Sargent & Lundy engineers critical power infrastructure - nuclear plants, grid modernization projects, renewable installations - where a breach doesn't mean leaked credentials, it means potential physical damage to generation assets or transmission systems. Founded in 1891 and consistently ranked among Engineering News-Record's Top 500 Design Firms since 1965, the firm operates at the intersection of operational technology and information systems across projects spanning small modular reactors, carbon capture systems, and grid-scale energy storage. The threat model here involves ICS/SCADA environments, supply chain integrity for long-cycle construction projects, and compliance frameworks governing nuclear facilities and critical infrastructure.
Nearly 75% of the workforce consists of engineers and designers, with staff holding degrees from over 650 institutions globally and serving on more than 300 national code committees. This creates an unusual security posture: deeply technical operators who understand physical systems but require robust InfoSec controls around design data, construction management platforms like Primavera P6, and engineering tools including PLS-CADD for transmission design. The company is engineer-owned, meaning security decisions route through technical leadership rather than pure business considerations - a dynamic that can either accelerate or complicate implementation depending on how threat scenarios align with engineering priorities.
The operational environment spans consulting through construction management and commissioning, requiring security practitioners to address both corporate IT and project-specific OT concerns. Work touches nuclear regulatory compliance, grid interconnection standards, and the emerging attack surface of decarbonization technologies where cyber-physical vulnerabilities remain under-studied. For security teams, this means navigating ISO 9001 quality frameworks, understanding how malicious code could propagate through engineering documentation, and designing controls that don't break workflows for teams managing multi-year infrastructure buildouts with strict change management protocols.