Worley is a $12 billion global professional services firm headquartered in Sydney, operating across more than 40 countries with over 45,500 employees. Founded in 1971, the company delivers engineering, project management, asset management, consulting, procurement, construction, operations, and decommissioning services to the energy, chemicals, and resources sectors. Its domain spans conventional energy, low-carbon energy, hydrogen, nuclear power, battery materials, and offshore and onshore oil - meaning the attack surface covers industrial control systems (ICS/OT), SCADA networks, and complex supply chain integrations across critical infrastructure that rarely gets a pass from threat actors.
The cybersecurity challenge here isn't abstract. Worley operates in sectors where a compromised engineering workstation or a tampered procurement pipeline carries real-world physical consequences - think process safety, not just data exfiltration. The company's AI-enabled delivery initiatives introduce additional vectors: model integrity, data poisoning, and the security posture of machine learning pipelines feeding into engineering decisions across the project lifecycle. Teams working in this environment need fluency in OT/IT convergence, industrial protocol security, and the governance frameworks that keep critical energy infrastructure defensible.
With operations spanning consulting through decommissioning, Worley's security work likely involves securing cloud and on-prem environments managing everything from EPC project data to operational technology in live facilities. The threat model includes nation-state actors targeting energy infrastructure, supply chain compromise through procurement workflows, and insider risk across a workforce distributed across 40+ countries. If you're looking at hardening environments where engineering meets physics and the blast radius is measured in more than data loss, this is the surface area.
