity and privacy.
Who it's for
- Municipal information security officers.
- OT cybersecurity analysts.
- ITS systems security engineers.
- SOC analysts.
- Cybersecurity auditors.
- NIS2 and ENS compliance consultants.
- Engineering or science graduates aiming to work in local government.
What you'll work with
- Directive (EU) 2022/2555 (NIS2) (cybersecurity across the EU)
- Royal Decree 311/2022 (ENS) (Spanish National Security Framework)
- IEC 62443 (security for industrial automation and control systems)
- ISO/IEC 27001:2022 (information security management systems)
- ISO/IEC 27005:2022 (information security risk management)
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- Law 8/2011 (Spanish critical infrastructure protection)
- ISO 22301:2019 (business continuity management systems)
- Wazuh
- Wireshark
- PILAR
- Zeek
12 modules · 1900 h
1.1Attack surface of the connected city1.2Urban IT versus OT systems1.3Critical infrastructure and essential services1.4Historical attacks on municipal services1.5Threat actors and motivations1.6The NIST CSF 2.0 cybersecurity framework1.7Governance of municipal cybersecurity1.8Cyber-physical risk in the city1.9Security culture in public administrations1.10Case study: analysis of an attack on a water service
2.1The NIS2 Directive and its transposition2.2System categorisation under the ENS2.3Spain's Critical Infrastructure Protection (PIC) Law and critical operators2.4Directive (EU) 2022/2557 on resilience2.5Obligations under the Cyber Resilience Act2.6Data protection in urban systems2.7ITS Directive (EU) 2023/26612.8CCN-STIC guides for local authorities2.9European certification schemes2.10Workshop: regulatory compliance matrix for a city council
3.1Architecture of urban ITS systems3.2Urban traffic control centres3.3Traffic signal controllers and their security3.4Variable message signs3.5Cooperative C-ITS services3.6V2X communications and their protection3.7C-ITS public key infrastructure3.8Tolling and access control systems3.9Ticketing and transport operations support systems3.10Lab: traffic analysis of a signal controller
4.1The IEC 62443 series for control systems4.2The Purdue model and segmentation4.3Zones and conduits in urban environments4.4Security of urban SCADA systems4.5Protecting programmable logic controllers4.6Modbus, DNP3 and IEC 61850 protocols4.7Patch management in OT4.8Secure remote access to OT4.9Target security levels (SL)4.10Practical exercise: network segmentation of a wastewater treatment plant
5.1Risk analysis methodologies5.2The MAGERIT method and the PILAR tool5.3Risk management to ISO/IEC 270055.4TARA analysis of connected systems5.5Threat modelling with STRIDE5.6Cyber-physical attack scenarios5.7Impact on people's safety5.8Prioritisation of controls5.9Risk treatment plan5.10Case study: risk analysis of a traffic control centre
6.1Defence-in-depth strategy6.2Zero-trust architectures6.3Segmentation and micro-segmentation6.4Identity and access management6.5Encryption of urban communications6.6Protection of field devices6.7Immutable backups6.8System hardening6.9Supply chain security6.10Lab: hardening an IoT gateway
7.1Security operations centres (SOC)7.2Event correlation with SIEM7.3Intrusion detection in OT networks7.4Anomaly detection with machine learning7.5Threat intelligence7.6Log management and retention7.7Indicators of compromise7.8Proactive threat hunting7.9Detection and response metrics7.10Practical exercise: detection rules in Wazuh
8.1Incident response plan8.2Incident notification under NIS28.3Coordination with CCN-CERT and INCIBE-CERT8.4Forensic analysis in OT environments8.5Ransomware response in city councils8.6Continuity of essential services to ISO 223018.7Recovery and return to normal operations8.8Crisis simulation exercises8.9Public communication during incidents8.10Case study: ransomware in a transport service
9.1Technical security audits9.2Penetration testing in IT9.3Security testing in OT environments9.4Red team exercises9.5CVE vulnerability management9.6Responsible vulnerability disclosure9.7Legal and ethical framework for testing9.8Isolated test labs9.9Writing audit reports9.10Workshop: audit of an ITS test bench
10.1Urban video surveillance and its regulation10.2Facial recognition and the AI Act10.3Number plate recognition in low-emission zones10.4Data protection impact assessments10.5Anonymisation of video and data10.6AI-based video analytics10.7Data retention periods10.8Transparency and signage10.9Citizens' rights10.10Lab: DPIA for a traffic camera system
11.1ISO/IEC 27001 management system11.2The municipal security officer11.3Staff training and awareness11.4Management of technology suppliers11.5Security clauses in contracts11.6Budgeting and prioritisation of investments11.7Cybersecurity maturity metrics11.8ENS compliance audits11.9Continuous security improvement11.10Practical exercise: security master plan for a city council
12.1Selection of the urban infrastructure12.2Asset inventory and architecture12.3Threat and risk analysis12.4Secure architecture design12.5Detection and monitoring plan12.6Response and continuity plan12.7Applicable regulatory compliance12.8Secure implementation roadmap12.9Master's Thesis report12.10Master's Thesis: defence before a panel
How you'll learn
The programme is delivered 100% online on the SEIUM campus, with downloadable materials, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within each intake, so the programme fits around your job.
Each module combines theory, guided reading of the original standards and applied exercises. The working software is Wazuh, Wireshark, PILAR and Zeek, in free, academic or evaluation versions. Practical work is based on real procedures: risk analyses of real urban infrastructure, incident response exercises and security testing on OT and ITS test benches. Assessment is continuous, module by module, plus the final Master's Thesis.
Standards covered: Directive (EU) 2022/2555 (NIS2), Royal Decree 311/2022 (ENS), IEC 62443, ISO/IEC 27001:2022, ISO/IEC 27005:2022, Regulation (EU) 2024/2847, Law 8/2011, ISO 22301:2019.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Where this takes you
Requirements
- University degree in engineering, science or architecture, or equivalent demonstrable professional experience.
- Internet connection and a computer capable of running the programme's software.
- English sufficient to read technical standards.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 1,900 hours over 12–14 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.
You work with Wazuh, Wireshark, PILAR and Zeek, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.
A SEIUM Institute diploma, awarded on passing the continuous assessment and the Master's Thesis. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Ask about the recognition policy when you enrol.
A university degree in engineering, science or architecture (or equivalent professional experience), a computer able to run the software and English sufficient to read technical standards.
Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.
Related programmes
Master’s in Unconventional Water Engineering
Online master's programme of 1,900 hours in unconventional water engineering, structured in 12 modules covering desalination, water reclamation and reuse, alternative sources, energy, plant design, operation…
Master’s in Sanitation and Wastewater Treatment Engineering
Online master's programme of 1,900 hours in sanitation and wastewater treatment engineering: 12 modules covering wastewater characterisation, sewer networks, preliminary and primary treatment, aerobic biological processes,…
Master’s in PropTech/ConTech and Urban Data Regulation (Privacy, Ethics)
Online master's programme of 1,900 hours in PropTech/ConTech and urban data regulation, with a focus on privacy and ethics. 12 modules covering the PropTech and ConTech…
More in Civil, Rail & Smart Cities
All Civil, Rail & Smart Cities programmes → · How to apply · Fees & financing · Scholarships