Women In Security Magazine Issue 19

19

MARCH • APRIL 2024

NEURODIVERSITY IN CYBERSECURITY P10

DECODING CYBER ROLES IN 2024 P72

W W W. W O M E N I N S E C U R I T Y M A G A Z I N E . C O M

FROM THE PUBLISHER The question “Who should be in security?” has never been more pertinent.

Today, professionals from varied disciplines, including technology, psychology and data analysis, play crucial roles in ensuring comprehensive security strategies.

T

Collaborative efforts that draw on the strengths of professionals from diverse backgrounds are essential to staying ahead of sophisticated threats. he security framework is shifting as the industry recognises the need for

Professionals with expertise in technology, artificial

diversity in perspectives, experiences

intelligence and data analytics are indispensable in

and skillsets. In this edition of Women

developing robust defences against cyber threats.

in Security Magazine we explore the

The security sector must actively seek individuals

importance of inclusivity and the

with advanced technical skills to secure critical

varied personality profiles that should be welcomed

infrastructures and sensitive data.

into the security domain.

I addressed this matter last year at the Australian It is essential to challenge preconceived notions

Women in Security Awards Alumni events, and it

surrounding gender roles in security. The industry is

remains at the forefront of my thoughts. The future

no longer exclusive to a particular gender; instead,

of security relies on the fresh perspectives and

it thrives on the collaboration of people with diverse

innovative ideas of the younger generation. Embracing

talents. Women are increasingly contributing to every

and nurturing young talent not only ensures a

facet of security, from cybersecurity to physical

continuous influx of new ideas but also keeps security

security, bringing unique problem-solving approaches

strategies adaptive to the latest technological

and critical thinking to the table.

advancements. Mentorship programs and educational initiatives are vital in preparing the next generation of

I see security as a global concern that requires a

security professionals.

nuanced understanding of diverse cultures and

2

backgrounds. Including individuals from different

Leadership within the security industry should reflect

ethnicities not only enhances the cultural competence

the diversity of the workforce. Creating a leadership

of security professionals but also fosters a global

culture that values and promotes inclusivity is crucial

perspective that is crucial to tackling international

for fostering an environment where everyone feels

security challenges. Embracing diversity enables the

heard, respected and empowered. Diverse leadership

industry to adapt and respond effectively to the ever-

produces diverse solutions, ensuring a well-rounded

changing threat landscape.

approach to security challenges.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

Abigail Swabey

As we navigate the complex and interconnected challenges of the 21st century, the question of “Who should be in security?” transforms into a call for inclusivity, diversity and collaboration. Embracing individuals from different backgrounds, experiences and disciplines is not just a moral imperative; it is a strategic necessity in the quest for comprehensive security solutions on a global scale. By redefining the security workforce we pave the way for a safer and more resilient future.

Abigail Swabey PUBLISHER, and CEO of Source2Create www.linkedin.com/in/abigail-swabey-95145312

aby@source2create.com.au

I S S U E 19

WOMEN IN SECURITY MAGAZINE

3

CONTENTS

2

CAREER PERSPECTIVES

FROM THE PUBLISHER

Decoding cyber roles in 2024

72

Cultural blips sink ships

76

Cybersecurity: an inclusive industry for everyone and how to break into it

78

How journalism set me up for a career in cybersecurity

82

COLUMN Who should fight cybercrime?

14

Who should be in cybersecurity? 46 Who should be in security?

10

68

NEURODIVERSITY IN CYBERSECURITY

INDUSTRY PERSPECTIVES

WHAT’S HER JOURNEY?

Who gets a seat at the table?

56

Managing AI bias and the vital need for upskilling and reskilling in technology: our industry depends on it

59

Fostering diverse and inclusive workplaces: embracing neurodiversity 62 Dr Fauzia Idrees Abro

16

Kenia Carvalho

18

Roma Singh

22

Sheavy Kaur

24

Beth Dwyer

26

Florence Mottay

28

Dr Mohuya Chakraborty

31

Heidi Mejia

34

Nalini Jadia

36

Cheryl Pome’e

38

Ash Mohanaprakas

41

Getting more women into cybersecurity 66

SECURITY 120 EVENTS

122 THE LEARNING HUB

MARCH • APRIL 2024

FOUNDER & EDITOR Abigail Swabey

50

ADVERTISING Abigail Swabey

NAVIGATING ADHD: THE UNFINISHED TALE OF HOW I FELL INTO CYBER SECURITY

Charlie-Mae Baker

M A G A Z I N E C O O R D I N ATO R Jane Saafi

116

JOURNALISTS David Braue Stuart Corner

SUB-EDITOR

64 EMBRACING NEURODIVERSITY IN CYBERSECURITY

TURN IT UP 124

STUDENT IN SECURITY SPOTLIGHT

Stuart Corner

DESIGNER Rachel Lee

Source2Create Pty Ltd is the publisher of this magazine and its website (www.womeninsecuritymagazine.com).

©Copyright 2024 Source2Create. All rights reserved.

Reproduction in whole or part in any form or medium without express written permission of Source2Create is prohibited.

Yasaman Samadi

86

Bernie Garnell

92

Tian Sang

95

Basila Shamsudeen Shaffi

100

Elisabeth Chen

107

Arooj Fatima

108

Nicky Bryant

111

Devyani Bhattacharya

112

OFF THE SHELF 126

ASSOCIATIONS & GROUPS SUPPORTING THE WOMEN IN SECURITY MAGAZINE

07

08

MARCH • APRIL

IN 2022, YOU CAN NO LONGER TAKE SECURITY WORKERS FOR GRANTED P10-13 AS THE SECURITY THREAT MORPHS, DEFENSIVE TEAMS MUST CHANGE TOO

MAY • JUNE

WHO RUNS

P76-79

20 22

IF YOU CAN’T SPEND YOUR WAY TO GOOD SECURITY THIS YEAR, TRY FOCUSING ON YOUR PEOPLE P94-97

YEAR OF THE SECURITY WORKER

W W W. W O M E N I N S E C U R IT Y M A G A Z I N E . C O M

the

WORLD W W W. W O M E N I N S E C U R IT Y M A G A Z I N E . C O M

OFFICIAL PARTNER

SUPPORTING ASSOCIATIONS

08

MAY • JUNE

IN 2022, YOU CAN NO LONG ER TAKE SECU RITY WORK ERS FOR GRAN TED P10-13

20 22 W W W. W O

AS THE SECU RITY THREAT MORP DEFE NSIV E HS, TEAM S MUST CHAN GE TOO P76-79 IF YOU CAN’T YOUR WAY TO SPEND SECURITY THISGOOD TRY FOCU SINGYEAR, ON YOUR PEOP LE P94-97

YEAR OF THE SECURITY WORKER

MENINSE

WHO RUNS

CURITYM

AGAZINE.

COM

WORLD the

W W W. W O

MENINSE

CURITYM

AGAZINE.

COM

TO O U R M A

GAZINE

SUBSCRIBE

07

MARCH • APRIL

Never miss an edition again!

Subscribe to the magazine today for exclusive updates on upcoming events and future issues, along with bonus content.

SUBSCRIBE NOW

AUSTRALIA’S

BEST SELLING S AN AUD I

OK BO

SO AL

A LE

O

AVAIL AB

CYBER SECURITY BOOK

Bought it for my daughter and we are both very impressed! Great artwork as well as the book itself. She is a 9 year old avid internet user, and I do worry about what she gets up to and the choices she makes. We limit her access and have cyber security overlays on her devices - but we are not too clued up on cyber security so it was always a worry.

This book has been great to get conversation flowing that I didnt really know how to start up, and it has definitely taught her some worthwhile lessons on things to look out for and "shadowy corners" of the internet to be cautious of! I recommend this book.

BUY THE EBOOK

BUY THE AUDIOBOOK

BUY THE PAPERBACK

NATHAN CHUNG

NEURODIVERSITY IN CYBERSECURITY

by Nathan Chung, Cloud Security Architect

Neurodiversity and cybersecurity are a match made in heaven. Many people with neurodivergent traits have natural skills that enable them to excel working in cybersecurity. Despite this, neurodivergent people face multiple barriers to working in cybersecurity and they often do not get the support they need with many being invisible, especially women.

N

NEURODIVERSITY

In cybersecurity, neurodivergent people can offer

eurodiversity refers to natural variations

a competitive advantage. Many are naturally gifted

in the human brain and covers a

with high creativity, intense hyperfocus, strong

multitude of conditions such as autism,

attention to detail, outside-the-box thinking, the ability

ADHD (attention deficit hyperactivity

to recognise patterns, strong visual-spatial skills,

disorder), dyslexia, dyspraxia, Tourette’s

and more. These skills are very much needed in

Syndrome, dyscalculia, and more. According to the US

cybersecurity, but despite this, neurodivergent people

National Library of Medicine, it is estimated that 15-20

working in cybersecurity need help to thrive.

percent of the world’s population have neurodiverse

10

conditions. STEM fields such as cybersecurity are

INVISIBLE WOMEN

popular with neurodiverse people: an estimated

According to ISC2, women represent 30 percent

15 percent of the STEM population are believed to

of the global cybersecurity workforce, up from 17

be neurodiverse.

percent in 2017. Despite this improvement, the key

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

F E A T U R E

demographic of neurodivergent women is often

norms, or how things are

ignored and forgotten.

done. To compensate, neurodivergent women

First, consider the stereotypes. The stereotypical

are forced to adapt

cybersecurity professional is often a man. Similarly,

to their environment,

the stereotype of a neurodivergent person is also a

putting their mental

man. Social bias and popular culture also reinforce

health at risk. This is

these stereotypes. Popular media images of

called masking.

neurodivergent people are Dustin Hoffman’s character in the movie Rain Man, Keir Gilchrist’s character in the

Masking for a neurodivergent

TV series Atypical and Elon Musk.

person is similar to running a virtual server operating system with a heavy I/O load on an old laptop with

Second, scientific studies and medical research

less than a gig of RAM. That server is going to

reinforce the prevalence of these gender biased

eventually crash with a Blue Screen of Death. When a

stereotypes. A research study by the American

neurodivergent person masks they increase their risk

Journal of Human Genetics found males to be

of anxiety, depression or mental exhaustion. What

at greater risk of suffering neurodevelopmental

can be done?

disorders than females and, as a result, males being correctly diagnosed significantly more often

THE INTERVIEW

females. This gender bias is so pervasive that, when

The first obstacle for neurodivergent people working

neurodivergent women visit a doctor, they are often

in cybersecurity is the interview. Interviews are a

dismissed, their conditions misdiagnosed, and they

very social activity, and many companies will often

are left to deal with the issues and the pain alone.

have multiple interview rounds, often with interview panels with multiple people, and often in a single

Third, if a neurodivergent woman does get a job,

day; a nightmare for many candidates. What a lot of

she often struggles to fit in. Imagine being an alien

job seekers do not realise is that they can request

on Earth and not understanding people, social

accommodations such as remote interviews over

conventions, how to communicate based on cultural

Zoom or Teams, for interviews to be spread over

I S S U E 19

WOMEN IN SECURITY MAGAZINE

11

multiple days, for interview questions to be provided ahead of time, for closed captions, for additional time to answer questions, and more.

THE OFFICE

“Masking for a neurodivergent person is similar to running a virtual server operating system with a heavy I/O load on an old laptop with less than a gig of RAM. That server is going to eventually crash with a Blue Screen of Death.

When a neurodivergent person masks they increase their risk of anxiety, depression or mental exhaustion."

- Nathan Chung

The second obstacle for neurodivergent people working in cybersecurity is the office. Offices are often loud, chaotic, full of people and full of distractions that can create overwhelming sensory overload for neurodivergent people. COVID-19 changed everything. People stopped coming into the office and started working remotely. The big bonus: people with neurodiverse conditions, in particular women, thrived working remotely. Now in 2024, remote work is being eliminated, with many companies wanting workers back in the office.

A 2023 poll asked neurodivergent people: “If your employer encourages you to return to the office, do you plan to do so?” Eighty five percent responded “No”. Return to office mandates risk destroying all the gains made by neurodivergent people, especially women. The best option is to allow people to choose their workplace.

12

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

F E A T U R E

CONFERENCES The third obstacle for neurodivergent people working in cybersecurity is conferences. To advance in cybersecurity, people often attend conferences for training and to network with other people.

Problem: conferences are often not accessible for people with disabilities, much less for people who

dotm.com.au/

are neurodivergent.

A poll conducted in 2023 asked: “How would you

Join Today for FREE

rate the capacity of big conferences to provide accommodation for your disabilities?” Fifty eight percent responded: “They don’t provide anything.”

Almost all the people who selected this response were women. To help, conference organisers should

To NETWORK with other like-minded people

have quiet rooms for people to recover from sensory overload, provide captions, provide better signs and maps for navigating the event, have remote participation options, and more. These facilities would go a long way to make conferences more accessible for everyone.

CONCLUSION Many neurodivergent people will find success working in cybersecurity. The barriers are many, especially for neurodivergent women who have been invisible and ignored for years, but the barriers

To MEET prospective candidates for graduate programs To MEET prospective employers of graduate programs

can be brought down. Ultimately, to help more women, especially neurodivergent women, get into cybersecurity, we need to listen to them, support them and work with them to see them thrive. Then we will see how far they can go.

The club is for security professionals (present, future and past)

www.linkedin.com/in/nc808

I S S U E 19

WOMEN IN SECURITY MAGAZINE

13

AMANDA-JANE TURNER Cybercrime is big business, thanks to technical advancement and interconnectivity creating more opportunities. This regular column will explore various aspects of cybercrime in an easy-to-understand manner to help everyone become more cyber safe.

C O L U M N

Who should fight cybercrime?

Cybercrime is diverse. It includes malware, cyber-

about fraud investigators and those who have worked

enabled fraud, cyber espionage, disruption, child

in or studied policing, and see their investigation skills

exploitation material, romance fraud, tech support

as an asset in cybersecurity.

scams, spreading hate online and cyber bullying.

Aside from those working in cybersecurity, anyone Criminals behind cybercrime are also diverse. They

who uses technology can help fight cybercrime. They

may be nation state-sponsored attackers acting on

can make it harder for criminals to successfully phish

behalf of or for their country; activists wanting to

for credentials, to trick people in romance fraud,

make a statement; individuals or criminal enterprises

or place malware on computers, all of which make

committing fraud; individuals, groups or criminal

it harder for criminals to be successful. Let’s help

enterprises creating and sharing or selling child

raise awareness in our families, workplaces, schools

exploitation material, or criminals running large call

and communities of how we can all be part of the

centres involved in tech support scams.

cybersecurity solution.

It follows that we need a diverse workforce in

Who should fight cybercrime? Anyone who uses

cybersecurity fighting all these diverse cybercrimes

technology.

and cybercriminals.

We need to look beyond people with degrees in computer science, start thinking about criminologists, and see their to ability to analyse crime and criminals

www.linkedin.com/in/amandajane1

www.demystifycyber.com.au

as an asset in fighting cybercrime. We need to think

14

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

WHAT’S HER JOURNEY?

A PIVOTAL CAREER MOMENT This was a decade after gaining her bachelor’s degree and working in the military and was, she says, a pivotal event. “This breakthrough marked a significant turning point in my career, allowing me to merge my technical foundation with specialised knowledge

Dr Fauzia Idrees Abro Associate Professor, Director DL MSc in Cyber Security and Campus MSc in Information Security at Royal Holloway, University of London

in information security. This educational milestone opened doors for me to actively contribute to the cybersecurity domain.”

In her role at Royal Holloway Abro oversees two postgraduate programs in information and cybersecurity. “One program is campus-based while

D

the other is designed for distance learning, catering specifically to a global audience constrained by r Fauzia Idrees Abro is an associate

full-time employment and geographical limitations

professor, director DL MSc in cyber

that prevent them from participating in on-campus

security and campus MSc in information

programs,” she says.

security at Royal Holloway, University of London.

“This dynamic allows me to contribute to the field of cybersecurity advocacy to a wider audience.

She has come a long way from where her life journey

One aspect of my role I find particularly enjoyable

began. She was born in a remote area of Pakistan

is the opportunity to engage in cybersecurity

where education for girls was not the norm. Abro was

education on a global scale. Facilitating learning

one of the lucky ones: she gained a school education

experiences for students from diverse backgrounds

and aspired to become a doctor, recognising the

worldwide, all under the guidance of esteemed

unmet healthcare needs of women in rural areas.

professors from Royal Holloway, fuels my passion for cybersecurity advocacy.

However, instead she acceded to her parents’ wishes for her to study engineering and enrolled for a degree

“Having assumed this position in July 2022, I

in electronic engineering. She excelled, gaining a gold

am relatively new to the role, yet I am thoroughly

medal from the Institution of Electrical & Electronics

enjoying the multitude of opportunities it presents

Engineers Pakistan for her final year project on the

to extend quality cybersecurity education to both

security of cellular mobile systems.

privileged and underprivileged communities through a single platform.”

“This project sparked my interest in security, a passion that deepened during my subsequent

Abro says her major challenge is the rapidly evolving

experience in the military,” she says. “Working

cyber threat landscape. “The need for continuous

on networks and security in a real-world setting

updates to our educational offerings to keep pace

intensified my fascination with the subject.”

can be demanding. However, our strong industry partnerships and collaborative efforts with experts

16

This interest led Abro to study for a master’s degree

in the field help bridge this gap. The willingness of

in cryptology and information security at Pakistan’s

industry professionals to share the latest insights with

National University of Sciences and Technology,

our students greatly contributes to our ability to stay

which she gained with distinction.

ahead of the curve.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

W H A T ’ S

H E R

J O U R N E Y ?

“A typical day for me is a well-balanced blend

consultancy where understanding the intricacies of

of technical and non-technical cybersecurity

the financial market is critical.

management within an educational framework, coupled with ample research opportunities. Engaging

“Given that financial institutions are often attractive

in meetings with industry experts, academic partners

targets for cyber criminals, enhancing my

and students forms a substantial part of my routine.

financial knowledge will enable me to offer more

While some days may be challenging to navigate,

comprehensive and effective cybersecurity solutions

the rewards lie in the constant learning environment

in this specific domain.”

that nurtures my passion for the field. Overall, my role allows me to contribute to cybersecurity education

NO REGRETS

on a global scale while staying attuned to the ever-

And Abro has no regrets about any aspects of

evolving landscape of cyber threats.”

her career in cybersecurity, saying she has never questioned any of the choices she made. “My

PHD AND MASTER’S

journey has been marked by a continuous sense of

Between gaining her MSc and taking on her current

fulfilment and passion for the work I do. If anything,

role at Royal Holloway, in 2022, Abro gained more

my predominant sentiment has been a realisation of

qualifications. She holds a PhD in Information

the vastness of this domain and the perpetual need to

Security Engineering from City, University of London,

learn and adapt.

in information security engineering. This, she says, “involved in-depth research on the analysis and

“The highs in my career have been moments of

detection of malicious software.”

achievement, such as successfully implementing robust security measures, contributing to cutting-

Since her PhD she has gained an MBA in innovation

edge research and witnessing the positive impact of

and entrepreneurship from the University of Kent,

my work on organisations. These moments reinforce

UK. “This program not only honed my management

my commitment to the field and provide a sense

and leadership skills but also provided me with a

of accomplishment.”

holistic perspective that has proven invaluable in my leadership roles,” she says.

She acknowledges there have been challenges and setbacks but says these have served as valuable

“The diverse knowledge acquired through these

learning experiences that “have not deterred

qualifications and courses has played a pivotal

my dedication to security but rather fuelled a

role in effectively leading teams and navigating the

determination to overcome obstacles and enhance

challenges of different organisational roles.”

my skills. The dynamic and ever-evolving nature of the security landscape ensures there is always more to

Abro says her learning has been particularly useful for

learn and discover.

her current role. “Balancing the intricate technicalities of security with effective leadership is paramount

“Far from feeling I’ve invested too much time in this

to ensuring the success of security programs and

field, I consistently recognise the need to invest

initiatives. The ability to communicate complex

more, given the rapid advancements and persistent

security concepts to diverse audiences, both technical

threats. The journey in security, with its highs and

and non-technical, has also been instrumental in

lows, has only strengthened my conviction that this

my success.”

is precisely where I belong and where I can make a meaningful impact.”

Abro is now looking to undertake further study to develop her financial education skills, saying this aligns with her aspirations in cybersecurity

I S S U E 19

www.linkedin.com/in/fiabro

WOMEN IN SECURITY MAGAZINE

17

Kenia Carvalho VP, Regional Information Security Lead at BNY Mellon

K

enia Carvalho is VP, Regional Information

From that point on, Carvalho says she worked

Security Lead for BNY Mellon and is

diligently to build her career in information security.

based in São Paulo, Brazil. “An institution

“I worked and studied hard to be prepared to work

that is America´s oldest bank and the first

within the information security area, and I am still

company listed on the New York Stock

focused on studying and looking for the best way

Exchange, today BNY Mellon powers capital around

to contribute more and more with my colleagues,

the world though comprehensive solutions that help

employer, and community. “For most of the journey,

clients manage and service their financial assets

I didn’t have any direct mentors. Everything I learned

throughout the investment life cycle, she says. She

to ease my way was through books and daily

joined the company in 2022.

corporate experiences.”

And if you look at her LinkedIn profile you will see

Carvalho gained a degree in computer science

‘information security’ in the job title of every role she

technologies in 2003. She was working at the time

has held since 2006. Hers is a career path forged

and after graduating she quit her job and used all her

from a seed planted back in 2000 when she was

savings to spend a few months in Italy.”

researching the philosophy of ethics and data.

BREAKING INTO INFOSEC “The term ‘information security’ was not used in

Her first job on returning to Brazil was in IT, working

Brazil at the time, and the area didn’t exist as we

for a company providing support and administration

know it,” she says. “I was shocked by the way data

of networks and IT projects for a large American bank,

and information were treated in Brazil. So, I thought

Citi. It was there that her passion for information

to myself, ‘Wow, is there an area that takes care of

security grew and she made the transition. “I

this topic? It’s an important topic, how can we protect

mentioned to my IT coordinator that I was interested

people’s data?’ A little seed was planted on that day.

in working with infosec and a few months later I

Then, it wasn’t until I was in my third job that I had

received a job proposal from the bank I was providing

contact with InfoSec and did everything to get into the

services to, and within the information security area.”

area. I started from scratch.”

18

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

W H A T ’ S

H E R

J O U R N E Y ?

That was the start of Carvalho’s information security career, and she was fortunate to get off to a good start. “This area was being restructured. The company was merging the business security area with the technology security area, so I was with a team of experienced professionals faced with all the security programs that were starting to take shape in Brazil, replicating the HQ in the US,” she says.

“I had a great learning opportunity, because over the years job rotation within infosec allowed me to get a very wide view of the area. During this part of my professional journey, I managed to improve my academic profile. I took a lot of internal and external technical courses, an information security postgraduate specialization and got two professional certifications in the risk-security field.”

A CAREER BOOST

I worked and studied hard to be prepared to work within the information security area, and I am still focused on studying and looking for the best way to contribute more and more with my colleagues, employer, and community. For most of the journey, I didn’t have any direct mentors. Everything I learned to ease my way was through books and daily corporate experience.

Carvalho stayed 10 years with Citi and left after receiving an offer from another US company, Goldman Sachs to take up a regional role. It delivered

“In this company I had the great chance to also play

a major boost to her career. “It was different

the role of data protection officer. I was able to put

from anything I had experienced until then; it was

into practice everything I had learnt in previous years

something big and with extremely qualified people,

of study on privacy and data protection, in addition to

and over the five years I was there, there was not

restructuring the entire infosec area. I went back to

a day in which I did not learn something, whether

the roots of information security by getting my hands

it was observing people, or from hands-on tasks.

dirty. It was very surprising to me that I was able to

It was an incredible experience that brought me

reinvent myself in such a profound way.”

qualifications and learnings I never imagined reaching or experiencing.”

A RETURN TO BANKING After two years with Iugu, Carvalho returned to big

Then, in the midst of the COVID-19 pandemic,

banking, taking her current role with BNY Mellon,

Carvalho made a major career shift: from a

but with a fresh outlook. “I was more open, more

multinational bank to a medium sized Brazilian

playful, looking for new ways to implement different

Fintech company, Iugu. It operates a payments

programs. It didn’t take long for me to realize there

platform with APIs that enable businesses to integrate

were lot of opportunities in this company,” she says.

and manage online payment transactions.

“It is a Vice President position whose mission is to The experience proved transformative. “It was a

contribute to the implementation of information

company full of energy and young people, and with

security strategies for the business area. I am the

a different risk appetite from what I was used to,”

go-to person for the entire LATAM region when it

Carvalho says. “It was a great challenge for me. I

comes to information security and cybersecurity

realised how rigid I was, and my creativity came to the

matters within the areas of business, internal

surface. I started to have a more humanised outlook,

staff, clients, and regulators. Part of my role is to

because I was facing a younger generation with new

contribute to the development and supporting of

ideas and new ways of doing business.”

an information security aware culture and mindset

I S S U E 19

WOMEN IN SECURITY MAGAZINE

19

among employees, contractors and service providers,

or anyone to stand in my way.” “Those were different

reducing the likelihood of reputational damage, and

times, and we had a lot of progress in this space and

of any regulatory issues arising from non-compliance

many things changed during these years and today I

with the bank’s information security management

can see a different environment, that this behavior is

policies and standards, including local procedures.

not allowed, people have more voice, and we work for

Given the nature of my work, I need to be constantly

a more inclusive environments in the firms. Nowadays

connected with other business units: operations,

I have been participating of Cyber and Tech groups

technology, legal, risk and compliance. In that sense,

for promoting a healthy and democratic corporate

I collaborate with other stakeholders to develop and

environment for women.”

implement consensual decisions.”

After almost 20 years in information security roles, “One of the main things I love about my job is the

Carvalho has certainly been successful, but says:

dynamic environment and the autonomy I have to

“Information security is not an easy area. You have

go ahead with my initiatives. Some of my challenges

fascinating and rapidly evolving adversaries, and

include presenting cybersecurity as an important

you are forced, as a result, to be constantly learning

value that allows business products and services to

and developing.” Improvement, she says, is “a never-

operate efficiently, and helping our clients navigate

ending exercise,” and for her one focus area for

the complex and dynamic financial world. In my

improvement is neuroscience.

position, there is no typical day. I usually organise my tasks in small projects and blocks that allow

“Considering that companies have been focusing

me to adjust my schedule. I need to be ready to

more and more on human beings as the most

change gears based on the needs of internal clients

important asset they have, I think it is important to

and business partners. If I had to describe my daily

understand how our brains work in the context of

routine, however, I would certainly include the local

so many generations and technologies. I am going

and global meetings, review and analysis procedures

back to the basics—the scientific data, the biology—

and processes, cybersecurity educational initiatives,

to understand behaviours and connect with people

technology learning and problem-solving.”

and ideas.

IS SEXISM A GAME?

“From a technical point of view, the main topics I am

Like many women who have risen to high level

interested in are AI and governance frameworks for

roles, Carvalho experienced her share of sexism and

data and information protection. I have been studying

misogyny, but her way of dealing with it was perhaps

cognitive science and AI. I am interested in topics

atypical: “At the beginning of my career there was less

regarding the ethical use of technology and the

diversity in the workplace and, I thought was normal,

cognitive science in human learning.”

so just ignored it because I had a goal in mind. I wanted to be successful. So, I didn’t allow anything

20

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/kenia-carvalho-crisc-cdpo-6a227610

M A R C H • A P R I L 2024

INTERESTED IN WORKING TOGETHER? Contact Aby Aby@source2create.com.au www.source2create.com.au

MEDIA

CONTENT

EVENTS

ADVERTISING

CUSTOM AS-A-SERVICE

Roma Singh Cyber Security Specialist

Singh moved to the UK and worked there for several years before migrating to Australia 10 years ago, where she struggled to find employment.

R

“It was hard for me to secure the first job, hence oma Singh was born into a conservative

I started volunteering which helped me gain

family in the City of Joy in West Bengal,

local experience and build a strong network,” she

India. where she attended an all-girl

says. “Over the years, I continued to establish my

convent school. She wanted to be a

career in information technology through various

doctor but failed to qualify for a position

helpdesk support, networking support and desktop

in the national entrance exams. Her parents were

engineer roles.”

unwilling to allow her an extra year to prepare for the medical entrance exams so she accepted a

ROME WAS NOT BUILT IN A DAY!

place at the engineering college where she studied

During COVID lockdowns in Melbourne staff in

for bachelor’s and master’s degrees in technology,

her workplace were sent to work from home or

electronics and communications engineering. Her

from backup sites, which created many IT support

master’s thesis was on the implementation of

challenges. “The office became a second home for

cryptography in the C programming language.

me in those days. I resorted to online cybersecurity learning,” Singh says. “I would read on the train on

It was during her university days that Singh developed

the way home and would post interesting content

a liking for cybersecurity when her friends talked

like cybersecurity news and how to maintain good

about various hacking activities around the world.

cyber hygiene in the Yammer community of the

While studying for her master’s Singh landed her first

organisation I worked for.

job, as a part-time lecturer. She remembers it well.

“My managers kept praising me and my continuous

22

“It was a Saturday afternoon. I walked home and

improvement efforts. One of them told me: ‘You are

surprised my parents with the first offer letter of my

punching way above your weight. You’re a role model

life,” she says. “It was an inspirational experience for

for others.’ I have been a mentor to junior colleagues

me to teach brilliant bachelor’s students and interact

over the years and I knew it was time for me to take

and knowledge-share through group discussions,

that risk and start being uncomfortable and embrace

seminars and laboratory experiments or in the library.”

the unknown.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

W H A T ’ S

H E R

J O U R N E Y ?

“I told myself ‘If not now, then never.’ Someone finally

and gained certifications like ISC2 Certified in

gave me a chance. I landed my first cybersecurity role.

Cybersecurity. The Purple Team Australia Program,

In my current position, I offer specialist cybersecurity

which offers a Diploma of Cybersecurity, was a

advice to clients and help achieve outcomes. The

massive learning opportunity for me.

IT and cybersecurity roles I enjoy most are those in which no two days are the same. Every day is a new

“0xCC also run training conferences on various

day of learning, collaborating and facing challenges to

topics which include web app hacking fundamentals,

achieve desirable outcomes.”

introduction to C, reverse malware engineering, digital forensics, and others which helped me brush up my

RECONNECT TO YOUR SOUL

skills. The Tangible Uplift Program (TUP) was another

Singh says: “the very first and crucial step towards a

great learning experience for me. It taught me how

successful career is the realisation of your passion in

to think like a CISO. I also participated in the incident

life. What do you want to do, and why do you want to

response competition run by Retrospect Labs, which

do it? The second step is setting out to achieve it. Are

was a great learning experience for me, collaborating

you willing to take risks, embrace discomfort, make

with four other women for 10 days in an exercise to

sacrifices and learn new things to move ahead?

respond to a cyber breach and dealing with legal, regulatory, board and media obligations around that.

“A job title, a contract role, longer travel time to work

Attending AISA Cybercon gave me the privilege to

or even a lower salary should never be a barrier

attend Locksport villages and Career villages which

between you and your dreams. If you want something,

had an inclusive and informative atmosphere.

go get it. Also don’t forget to be kind to yourself. At the end of the day, you can only do so much.”

“Bsides Melbourne was another great conference at which to listen to inspirational stories. Code Review

SMALL DROPS OF WATER BUILD AN OCEAN

- HackerChix by InfoSect was another great course

She also stresses the value of continuous learning.

I undertook and highly recommend. Cybersecurity

“Life happens and I know we are all dealing with so

is a massive and evolving field. To keep pace we

much in our lives, but we surely can make some

must develop a habit of continuous learning and

time for learning. The first 24 years of my life, I had

knowledge sharing through our social networks.

no social life. I was shy and in my own world. I am

Take part in those incident response and capture

sure we have all heard how important networking is.

the flag competitions and explore the world of

Going to cyber conferences, meetups and talks not

endless possibilities.”

only increases your knowledge but also exposes you to different technologies, tools, artefacts and, most

Singh says leadership is a way of life. “Every little seed

important of all, people.

of empathy you plant around you helps makes you a leader. The experiences you share in your community,

“Engaging in the community and volunteering my

motivating and uplifting others set great examples

time has been a very rewarding experience for me.

of captainship.

I started volunteering when I was at school. After school hours some of us would stay back and teach

“And lastly, I have a habit of leaving the house in

underprivileged kids who had no access to education.

perfect condition. I heard someone once say, ‘Chores

Today, I try to help wherever I can from local sports

can wait’ and this changed my life. Everything else

clubs or neighbourhood or not-for-profit organisations

can wait, now is the time to pursue your dreams because ‘If not now, then never’.”

“Joining organisations like AWSN, AISA, ISACA has helped me advance my learning and boost my professional network. I have taken courses

I S S U E 19

www.linkedin.com/in/romasingh19

WOMEN IN SECURITY MAGAZINE

23

Sheavy Kaur Information Security Specialist at RAAFA WA

in thought and experience is the cornerstone of innovation, especially in such a dynamic and complex field.

As a cybersecurity specialist today, Kaur’s interest has

S

spread beyond the technical aspects. Her initial spark of curiosity has evolved into a steadfast commitment heavy Kaur’s journey in cybersecurity

to making the digital world a safer place for all.

unfolds as a captivating blend of serendipity, adaptability and continuous

For aspiring cybersecurity professionals, Kaur offers

learning. Hailing from a small town in

a comprehensive roadmap. A strong foundation, she

India with limited opportunities for girls

emphasises, is built on a combination of technical

in IT, her initial pursuit of programming was fuelled

and non-technical disciplines. University studies

by a flourishing curiosity for technology. However, a

should encompass computer science fundamentals,

transformative moment occurred after relocating to

information security, networking, ethical hacking,

Australia where she immersed herself in networking

cyber law, risk management and essential soft

and extended her expertise by teaching IT students,

skills like communication and leadership. Practical

broadening her horizons and deepening her passion

experience, hands-on training and engagement with

for the field.

industry professionals are crucial complements to academic learning, preparing individuals for success

Kaur had no clear, predefined vision of specific roles

in the dynamic field of cybersecurity.

when she ventured into cybersecurity: her path unfolded organically. It was guided by a readiness to

Looking ahead, Kaur predicts a thrilling, tech-fuelled

embrace new challenges, adapt to emerging trends

ride over the next two years. AI superhero squads,

and seize opportunities aligned with her evolving

quantum computing, zero-trust architectures and

interests. From programming in India to networking

the convergence of operational technology (OT) and

and teaching in Australia, each experience enriched

IT security are expected to reshape the landscape.

her perspective, cultivated diverse skills and paved the

The release of the 2023-2030 Australian Cyber

way for a rewarding career in cybersecurity.

Security Strategy and the accompanying Action Plan underscores a commitment to making Australia a

Kaur is grateful for the diverse experiences and

world leader in cybersecurity by 2030.

unexpected twists that shaped her path, particularly

24

the experience of being a woman in cybersecurity.

Kaur’s inclination to step out of her comfort zone has

She views this as an opportunity to bring a different

been one of the most important factors in her career.

perspective to the table, firmly believing that diversity

The combination of curiosity, a hunger for learning

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

W H A T ’ S

H E R

J O U R N E Y ?

and guidance from mentors has propelled her

To stay current and effective in her role, Kaur employs

forward. A supportive sisterhood of women in IT and

a multifaceted approach to learning and engagement.

security serves as a source of inspiration, pushing

Active participation in conferences, workshops,

her to make meaningful contributions to the field and

webinars, networking with peers, joining professional

advocate for inclusivity and diversity.

organisations, independent research and pursuing relevant certifications are all integral components

The most satisfying aspect of Kaur’s current role lies

of her continuous journey. A mindset of lifelong

in the tangible impact on safeguarding digital assets

learning, curiosity and adaptability is emphasised,

and fostering a culture of security awareness. Solving

acknowledging change as the only constant

complex challenges, collaborating with diverse

in cybersecurity.

teams and empowering organisations to navigate the evolving landscape bring immense satisfaction.

Addressing the cybersecurity skill shortage poses

Additionally, mentoring and advocating for the next

challenges and opportunities for Kaur’s organisation.

generation of women in security contribute to broader

The rapidly evolving threat landscape and the

professional fulfillment.

demand for specialised expertise impact recruitment strategies. Roles requiring niche skills such as threat

Maintaining work/life balance is deemed crucial,

hunting, cloud security and risk assessment, present

especially in the demanding field of cybersecurity.

significant challenges in talent acquisition. The

Kaur prioritises self-care, sets clear boundaries,

competition for top talent in these areas necessitates

practices effective time management and engages

innovative approaches to talent development,

in personal interests to achieve a harmonious

partnerships with educational institutions, and a

equilibrium. Leveraging supportive networks,

focus on cultivating a diverse and inclusive workforce.

delegating responsibilities and embracing continuous learning further enhance the balance between professional commitments and personal life.

I S S U E 19

www.linkedin.com/in/sheavy

WOMEN IN SECURITY MAGAZINE

25

Beth Dwyer Senior Information Security Consultant, Cyber GRC at MYOB

A

fter four years studying law and gaining

out mentorship played a critical role in overcoming

a Bachelor of Laws from Deakin

moments of uncertainty. Having a mentor provided

University, Beth Dwyer was confused

me with valuable guidance and reassurance during

about her future direction and had no

challenging experiences.”

desire to practice law.

“KEEP YOUR OPTIONS OPEN”

Fortunately, she had taken electives in cybersecurity,

As someone who had limited awareness of

intellectual property law, privacy and digital law. “I

cybersecurity, let alone as a career option, during

finally felt that I had found an area I could see a future

her high school years, Dwyer’s advice to today’s high

in,” she says.

school students is “keep your options open and broad and choose subjects that enable you to apply for a

Armed with this realisation Dwyer joined the Cyber

range of different university courses.” She adds: “It’s

and Digital Risk consulting team at Boston Consulting

so easy to not undertake a certain maths or science

Group (BCG) which, she says, “exposed me to a broad

subject when you’re unsure of your path, only to find

array of cyber topics across multiple industries and

that it is a prerequisite for a university course you

clients.” She spent almost five years with BCG before

might want to study.”

joining MYOB in Sept 2023.

Dwyer says that, in addition to working with “As a non-technical person in a technical field, I had

“a fabulous team of cybersecurity and risk

my doubts, particularly in the early days pursuing a

professionals” there are multiple aspects of her

cybersecurity career, Dwyer says. “Imposter syndrome

current role that give her fulfilment.

kicked in, as I’m sure is very common for almost everyone in their early career across any industry,

“I love the everyday challenges that come with

but I was able to navigate this by forming a strong

working in cyber risk and the fact that no two days are

network of both cybersecurity and non-cybersecurity

exactly the same. Solving complex problems, getting

professionals. I also ensure I continuously invest in

to collaborate across multiple teams, and seeing

my learning and development, always challenging

actionable outcomes and changes from the work

myself to branch beyond my comfort zone.

we undertake is a highlight of the role. I feel satisfied seeing actual change across an organisation, whether

26

“In addition to building a supportive network and

it be risk buy-down or behavioural shifts from the

embracing continuous learning, I found seeking

initiatives we are working on.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

W H A T ’ S

H E R

“Having the opportunity to contribute to improving the overall security posture and cyber resilience of MYOB is really satisfying and knowing my efforts are contributing to creating a more secure environment for both our organisation and our customers brings me fulfilment.”

Dwyer says a typical day in her role might involve “responding to any urgent security matters from across the business that require cyber risk support, communicating with stakeholders such as legal, procurement or product teams on security matters, and progressing on uplift initiatives that we have

J O U R N E Y ?

In addition to building a supportive network and embracing continuous learning, I found seeking out mentorship played a critical role in overcoming moments of uncertainty. Having a mentor provided me with valuable guidance and reassurance during challenging experiences.

committed to as a team.”

She adds: “There are some consistent responsibilities

Dwyer’s career journey is very different from what

and priorities my role includes. A few of these

she might have expected as a young student

include working on cybersecurity strategy for

embarking on a law degree. For others contemplating

the organisation, conducting cybersecurity risk

a pivot into cybersecurity, she says: “Cybersecurity

assessments and developing mitigation strategies,

is an extremely broad area so I would recommend

vendor/third party assurance and risk assessments,

identifying the area/s you find most interesting and

cybersecurity policy management, cybersecurity

tailoring your learning to suit.

awareness for the organisation, amongst many other things.” She is also involved in a range of audits

“Cyber is also always evolving, so ongoing learning

including PCI DSS and ISO27001.

is critical to success in the industry, regardless of background, to stay on top of trends, threats and

CONTINUOUS LEARNING

technologies. There are several transferable skills

In addition, to be effective in her role, Dwyer says she

from other professions, such as problem solving,

needs continuous learning and engagement with a

critical thinking and project management, that are

range of stakeholders from different backgrounds.

very valuable in the field of cyber, in addition to

“Regularly participating in industry webinars and

standard soft skills such as communication that are

conferences helps me gain insights into trends

developed in any role.

and threats. I also have a healthy stream of cyber news and articles I consume via LinkedIn and other

“Finally, I would spend time connecting with industry

platforms. These provide a space for discussion

groups and learning from other individuals because

and exchange of opinions, which I find useful. It is

there are countless people who have changed

particularly useful to have different perspectives on

career pathways into cybersecurity, and there is

cyber issues.”

always so much you can learn from others. The best advice I received in the beginning of my cyber

She adds: “Additionally, collaborating with my

journey was that I could learn everything I needed to

colleagues and continuing to expand my network

know about cyber over time, but my attitude, way of

within the cybersecurity field helps me stay on top of

thinking, work ethic and communication skills would

developments. It’s a proactive approach to learning

be fundamental.”

and networking to ensure I can continue to grow my skills and understanding of an ever-growing field.” www.linkedin.com/in/beth-dwyer

I S S U E 19

WOMEN IN SECURITY MAGAZINE

27

Florence Mottay VP and CISO at Zalando

F

lorence Mottay has been VP and Chief

Florence Mottay’s first foray into cybersecurity was

Information Security Officer (CISO) at

with a US startup, Florida-based Security Innovation,

Zalando since 2022, when she joined the

in 2003, as employee number seven.

company to lead the team responsible for providing protection of critical assets, early

“I had a degree in mathematics and one in software

detection of information security vulnerabilities and

engineering, but I did not know anything about

incidents, and fast response and recovery.

information security and ethical hacking,” she says. “I remember understanding roughly 40 percent of what

Florence is also a strategic advisor for Paladin

the other six were talking about on my first day. As a

Capital Group, a multi-stage venture capital

project manager, I did not necessarily need to know

firm focused on leading investments in the best

the technical details, but I decided it was interesting

technology companies globally. With more than

and that I wanted to learn more anyway.”

20 years of experience in cybersecurity and ethical hacking, Florence was previously the Senior Vice

And learn she did. “I asked one of the other six

President of Information Security and Global Chief

employees who was an amazing ethical hacker to

Information Security Officer of one of the world’s

be my mentor and he spent the next five months

largest food retail groups, Ahold Delhaize, based in

teaching me (almost) everything I needed to know

The Netherlands. She was responsible for the overall

to become an ethical hacker myself,” she says. “This

cybersecurity practice across eight countries and 19

took time and effort. After my workdays I studied

retail brands. During her tenure, Florence founded the

every night until 3am. And it worked! I became a

firm’s Global Women in Tech program. Earlier in her

strong ethical hacker and a recognised member of

career, Florence spent 10 years supporting the growth

the team.”

of small businesses specialising in information

28

security. During that time, Florence led the delivery

Mottay’s role at Security Innovations eventually

of information security and IT governance services

took her to Zalando, where she works today as

to global software and technology vendors, financial

Chief Information Security officer, a German online

companies and retail firms in her roles at IOActive,

retailer of shoes, fashion and beauty products active

Cigital, and Security Innovation.

throughout Europe.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

W H A T ’ S

H E R

J O U R N E Y ?

Hers is a career journey with many twists and

Mottay graduated in 2001, moved to Colorado and

turns which started when she left her native France

took a job as a software engineer while supporting

for Florida at age 16 to continue her studies in

her then boyfriend, now her husband, who had

mathematics as an exchange student. There she was

decided to embark on a master’s degree in computer

introduced to James Whittaker, then a professor of

science. She had been there only six months when

computer science at Florida Institute of Technology

Whitakker once again intervened in her career journey:

and later the founder of Security Innovation. He would

he lured her back to Florida to join his startup,

have a profound impact on Mottay’s career journey

Security Innovations.

over many years, after a less than auspicious start.

The company grew and garnered customers, Whittaker had acquired grants from Microsoft and

including large financial institutions and tech

IBM and was offering scholarships to students.

companies in Europe, and Mottay was asked to move

Mottay was recommended to him, separately, by her

to Amsterdam to run the European operation.

teachers in assembly language and statistics.

FROM FLORIDA TO AMSTERDAM IF AT FIRST YOU DON’T SUCCEED…

“My husband and I took the opportunity and landed

“James asked me to meet him on a Wednesday

with our three-month-old in Amsterdam in June 2005.

at 11am. As I arrived, he told me he did not have

Overnight, I went from being a technical person to

anything for me at the moment, but that I could come

leading a small business. It was challenging but gave

back the week after if I wanted, which is what I did,”

me the opportunity to polish my technical-to-business

Mottay says. “That day, he told me again that he did

‘translation’ skills and to learn how to manage profit

not have any role for me, but that I could come back.

and loss.”

This little back and forth lasted for 11 weeks. On the 11th Wednesday, James (who admitted later he could

After four years in the role, Security Innovations’

not believe that I kept on coming back!) offered me a

EMEA business was sold to another cybersecurity

job for 10 hours a week.”

company, Cigital, and Mottay stayed on for four more years to run its European business before moving to

Her first assignment was to reverse engineer some

IOActive, a company specialising in hardware hacking,

C code from the 70s. “It was one of the hardest

where she led its EMEA business.

projects I’ve ever had to work on,” she says. “I was not sure of the quality of my work, but it must have

“It was a wonderful new experience hacking vessels,

been alright as my contract got renewed after six

printers, voting machines and so many other things,”

months, and both the number of weekly hours and my

she says. “By then, we were in 2016 and I felt I

rate increased.”

had acquired a lot of expertise in ethical hacking, software, firmware, and hardware security, and that it

Whittaker’s next intervention in Mottay’s career was

was time to get a ‘grown up’ job.”

to get her to switch her university education from mathematics to software engineering. “James offered

So Mottay joined Ahold Delhaize—one of the world’s

to sponsor the rest of my bachelor’s degree and my

largest food retail groups employing 400,000 staff—as

master’s degree if I moved from mathematics to

its European CISO. “This opened up a new world for

software engineering.” Mottay says. “Mathematics

me,” she says. “First, I became a cost centre rather

was my real love, but I recognised the potential in

than a profit centre, which comes with its own set of

software engineering and decided to take on the

challenges, but different ones.

challenge. Over the three years that followed, I continued working for James, started leading projects

“Being a CISO comes with similar challenges to those

and ended up working 40 hours per week in addition

of any business leader. In particular, making the right

to my classwork.”

decisions to balance security, cost and customer

I S S U E 19

WOMEN IN SECURITY MAGAZINE

29

experience is challenging, but also an integral part

joined many groups of like-minded security leaders

of the job. Second, this gave me the opportunity

including the CISO Circle of Trust Foundation—an

to lead the entire function of information security

organisation founded in 2022 by ten large Dutch

including identity and access management, which

companies to improve their protection against

was new territory.”

cyber attacks and threats—and the Multinational Information Sharing and Analysis Center (MN-ISAC),

Two years later Mottay was promoted to global CISO,

an organisation whose mission is to improve the

and four years later, in September 2022, left to join

overall cybersecurity posture of global multinationals.

her current employer, Zalando, where she says she is “responsible for defining the strategy and leading the

“With these groups, we aim to tackle the hard

execution of the company’s cybersecurity practice,

problems that we all face and support our

including identity and access management and

communities who also face cybersecurity challenges,”

privacy engineering.”

Mottay says. “In addition, I have been on the RSA program committee for years and have built strong

Today Mottay has been working in cybersecurity for

relationships with security professionals, both in the

23 years and says she still really enjoys her work. “I

corporate and government sectors. I also have a few

get up feeling excited about the day. Beyond the field

mentees, internal to Zalando and external, most, but

itself, I enjoy the people I work with: my team, my

not all in cybersecurity.”

peers and the very diverse community at Zalando.”

Mottay has come a long way since being a 16-year-

A MEETING-HEAVY ROLE

old French high school student studying mathematics

Hers is a meeting-heavy role. “On an average day I

on an exchange visit to Florida. “I took a lot of

have over 10 meetings,” she says. “In between, before

chances in my career, rather I should say that my

and after, I do emails and respond to requests I get via

husband and I took a lot of chances in our lives. And

chat. I always break around 6:00 or 6:30 and spend

we regret none of them. Truth is that we will never

time with my family. If needed (which is thankfully not

know what would have happened had we made other

very often) I go back to work after dinner is finished.”

choices. So, we feel blessed with the choices we made and don’t look back.”

Outside of her role at Zalando, Mottay sits on the advisory board of Paladin Capital Group, a global

Mottay acknowledges the role of James Whittaker.

venture capitalist specialising in cybersecurity

“He is the one who got me into security and remains

investments, and is a co-chair of Evanta’s Benelux

a very dear friend of mine” She cites as “sounding

CISO community (Evanta is a Garner subsidiary that

boards and sources of inspiration,” Ben Wishart and

creates and runs communities of C-level executives

Natalie Knight, respectively the CIO and CFO of Ahold

from major organisations). Over the years she has

Delhaize when she worked there, adding “Although I’ve only been at Zalando for a year I have also met fantastic professionals including Meg Greenhouse, a strong female leader who is committed, among other things, to diversity, inclusion and belonging.” www.linkedin.com/company/zalando/about

www.linkedin.com/in/fmottay

30

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

research articles, books and eventually set up my own brainchild – The Cybersecurity Centre of Excellence (CCoE) at our university. I have collaborated with several professionals in this area from across the

Dr Mohuya Chakraborty Director of the Cybersecurity Centre of Excellence at the University of Engineering and Management (UEM) in Kolkata

globe and organised four ethical hacking conferences.

I am happy that I took the initiative towards this venture.”

FOUNDED A CYBERSECURITY CONSULTANCY And she has not stopped there. Three years ago she started her own cybersecurity consultancy. “I have been fortunate to help more than 80 clients in several aspects on cybersecurity such as whitepaper and

P

research paper writing, online course development, hands-on projects, etc,” she says. rofessor Mohuya Chakraborty, newly appointed director of the Cybersecurity

She has also organised several international

Centre of Excellence at the University of

conferences, gaming and coding competitions on

Engineering and Management (UEM) in

cybersecurity and ethical hacking, is a regular blog

Kolkata, India is a highly accomplished

writer/expert opinion provider on LinkedIn and

cybersecurity professional, blockchain expert and

associated with several cybersecurity groups.

the author of two Udemy courses on cybersecurity: Introduction to Ethical Hacking and Computer

And she has received an invitation from the

Networking and A to Z of Cryptography. The centre is

University of Vaasa, Finland to review a PhD thesis on

her creation.

‘Cybersecurity in Healthcare’, which she describes as “an amazing accomplishment in my work.”

Her first degree was in physics, back in 1991 when cybersecurity as a discipline did not really exit. She

Chakraborty’s involvement in cybersecurity spans

followed this with bachelor’s and master’s degrees

many facets of the industry but what excites her

in electrical, electronics and communications

most, she says, is cryptography. “Cryptography is

engineering and a PhD in mobile communications

the heart of cybersecurity, and there is a lot of scope

and computing: her thesis was mobility management

to develop new algorithms.” She adds: “I also like

schemes for 4G mobile wireless networks.

malware analysis through Wireshark.”

Her interest in cybersecurity developed when she

Looking back she credits her husband as being

started teaching networking. “There was a network

one the main influences on her career. “He urged

security module in the course that I liked very much

me to choose this path and is connected to the

because it dealt with various algorithms used in

cybersecurity industry.” She adds: “These days, I have

cryptography,” she says.

a lot more faith in cybersecurity.”

“I then started developing an interest in that and going forward took up certification courses in cybersecurity

www.linkedin.com/in/dr-mohuya-chakraborty-cmgrsmieee-44263456/

and blockchain from the EC Council under Coursera.

I supervised several undergraduate, postgraduate

www.facebook.com/mohuya.chakraborty.3

and doctoral research projects, published several

I S S U E 19

WOMEN IN SECURITY MAGAZINE

31

INTRODUCING OUR

024 2Australian

WOMEN IN SECURITY AWARDS JUDGING PANEL

JOHN TAYLOR Group Executive | CIO | CTO | CISO

MAXINE HARRISON CISO from Department of Energy, Environment and Climate Action

DANIEL GRZELAK Chief Innovation Officer at Plerion

LEANNE FRY CIO at AUSTRAC

CLIVE REEVES Deputy CISO AsiaPac at Telstra

STEPHEN BENNETT Group Chief Information Security Officer at Domino’s Pizza Enterprises Limited

SALESHNI SHARMA

YASO ARUMUGAM

Director, Regional Information Security Officer: AsiaPac at W. R. Berkley Corporation

Assistant Director-General Data and Digital, CIO, CISO at National Archives of Australia

NADIA TAGGART

SARAH LUSCOMBE

CISO at Western Sydney University

Head of Cyber Security at the University of Canberra

ANAFRID BENNET Head - Technology, Security & Property at Greater Western Water

MARYAM BECHTEL Chief Information Security Officer at AGL

LAURA WHELAN Director, Security & Business Continuity at National Indigenous Australians Agency

JACKIE MONTADO Chief Digital and Technology Officer at Wesfarmers Industrial and Safety

PAUL CLARKE Head of Security at Canva

VISIT THE WEBSITE womeninsecurityawards.com.au

®

NIKKI PEEVER Director, Cybersecurity at CAUDIT

ROXANNE PASHAEI Chief Information Security Officer at NSW Rural Fire Service

CRAIG FORD Australian Best-Selling Author | vCISO | AISA Member Board of Directors | Security Journalist

JASON MURRELL Independent Chair CSCAU | Cyber Security Standards Development

DAN MASLIN Group Chief Information Security Officer at Monash University

LYNWEN CONNICK Cyber Security and Technology executive l Chief Information Security Officer | CIO | Advisory Board Member | Mentor | Diversity Advocate

TAMSIN JOWETT ICF Executive Coach & Diversity Consultant at Coaching To Thrive

JANICE LAW Chief Information Security Officer at Services Australia

Nominations ARE OPEN 1ST FEB 2024 TO THE 30TH JUNE 2024

Why Nominate?

To identify rockstars To celebrate ‘hidden’ security superstars To lift and empower the entire company To express admiration for fellow co-workers To pause and express your gratitude To pay it forward - and give back to the community

HOW TO SUBMIT A WINNING NOMINATION TIP #1

TIP #2

TIP #3

Authenticity

Highlight Achievements

Support with Testimonials

First and foremost, be authentic.

When crafting your nomination, share real stories and concrete examples that highlight the nominee's impact in the cybersecurity & protective security field. The more genuine and specific, the better.

Whether it’s groundbreaking projects, leadership roles, or innovative solutions, make sure to showcase the nominee’s outstanding contributions to the industry. Numbers and metrics can add that extra punch!

TIP #4

TIP #5

Emphasise Diversity & Inclusion

Collaboration is Key

Share how the nominee has contributed to creating an inclusive environment in the cybersecurity & protective security sector. Highlight initiatives that promote diversity and equal opportunities.

Collaboration is key.

If you’re part of a team, gather input and insights from your colleagues. They might have unique perspectives on the nominee’s contributions and can help strengthen your nomination.

Gather testimonials. Reach out to colleagues, mentors, or anyone who can provide additional insight into the nominee’s skills and impact. A well-rounded nomination with testimonials adds credibility and depth.

2024

NOMINATE

TODAY

in cybersecurity, watching on the sidelines as attacks escalated in velocity,” she says. “I was motivated to join the battle to help keep our nation safe and protect people and organisations,” she explains.

THE POWER OF PASSION

Heidi Mejia Client Executive at Tesserent

And her passion helped her make the break into cybersecurity. At the interview for her role at Bitdefender Heidi asked why, with neither qualifications nor background experience in IT or cybersecurity, why were they interested in her for the job.

T

“The director who interviewed me could feel my passion and determination to learn and remarked it oday Heidi Mejia is a client executive at

was better to hire someone who is hungry and willing

Tesserent, part of the Thales Australia

to learn than to hire someone with experience, who

cybersecurity solutions group. She

was less motivated to learn,” she explains.

came to the role after a ten-year career as a chef with various Australian

organisations, and a brief stint in cybersecurity sales.

“So, I got my first important break in the industry, was I incredibly grateful for and have never looked back.

When I first started out, I knew I had to start from

Her initial move into sales was from the role of

scratch, which was perfectly fine with me. I prefer

chef, occurred within the same company, an oyster

to work my way up, that way, I can be exposed to

wholesaler. From this, she transitioned to a sales

learning the ins and outs of everything and build a

role with cybersecurity company, Bitdefender, then

solid foundation. I find it makes me more adaptable

to partner development manager before moving to

and flexible. My goal is to be an industry leader in

Tesserent in October 2023.

cybersecurity and in time, I know I will get there,” she enthuses.

The move into cybersecurity, she says, fulfilled a long-held ambition. “I had been keen to work in

To overcome the challenges of diving into

cybersecurity for a long time. … When COVID hit,

a completely new industry, Heidi says she

all the chef roles in the hospitality industry dried

asks lots of questions, keeps reading and

up overnight and I lost all my work as the industry

continuously researching.

complied with mandatory shutdowns. I spotted a vacancy in Bitdefender, a cybersecurity company I

“I always strive to deepen my knowledge and put it

knew about because I had been using their product

into practice. After some time and perseverance, it

for a long time. I took a chance and submitted my

pays off and begins to flow naturally. It is important

application and after four rounds of interviews I got

to work with great people and immerse yourself in

the job.”

a strong team culture under a highly skilled leader— which I’m grateful to have in my past company

34

COVID did more than create the opportunity for Heidi

and here at Tesserent—so you can be supported in

to make the move into cybersecurity, it also provided

your learning and continue to develop and improve,”

the motivation. “COVID really galvanised my interest

she says.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

W H A T ’ S

H E R

J O U R N E Y ?

TESSERENT ROLE

Given Heidi career history it is hardly surprising her

In her role at Tesserent Heidi is helping businesses

advice to anyone aspiring to make a career switch

of all sizes across many sectors—banking

into cybersecurity is simply: go for it.

and finance, healthcare, critical infrastructure, government and retail—stay protected through risk

“Send that resumé or reach out on LinkedIn. You have

management, and helping them be compliant with

nothing to lose by trying,” she recommends. “Don’t

frameworks such as the Essential Eight and the NIST

let your lack of experience or coming from another

Cybersecurity Framework.

industry ever prevent you from giving it a go. Australia has a massive shortage of cybersecurity talent, and

“I benefit daily from being briefed on threat

many organisations are willing to hire and train people

intelligence from our security operations centre

that come from other backgrounds and disciplines.

and our expert advisory team. I make time to read

Start from scratch and be willing to learn and build

every day about what’s new, emerging and trending.

experience, but make sure you leave your ego at

I keep myself informed. I also subscribe to updates

the door. I was a chef, and I made the transition to

from the Australian Financial Review and Australian

cybersecurity, so anyone who is determined can do it,”

Signals Directorate. I attend as many cybersecurity

she stresses.

conferences as possible to hear from the wider industry,” she explains. www.linkedin.com/in/heidimejia

I S S U E 19

WOMEN IN SECURITY MAGAZINE

35

Nalini Jadia Sr Cyber Security Risk Leader

N

alini Jadia is in a senior cyber risk

FROM COSMETOLOGY TO CYBERSECURITY

leader/assessor role at HP in Spring, a

“After completing some courses in cosmetology

suburb of Houston, Texas. She assesses

[the study and application of beauty treatments]

risk related to third-party vendors

and haircare and getting a license, I started a salon

and evaluates their security posture,

offering hair and beauty services, which I continued

because “vendors are the weakest link in the business

for almost 15 years,” she says.

chain.” She says there is never a dull day.

This was not her only career pivot. “One day I met “No risk is like any other: all vendor brings different

one of my customers who inspired me to learn a

scenarios and different challenges. This is what I

foreign language -specifically Japanese, one of

love about this work. Being an avid learner, this is the

the most difficult languages with three different

perfect place for me. With each assessment I learn

scripts. I started my linguistic journey, completed an

something new, and I can use that knowledge when

advanced diploma in Japanese from the Japanese

making other risk assessments.

Language Proficiency Training Institute in Pune, India.

I also gained some certifications from the Japanese

“With a changing risk environment, you are always on

government and started working with a multinational

a learning curve. You can never master it. You have to

company managing a team of 100 translators: their

keep updating your knowledge and horizons.

workload and the quality of their translation services.”

“My day starts mostly at 7:00am and generally

Jadia left this job to join her husband in the US, and

ends at 4:00pm, but it all depends on meetings with

made yet another career change. “After coming to the

stakeholders and vendors. Sometimes, when working

land of opportunities, I decided to go back to school

with the global team, I have to schedule meetings very

and complete my education, as that was a missing

early in the morning and late at night to meet their

part of my life,” she says.

time zones. With a flexible routine, this allows me to adjust my hours accordingly.”

“I went to community college and then joined a bachelor of science course in psychology at the

36

Jadia started her educational journey in India,

Northern Illinois University. I supported myself

studying for a bachelor’s degree in mathematics, but

financially because my husband refused to help me

abandoned this to get married and then took a very

with my school payments. I worked multiple part-time

career different path.

jobs at various beauty salons, on very low wages. I

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

W H A T ’ S

H E R

J O U R N E Y ?

provided translation services in courtrooms, taught

my MIS degree with a grade point average of 3.6

mathematics to kids, did babysitting and more.”

and was awarded a Dean’s Scholarship for Women’s Leadership in IT. This scholarship paid for me to study

Jadia completed her bachelor’s degree with

expensive SAP courses and take the exam. I passed

honours and gained multiple awards in research in

the exam and decided to pursue my career in SAP.

neuropsychology, but her stressful lifestyle caught up

However, getting a job in SAP was a little challenging,

with her.

so I started applying for internships, and got my break at TransUnion [a US consumer credit reporting

A MAJOR SETBACK

agency] in cybersecurity. That opened the door into

“On the last day of my bachelor’s course, I suffered

cybersecurity for me.”

a facial paralysis attack. That was shocking and life-changing, because I was going through some

After completing her internship, Jadia continued

stressful family issues at the same time. I decided

working and studying. “Starting late in my career path,

not to sit and cry over spilt milk but to take command

I never lost my focus, I set some rules to achieve my

of my life and start preparing for the GRE exam [a

desired outcome, and one of them was to get/try for

standardised test that is part of the admissions

every year one new professional certification,” she

process for many graduate schools in the US

says. “Many times, I didn’t pass on the first go, but I

and Canada] which was the requirement for a

never gave up. I achieved some industry-recognised

master’s degree.

certifications such as CISA, CISM, and CTPRP.”

“I took the GRE exam the same day as my divorce

I keep on upgrading my knowledge and expertise.

came through, passed the exam and was admitted

I am currently preparing to learn about AI/ML

to the master’s program in management information

security risks.”

systems (MIS) at Northern Illinois University.

“Every day I taught myself by watching YouTube

www.linkedin.com/in/nalini-jadia-it-infosec

videos about computers and IT-related stuff. I passed

Interested In Working Together?

Data Admin Services

Content

Media

Advertising

Events

Custom

Special Offer!!

New client data admin programs 15% Off

The team at Source2Create has all the necessary skills to get the job done for you, so your time can be reserved to focus on other things.

We can execute anywhere in Australia, reach out today for an instant quote.

I S S U E 19

aby@source2create.com.au

source2create.com.au

charlie@source2create.com.au

WOMEN IN SECURITY MAGAZINE

37

Cheryl Pome’e Digital Security Lead, GRC - ALGIM ICT Professional of the Year 2023

A

t age 17, New Zealander Cheryl Pome’e

On her return from East Timor Cheryl was promoted

was feeling “10 feet tall” and with “a

to lance corporal and sent on leadership courses.

bullet-proof cocky attitude” so she left

These and the five years she spent in the Army, she

school and joined the New Zealand Army

says, have served her well ever since.

as an Information Systems Operator

(ISOP). It proved to be a decision with lasting impacts

“I have never found it hard to land a job after being in

on her life journey.

the Army. It has been a talking point in every interview I have had, even today, more than 10 years on. I

“After completing the Army aptitude test, I was

believe the time I spent and the skills I learned in the

informed, I had the pick of any trade. I remember

Army have been the biggest contribution to my career

joking with the recruiter ‘What pays the most?’ and

in IT and security.”

that is how I fell into IT,” she says.

DIGITAL SECURITY LEAD It was not an easy path she had chosen. “My first

Today, Cheryl is the Digital Security Lead with

years in the Army were hard and grueling, not only

Tauranga City Council. This is her first official

was I learning how to be a soldier, but I was also

cybersecurity title after a string of IT roles held since

learning IT system engineering,” she says. “IT did

leaving the Army. “Security was built into everything I

not come naturally to me. I was more of the sporty,

did in the Army,” she says. “I have carried that through

outdoorsy type and had not completed any computer

into all my roles since. Although I wouldn’t officially

subjects in school.”

step into a security role until 10 years after the Army.

I was always drawn to security,quite often security

Eventually, everything clicked into place and Cheryl

was a part of my IT roles, also I consulted on security

was put in charge of a team preparing ISOPs for

during some customer projects.”

overseas deployment. She was deployed in 2009,

38

spending nine months in East Timor, where “my boss

Cheryl did not study computing at school and without

who had worked in the private sector before joining

that background, her IT career in the Army did not get

the Army, taught me about customer service. This

off to a good start. “There was a point in my first year

helped me to improve my communication skills and

in the Army when we were learning networking, I was

handling requests.”

failing big time. I could not for the life of me get my

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

W H A T ’ S

H E R

J O U R N E Y ?

head around networking. I was even asked if I should

you,” she says. And on the question of job interviews:

consider changing trades. If I had learned computer

“It is important that when they ask you ‘Do you have

networking in school, I would never have had to

any questions for me?’, you take the opportunity.

struggle as much as I did,” she says.

You are interviewing them as much as they are interviewing you. I always ensure I have questions

She also confesses to missing out on what would

lined up and if questions pop into mind during the

have been other useful school learnings. “High school

interview I add them to the list.”

English covers a lot of the areas that are a huge benefit to security roles. I did take English at high

Good culture, Cheryl says, is essential, and fear of

school, but I was not serious about it.”

failure does not make for a good culture. “Whenever I am implementing change, I always start the

To compensate she took a professional and technical

conversation with ‘We are doing something new, we

writing course with an online polytechnic some years

might fail, but we will learn and adjust’,” she says. “I

ago, which “has been extremely helpful with reports,

have worked in teams where failure was feared. I have

policies, standards, and communication emails.”

for the most part been able to change this culture.

One team I was in, I was unable to change the culture.

And, she says, “Debating was an extra-curricular at

It made working difficult, people were stressed, and

my high school, but something I chose not to do.

work was slow, very slow. People can create a good

Debating teaches skills like critical thinking, analytics,

culture, but managers are the ones that can entrench

and how to get your point across. Analysing complex

it into the team.”

security issues, persuasiveness and effective communication are skills I use daily in my current

Today Cheryl is responsible for training staff in

role. I have learned these skills over time throughout

security and awareness of cybersecurity risks.

my career, but it would have been handy to have

“Having a great security training and awareness

debating skills prior.”

program ensures that people have security front of mind and security is incorporated into everything they

She also stresses the importance of both verbal and

do,” she says.

written communication skills for anyone wanting a career in cybersecurity. “In an incident, you need to

“For me, Cybersecurity training and awareness is very

effectively communicate your findings or translate the

important. The stronger your people are the better

technical information for executives. Report writing

protected you are from attacks. It is fun coming

is something no cybersecurity role can escape.

up with friendly phishing email simulations. I find

Information in reports needs to be clear and readable

people love the challenge and we see great learning

to the intended audience. Cybersecurity professionals

outcomes. People will often message me saying

quite often attend meetings where they will be

something like ‘You will have to do better next time!’

required to articulate cybersecurity recommendations,

or ‘Oh no, you are sneaky!’”

requirements, or changes. Having the ability to communicate effectively and clearly is very valuable.”

“Last year I was fortunate to be able to organise a Cyber Smart Week. There were cybersecurity

AN EXPERIENCED INTERVIEWEE

presentations, music, and games. We even had a

Cheryl has held more than a dozen IT or security roles

cybersecurity song written and played it for everyone.

since leaving the army, so has plenty of experience

People got really into it, I cannot wait to run another

with interviews management styles, managers’

again this year.

personalities, and company cultures. In her view, there is no getting around a bad manager. “I am a firm

“After creating and updating a policy or standard,

believer that your manager will make you or break

I need to ensure the teams directly affected are

I S S U E 19

WOMEN IN SECURITY MAGAZINE

39

aware and they update their processes/procedures

“We love going on family holidays, so I always ensure

to meet the policy or standard. I conduct workshops

we have a trip planned. Having a trip always coming

with teams, which allows them to come along on

has been instrumental in keeping me sane. Last year

the journey and discuss ideas and let me know what

we went to Disney World, which the kids absolutely

issues they might face.”

loved, and so did us parents.” And she has returned to a teenage passion: karate. “I use karate to force me

A FAMILY AFFAIR

to finish work on time, I do not want to miss a class

With two children and both Cheryl and her husband

and I am extremely motivated because my Sensei

holding full-time jobs in cybersecurity—she says they

has asked me to grade for my Black Belt in Okinawa,

have “fun debates”— Cheryl finds balancing work and

Japan in September. Karate has been a great outlet

family life a challenge.

for frustrations, and for strengthening my mind.”

“I struggled for a long time and often put work before

www.linkedin.com/in/cherylpomee

my family. My attitude today has changed, family is forever, a job is just for now. I have no issues now with taking time off work and attending my kids’ school trips, plays, and prize-giving’s. Spending quality time with my kids is important. It’s not about being in the house together. It is about going on adventures and creating memories they can look back on.

40

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

College to encourage pupils from a diverse range of backgrounds to apply for places in the UK’s top universities.

LINGUISTICS AT OXFORD Mohanaprakas chose to apply for a place at the University of Oxford studying linguistics and

Ash Mohanaprakas Head of Information Security at Vault Platform

Portuguese, because of Portugal’s involvement as a colonial power in India: she was “curious about how the Portuguese maritime engagements in India would be portrayed by Portuguese authors.”

By the time she graduated Mohanaprakas had

A

already become a mother, at age 20. After dabbling in multiple disciplines during her university years, s a child growing up in India, Ash

including writing about cultural issues in a community

Mohanaprakas learnt English, but it did

newsletter and working as a costume designer/

little to prepare her for life in the East

assistant director on a movie portraying life in the UK

London suburb of Newham at age 11,

for immigrants from South Asia, she took an admin/

which was a melting pot of ethnicities

database role with one the University of Oxford’s

and accents.

Philanthropic functions.

“I felt like each person spoke an entirely different

“This was really where I saw the benefits of my

language as I tried to figure out simple terms like

training in linguistics and languages,” she says. “I

‘bottle’ and ‘water’ in what felt like a super-fast stream

quickly got to grips with HTML because it was, in

of speech,” she says.

essence, another language. I very much enjoyed understanding the relational databases underpinning

Her response was to relearn English in much the

the relationship management and fundraising ERP

same way as she was learning French and German in

system we used, and I progressed quickly to a

school: writing down words she did not understand,

process and training role.”

looking these up in a dictionary and “reading books all the way from nursery rhymes upwards.”

“I found myself enjoying implementing efficiencies in how we did things, and I picked up a TAP Training

Mohanaprakas clearly had a gift for languages, and

Academy qualification to help me design, develop and

much else: she took the French GCSE exam in year

deliver online and in-person training for the tool which

nine along with native French speakers. She went on

supported the £120m plus annual fundraising targets

to achieve the top grades in her school with seven

for the university’s philanthropic functions, the largest

A*s and 4As, including German, Spanish, and French.

higher education charity outside of the US.”

She then went on to gain advanced level Mathematics (A), Media Studies (A*), English Language (A*) and

At around this time the European General Data

Drama (AS-Level).

Protection Regulation (GDPR) was coming into force and the UK’s regulator had introduced the

As a result of her academic performance she was

Fundraising Preference Service to enable individuals

put forward to participate in a program for gifted

to block direct marketing communications from

and talented children that later became OxNET,

named charities they no longer wanted to hear from.

a service run by Oxford University’s Pembroke

Mohanaprakas became involved in the analysis and

I S S U E 19

WOMEN IN SECURITY MAGAZINE

41

design of an ERP tool to enable the charity to comply

explains. “Whilst the University offered excellent work-

with its requirements, and this, she says, marked a

life balance, I wanted to work in a more meritocratic

turning point in her career, setting her on the path

environment where I could see the impact of the

towards a regulatory role.

changes I had initiated within a shorter time frame.”

A GRC ROLE

HEAD OF INFORMATION SECURITY

She saw a governance, risk and compliance job

So, Mohanaprakas got a job as head of information

advertised at the University of Oxford, applied and

security with Perspectum—a startup medical

was hired in an underfill capacity for a year. And this,

technology company spun out from Oxford

she says, is when the possibility of career in security

University—where she was responsible for securing

first arose.

personally identifiable information and the security of diagnostic software. “Here, I felt I was properly in

“I never initially thought of a career in cybersecurity.

security, as my previous role had a bigger governance

I was candid with my CISO on why I saw myself in

focus, and wasn’t as technical in terms of hands-on

security. It was mostly because I wanted to gain

operations,” she says.

a deeper understanding about how organisations worked. Security seemed to be at the heart of all

Mohanaprakas stayed with Perspectum for three

organisational functions and activities, and I saw

years before moving to a cybersecurity consulting

this as an opportunity to understand better how

role with Bridewell, a cybersecurity services company

organisations run and succeed.”

that specialises in protecting critical national infrastructure organisations. She stayed for only a

Her main role was “to get past the National Health

year during which time she progressed from a senior

Services’ digital red tape to enable patient data to be

consultant to a senior lead consultant, managing up

used for research purpose,” she says. “This allowed

to five other consultants and contributing to the sales

me to work with a range of top academics within the

conversations as well as services to enterprises and

university and support them with secure research

government. However, there was a downside.

data management and manage stakeholders to ensure their departmental and divisional security risks

“While I thoroughly enjoyed consulting, I was also

were understood and managed effectively.”

exposed to the challenges faced by an ambitious woman from an ethnic minority in cybersecurity. All

During this time Mohanaprakas gained CISMP

the stereotypical attitudes, the pay gap and lack of

certification, completed the Open University course

recognition were real issues for me. I realised that

in cybersecurity and gained a PCI DSS qualification.

one of my core strengths is in getting things done

After two years she was in search of new challenges.

well. I was able to build a good reputation within the company and with clients.

“I realised I needed to experience the private sector in my twenties while I had the energy for it,” she

“What I enjoyed less was the underlying feeling of fighting against my peers to get that next promotion, and while I enjoyed the competitiveness to do better, I did not enjoy the reality of race, gender, or perceived ‘experience’ contributing to that decision, as opposed to evidence of achievements being the deciding factor.”

Mohanaprakas’ search for a better working environment led her to her current employer, Vault Platform, which she describes as “an impact-led tech

42

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

W H A T ’ S

H E R

J O U R N E Y ?

startup, bringing innovative digital solutions to the

of the tool has really helped me improve and change

problem of unreported misconduct and ESG violations

the traditional perception of security as a blocker,”

in the workplace.” She is head of information security.

she says.

JOINING A MISSION-LED STARTUP

“On a typical day, I could be doing new employee

“Vault Platform stood out to me as it’s a mission-

onboarding and their IT set up, or articulating

led tech start-up that was very mindful of the tech

risks as part of the product/ feature development

culture and has endeavoured to create a positive

processes, investigating vulnerabilities and suspected

working environment,” she says. “I have been enjoying

incidents, or having risk-based discussions with

working with the leadership and wider team to

key stakeholders.

implement good controls and demonstrate Vault’s maturity to customers from a security standpoint.

“I believe my problem solving and relationship

It is challenging being the only IT/security person,

management skills play a key role in helping me

but the work culture, the conscientious approach to

succeed in my current role. Working with stakeholders

expansion and investment in people have all been

of different seniority and expertise, it’s essential

green flags.”

decisions are risk-informed and pragmatic whilst we maintain the high standards we aim to achieve.”

She been here for almost a year and has led the security and compliance program for Vault, including

“My husband has been a pillar of strength through

ISO 27001 and SOC 2 Type II attestations. “As the only

and through in realising my ambitions and going

security resource, I get involved in a range of activities

after them.”

across the company. I work with finance, ops and legal to ensure our operational security policies and

Outside of her day job Mohanaprakas is a member

processes are carried out effectively,” she says.

of Oxfordshire regional CISOs network and of the Inclusive InCyber women’s network, mentors

“I also work closely with the engineering and tech

cybersecurity students in the UK and India and is a

functions to ensure the product we’re bringing

committee member of SADAH.org, a charity working

to the market is enterprise-ready, with security

to support South Asians manage their diabetes

baked in from the very beginning of each project.

long term.

I also work with marketing to ensure the security requirements our customers expect their vendors to

“I have been able to offer my skills and understanding

have are accurately understood and demonstrated

of the fundraising regulations and good governance to

in our external-facing content. I also ensure new

ensure the charity is set to succeed and has mature

requirements are understood and fed back into the

processes for handling of personal and sensitive

organisation for improving our solutions.”

information,” she says.

Over the past year, Mohanaprakas says a key focus

Looking to the future Mohanaprakas is eying a

has been the implementation of proactive security

business leadership role and perhaps gaining an

controls and a risk management framework for

MBA, “not very cybersecurity focused, but I think it’ll

facilitating key decision-making at Vault.

be valuable in navigating leadership and elements of wider organisational challenges,” she says. She also

“Working for an early-stage startup, I am constantly

plans on tackling CISSP/CISA/ CISM at some point in

challenged to be as lean as possible whilst not

the future.

compromising the value, and maximising resources.

Demonstrating the value of having the right tools and processes that work for the company, ensuring that

www.linkedin.com/in/amohanaprakas

controls do not compromise on the user experience

I S S U E 19

WOMEN IN SECURITY MAGAZINE

43

Your Success Copywriting

Lead Generation

Content Creation

Social Media

Podcasts

Data Admin Services

Telema

LET US HELP YOU AN

AN EXTENSION

CONTACT US

charlie@source2create.com.au | 0452 588 406

OR

is Our Priority Events

arketing

Speaker Acquisition

Event Management

Strategy

Website Creation

Custom Projects

ND WE WILL BECOME

OF YOUR TEAM

aby@source2create.com.au | 0415 500 580 | linkedin.com/in/abigail-swabey-95145312

CRAIG FORD Head Unicorn – Cofounder and Executive Director, Cyber Unicorns. Australian Best Selling Author of A Hacker I Am, Foresight and The Shadow World book series. vCISO – Hungry Jacks, Wesley Mission, PCYC, Baidam Solutions and Ipswich City Council.

Member of the Board of Directors – AISA (Australian Information Security Association).

C O L U M N

Who should be in cybersecurity?

Who should be in cybersecurity is the theme of this

forgiving of mistakes. That said, we should all be

edition of Women in Security magazine. It’s a question

allowed to make mistakes. We are human, after all.

that perplexes me a little. I am a massive believer in

However, it is a reality that when an incident occurs it’s

diversity and inclusion, as many of you would know

a pile-on. The industry condemns the poor people doing

if you have read any of my previous articles in this

their best, working ridiculous hours trying to minimise

magazine, or any of my books. Knowing that you

the impact of an incident. We should be getting behind

might think I would answer “everyone.”

them, helping them recover and allowing them (and us) to learn from what has occurred.

On really thinking about the question though, that’s not the case. Now, before you jump to a negative

I got a little sidetracked, so let’s get back to the

conclusion as to the direction I am heading with this,

question of who should be in cybersecurity. Everyone

let’s break it down a little.

and no one. It is not my decision, it’s yours. It’s your life and your choice. You need to walk your own path,

Cybersecurity is important. It’s complicated and a

not mine or anyone else’s.

person needs many years’ experience before they can consider calling themselves an expert. No one in this

Once you have made that decision, the industry’s

industry knows everything. I certainly don’t. There is

responsibility is to make you feel welcome, to allow

probably more I do not know than what I know. That is

you to do your best, and become a valuable contributor

the nature of cybersecurity. There are so many different

to this battle we are all waging to keep the malicious

paths you can take, so many different skill sets, some

hordes at bay, to keep the lights on and businesses

of which will fit you better than others. It’s complicated.

running, to not judge people on their appearance, their culture and what experience they have.

That’s evident from the never-ending stream of data breaches and cybersecurity incidents. It’s hard to

If we are open to allowing everyone an opportunity we

get security right. And you can’t stop a zero-day

may be surprised at just how great this industry can

vulnerability from being exploited if you are not

be, and the extent to which the diversity of our teams

aware of it and have no idea how you might protect

can produce the out-of-the-box thinking we need if we

your organisation from it. There are no silver bullets.

are to succeed.

Cybersecurity is all about reducing your risks and trying to get things right from the start.

So, make your choice. Once you do, I will be here to help make the industry as welcoming as possible.

I know that’s not answering the question as to who should be in cybersecurity, but I don’t think I should.

I think it is up every individual to decide whether cybersecurity is the right place for them. If you are considering a career in cybersecurity I believe you should ask yourself one question: how badly do I want to work in cybersecurity?

Why? Because it’s hard, it’s stressful and it is an

www.linkedin.com/in/craig-ford-cybersecurity

www.facebook.com/AHackerIam

twitter.com/CraigFord_Cyber

www.cyberunicorns.com.au

industry that is neither easy to get into nor very

46

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

Want to get matched with Lead Gen experts but dont know where to start?

Our solution experts can help you find the right supplier, Looking to streamline your B2B lead generation process?

Want to use multiple suppliers but dont have time to coordinate?

Need a consistent stream of leads coming into the sales team?

Looking to tap into new markets?

Need end-to-end lead nurture programs?

LET US HELP YOU OVERCOME YOUR LEAD GEN CHALLENGES REACH OUT TODAY FOR AN INSTANT QUOTE. The team at Source2Create has all the necessary skills to get the job done for you, so your time can be reserved to focus on other things.

With:

aby@source2create.com.au charlie@source2create.com.au source2create.com.au

INDUSTRY PERSPECTIVES

SASHA MULLINS

NAVIGATING ADHD: THE UNFINISHED TALE OF HOW I FELL INTO CYBER SECURITY

by Sasha Mullins, Strategy & Risk Consulting, CyberCX

Bear with me on this, it wasn’t exactly a straightforward journey. Now that I think about it, it wasn’t straightforward at all. I have many people who can attest to that. ‘Many’ being… Well, everyone in my life, I guess.

Though, actually only ‘some’ of ‘everyone’ picked up that I was truly different.

W

ell, no. For the most part they

I guess my ADHD could be described as a version of

knew I was different, but more in a

ChatGPT, except with all the functionalities you did

“oh my gosh Sasha can you please

not ask for:

remember for once…” kind of way, rather than a “oh your brain is a bit

spicy” realisation.

your question.

• Interrupts everything you say.

Wait, is it ‘bear with me’ or ‘bare with me’? This is

• Loses train of thought mid-sentence.

getting confusing. I’ve lost the point. Let me start

• Answers every question with a story that has at

over. Plain and simple, I was diagnosed with ADHD at the age of 24, which wasn’t so long ago.

50

• Takes 5-10 business days to respond to

W O M E N I N S E C U R I T Y M A G A Z I N E

least 10 sub-plots.

• Tries to befriend you the moment you say anything.

M A R C H • A P R I L 2024

F E A T U R E

• Will shut down if your ‘vibe’ is off.

On a final note, before I share my tale, I’d like to highlight that it may feel a bit unstructured at times,

Interestingly though, a lot of the story I am about to

or occasionally repetitive with the phrasing (welcome

tell I wrote before I was diagnosed. And, throughout

to my brain). Let’s remember I had complete control

the tale you may notice I don’t talk to all of the things

over the words on the page, but these were genuine

associated with ADHD. You see, even though I wrote

moments where my mind trailed (well, a summarised

the story only a few months before my diagnosis, I

version). I wanted to give some indication of what

still had not fully comprehended what ADHD meant.

that looks like.

So, when I was experiencing things like insomnia, time-blindness, lack of object permanence, rejection

So, without further ado, here is a little bit of insight

sensitivity and more, I didn’t understand that these

into my neurodiverse journey into cyber security:

could all be tied back to the way my brain worked.

What’s more, even though it felt etched into my skin,

I attended an all-girl secondary school where

my being, my entire self, it wasn’t until it was sketched

‘technology’ was predominantly food, sewing or

onto a piece of paper that I could confidently say OK,

design related. So, though my introduction to

this is 100 percent me.

cybersecurity did not start here, my journey did.

I would say I became self-aware about two years ago,

I struggled in school, and I mean really struggled.

but my self-awareness took a while to come to terms

The sciences, maths and business subjects made

with (and remember), and then it took another year to

me feel incredibly incompetent. Noise would crowd

go through the actual ‘process’ of getting diagnosed.

the air as my peers and I would fumble to our seats. I

It should not take a year. However, the way this

did not know it at the time, but those moments were

process is set up makes being on the receiving end

my safe space. Like clockwork everyone in the room

of it feel as if they took all the ingredients of ADHD,

would mechanically switch to focus mode. I didn’t

mixed them in a pot, and served them on a plate that

understand it, I could never do it and, as a result, I felt

says “F*** You”.

so alone. My brain didn’t work that way. So much of my education went a bit like this:

But now that I have it (the piece of paper, not ADHD – let’s be clear I always had that), I would like to

Always told to stop talking.

share the ‘story’ I wrote post self-awareness but prediagnosis. As a bit of a disclaimer, I don’t consider

Always told to start listening.

myself an experienced writer, nor an adequate one.

My writing this piece was merely an outlet and a fixation during a time of confusion and isolation. So, I apologise for any deeply blue undertones.

You see, I thought if I could try to tug out some of the million words screaming from all corners of my brain and put them onto paper, maybe the noise would dim just a little. And, while the volume always remained at max, at least it was a somewhat healthy hyperfocus; just one of the key traits of my spicy brain.

I S S U E 19

WOMEN IN SECURITY MAGAZINE

51

Always told to stop distracting.

future lawyers, doctors, accountants, scientists and so on. Where the hell did that come from? It felt like

Always told.

everyone was called to a meeting that I wasn’t invited to. Seriously though, was it their parents channelling

Always stopped.

through them, or did they genuinely wake up one day with a sudden urge to pay their taxes?

Always. Always. Always.

I woke up with songs in my head, never goals, never Always sitting there in the silence that felt so loud,

plans. I still wake up with songs in my head. Doesn’t

peering through a teacher’s words to try to cancel out

everyone? Which part of the brain even triggers that?

the voices playing in my head. A sickening remix of uncontrollable sounds: elevator music, a song I heard

Sorry, off topic. Where was I.

once three years ago, a list of things on my to-do list, a list of things I wanted to say, a list of conversations

The school naturally provided students with a career

replaying over and over, things that were funny, things

path based on their subjects. However, mine were

that weren’t appropriate, words that tickled a certain

a bit of a mixed bag. I switched between calculus,

part of the brain: these things were always on repeat.

performing arts, statistics, chemistry, history, English and media studies.

Always. Always. Always.

But having a broad range of subjects was strategic to So, yes, I struggled in school. And if it weren’t for the

me. I couldn’t set myself a path if I didn’t know what

creative subjects I don’t know where I would be today.

it was. So, it was smart. It was the right decision. No,

I enjoyed things like performing arts, English and

stop, wait. Why the hell did I do chemistry?

media studies and, for the most part, I understood them. Not that I always excelled in them. You see the

Anyway, I legitimately convinced myself at one

curriculum enforces a strict set of deadlines which

point that the reason I could not see my future was

felt like an everlasting battle, and I wasn’t winning.

because I didn’t have one. It put me in such a dark

It sewed a cloak of stigma to my personality that

place. How was I supposed to get out of it? After

I couldn’t seem to un-weave no matter how

all, I am a procrastinator, I am lazy, I am

much I tried. Procrastinator, lazy, unmotivated,

unmotivated, I am unsuccessful. And you

unsuccessful, “would do better if she stopped

know what? Maybe if I just stopped f*****

f**** talking for once and paid attention

talking for once and paid attention more,

more often.”

I could do better. But that’s not me.

A few of those words I could read in my

University was a somewhat compulsory next

teacher’s eyes. I don’t blame them; I must

step in my journey. And, while I recognise

have been an incredibly challenging student. But I just wish they could have seen I was trying.

this was a privilege I should have been extremely grateful for, at a time when I could not picture a career, approaching a degree felt nothing

When high school was coming

but daunting. Everyone around

towards its end I was shocked

me attempted to take on the

that so many around me could articulate their career

52

role of a career guide as I sat through conversation

plans clearly. I was

after conversation about

suddenly surrounded by

my skills (limited), my

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

F E A T U R E

passions (useless) and my goals (non-existent). The

paranoia set in that I would fail my courses, become

result was marketing and psychology. Sophisticated

the dropout my teachers expected me to be and

enough to sound exciting, broad enough to maybe

amount to nothing. I was always trying to change

enable me to make it somewhere in the world. I can

the outcomes of my grades but as much as I tried,

only assume that is what my family were thinking

I couldn’t. I would procrastinate. I was lazy, I was

when they chose those degrees for me.

unmotivated and I could never be successful. And maybe I would do better if I just stopped f**** talking

I wanted to see the silver lining though. This was a

for once and paid attention.

chance to make new friends in a new city and that is exactly what it became. I set sail for windy Wellington,

You do this every time. You always mess up.

moved into the halls of residency and almost drank myself into a coma every weekend.

Always. Always. Always.

It was bliss.

Always sending myself into an avoidant state of mind, shoving everything that matters into a ticking

For a while it didn’t matter that I wasn’t considered

time bomb of chaos. Always wondering if I have

academically smart, because I was good with people.

disappointed people I care for. Always fixating on

I always have been. I grew up in a social family with

everyone’s expectations. I needed help.

lots of cousins and friends, and mum was an absolute social butterfly, plus her and my dad are both in sales.

Please, I needed help.

Thanks to them, I had the gift of the gab. And for a

My emotions have always been extremely

while there I was truly happy, on a high streak. But

unpredictable and difficult to control. Everything:

the rush can last for only so long, and eventually the

happiness, sadness, stress and love, they’re all

I S S U E 19

WOMEN IN SECURITY MAGAZINE

53

intensified, and they come in waves. Subsequently,

Now, just as a side note, I have this habit of making

when I feel lost, it can be difficult to see the other side.

whatever I’m doing at any point in time my entire personality. In high school it was largely performing

In this case it was my siblings who reached out to me

arts, in university it was tutoring, and as time went

in my attempt to reach sanity. My brother suggested

on it became cyber security. But I’m jumping ahead.

I should look at information systems. It was a

Tutoring had its challenges, but it was the first time I

mandatory course for my commerce degree anyway.

felt I was around people who saw me academically,

So, what did I have to lose? There was an assignment

and I mean truly saw me. Don’t get me wrong, they

which involved introductory coding, and I can honestly

could still see I was a procrastinator, but they never

say I have never experienced hyper-focusing to that

saw me as unmotivated or unsuccessful, and I had a

level in my entire life. I excelled, and I enjoyed every

probably quite annoying but fascinating trait: I never

moment of it.

stopped talking. I felt at home with people who were very different from me.

This was it. This was me.

I think what most surprised me during this time Following that semester I changed my degree, and

was how much finding something I was passionate

by this point I had also dropped psychology. I have

about would influence the other components of

a lot of respect for people who enjoy statistics, I am

my everyday life. All of a sudden, I could see I was

not one.

capable of achieving higher grades, and higher grades soon became the standard across all my courses,

Okay, off topic once again. Back to the story.

even the ones I wasn’t necessarily passionate about.

Tutoring not only increased my confidence, but for the

54

I was greatly inspired by the impact the course had

first time ever in my education, I had a slight grasp

on me, and I wanted to create that experience for

on time itself. You know that feeling of untangling

others. I’m not going to sugar-coat this though, I also

headphones? That is what it felt like. The intertwined

desperately needed money. Hence, I applied to be a

lanes of tasks and deadlines became less jumbled,

tutor for the course in the following semester.

less noisy, less overwhelming. I could do this.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

F E A T U R E

I had many achievements toward the end of my

challenges, there is so much joy in having a not-so-

degree: the top tutor award for the university, the

typical brain.

dean’s list for both my BA and BCom degrees, the top performing student in my information systems course

Look, I’m not here to tell you that I have completely

in (drum roll please) …. cyber security!

solved the challenge of being neurodiverse in the workplace. I still find myself working twice as hard

I know, about time we got here.

just to achieve simple things like ‘time management’, when the reality is that I do not have a concept of time

From landing an internship with one of the banks to

itself. But what I can tell you is that cyber security

working fulltime in its cyber security team, to then

played a big role in helping me recognise the power

working at a cyber security-focused organisation,

that comes with ADHD. My superpowers: creativity,

my world has forever changed (for the better if that

confidence, hyper-focusing, intuition, positivity, a big

wasn’t clear). It’s a diverse, fast-paced environment

picture mindset, and more. You know what? ChatGPT

where no two days are the same. And, with so much

wishes it had ADHD.

innovation and creativity across the industry, I finally have the ability to work with my brain, rather than

Okay, maybe not so much.

against it. But ultimately this would be nothing without the people along the way. Throughout every

What I am trying to say is that, while I may have a not-

part of my cyber security adventure, there…

so-typical brain, cyber security is a not-so-typical kind of job, and that makes us a perfect pair. Perhaps if

Well, I’m sure that sentence was going to be

you are reading this as a fellow spicy brainer, or you’re

absolutely great, but sadly that seems to be the point

just someone who is a little unsure about your path,

where I got distracted by something else and forgot

cyber security could be a match for you too.

the story existed. However, I can make a guess that I was going to highlight my appreciation for the people

Now, it is time I wrap this up, but before I sign off, I

in my life. And wow, no wonder I stopped typing.

would like to say a few final words:

Where do I even begin to describe how much love and admiration I have for so many people around

I am not a procrastinator.

me? I wouldn’t be where I am today without them.

My inspiring family and friends both inside and out

I am not lazy.

of work who love and support me every day, and my partner in crime who I am so grateful for. I am so

I am extremely motivated.

incredibly fortunate.

I am successful.

I want to re-iterate that this story was written during a darker time of my life. You see, when you start to

I will never stop f**** talking.

realise that every single habit, tendency, behaviour, thought process can be tied back to one simple

Pay attention because that is me.

thing, it’s easy to spiral. And, when the spiral takes over, sometimes it can feel impossible to hold onto the good.

www.linkedin.com/in/sasha-mullins-335325a3

In all honesty it feels weird to think there was ever a time when ADHD was not a concept used in my everyday life. But I am also only at the beginning of my journey, and I have to say, through all the

I S S U E 19

WOMEN IN SECURITY MAGAZINE

55

POOJA SHIMPI

WHO GETS A SEAT AT THE TABLE?

by Pooja Shimpi, Founder & CEO, SyberNow | We specialise in Security Awareness to Mindfulness Trainings for corporates

“Having a seat at the table” symbolises influence,

proficiency, strategic thinking and continuous

decision-making power and a voice in shaping the

learning. The increased diversity she brings to that

trajectory of an organisation.

board will make it more resilient, more inclusive and more forward thinking.

Ground-breaking New York congressperson Congress—told us back in the 1970: “If they don’t give

WHAT DO YOU DO TO GET A SEAT AT THE TABLE?

you a seat at the table, bring a folding chair.” It was an

There are many factors that determine who earns a

inspirational statement from a legendary woman. It is

place in the boardroom.

Shirley Chisholm—the first black woman elected to

also very instructional, and a critical piece of advice I, as a woman in cybersecurity, can truly relate to it.

Understand the relationship between actions and titles

According to ISC2’s most recent survey, women

First and foremost, let’s bust the myth that you need

hold only 25 percent of cybersecurity roles. Female

to be very senior to earn a seat at the table.

representation in cybersecurity is growing, but there is a long way to go. One of the most significant factors

Titles don’t make you a leader. Your leadership

influencing boardroom dynamics is gender disparity.

standing is determined by the steps you take.

Despite strides made in recent years to promote

Numerous individuals manage to earn a seat at the

diversity and inclusion, women in cybersecurity

table, despite job titles that do not accurately reflect

remain underrepresented in boardrooms globally.

their position in the hierarchy. In a previous role I secured my place in that organisation’s hierarchy by

56

WHAT DOES IT REALLY MEAN TO GET A SEAT AT THE TABLE?

thinking strategically, articulating my perspectives

When a woman breaks through the gender barrier and

strategic vision and mission, despite not having a

gains a board seat she has demonstrated technical

board position or a senior role.

W O M E N I N S E C U R I T Y M A G A Z I N E

effectively and aligning with the organisation’s

M A R C H • A P R I L 2024

I N D U S T R Y

P E R S P E C T I V E S

Make sure you are heard

consequences of cyber threats to stakeholders

Ensure your voice is heard by strategically inserting

and making informed decisions that align with

yourself into conversations. Balance spontaneity with

organisational objectives.

preparation; don’t rely on unprepared improvisation.

Research and develop your perspectives and

Ethical considerations

talking points. Embrace disagreement and commit

Today, when cybersecurity decisions have far-

to your stance. Avoid the need to be always right.

reaching ethical implications, leaders who prioritise

Constant insistence on correctness does not

ethical considerations are increasingly valued.

make for effective communication; it may, in fact,

Individuals who understand the importance of

demonstrate ignorance.

privacy, transparency and the responsible use of technology contribute to a cybersecurity strategy

Strategic thinkers

that both protects the organisation and upholds its

Cybersecurity requires more than tactical responses

ethical standards.

to address weaknesses and mitigate threats: it’s a strategic necessity. Individuals who can think

Commitment to continuous learning

strategically about cybersecurity risks and align them

In the fast-paced world of cybersecurity, staying

with broader business goals are increasingly sought

ahead of the curve is essential. Those who exhibit a

after in the boardroom. The ability to understand

commitment to continuous learning and who adapt

the business impact of cybersecurity decisions, risk

to emerging threats are highly valued. Cybersecurity

management and the integration of cybersecurity into

professionals who engage in ongoing education,

overall business strategy is essential.

attend conferences, obtain certifications and actively seek out the latest developments in the field

Strategic thinkers in cybersecurity are adept

demonstrate the agility to navigate the ever- changing

at translating technical jargon into business

cyber landscape.

language, effectively communicating the potential

I S S U E 19

WOMEN IN SECURITY MAGAZINE

57

You must be a people person

relationships with experienced cybersecurity

Developing strong connections with the people in

professionals can provide valuable guidance and

your organisation will go a long way towards gaining

insights, helping women navigate the complexities of

you a seat at the table. Keep your eyes and ears open.

the field and make informed career decisions.

Do floor walks to understand people’s concerns.

GO FOR IT! People face multiple cyber threats every day of

You need to be focused on yourself and on the

their lives. Understanding psychology is crucial

priorities in your personal and professional life, and

to empathising with employees and what they go

not be distracted by external events such as office

through when they become victims of cybercrime.

politics, social media, etc. Fear of missing out (FoMo) is a powerful lure. Unfortunately, it causes you to

Communication and stakeholders

focus on issues that can be detrimental to your

management skills

success, and prevents you focusing on issues that

Effective communication is a cornerstone of success

are important.

in any leadership role. It is essential to hone your communication skills so you can convey complex

Doing the above helped me gain a seat at the table

technical information in a clear and concise manner.

and I am sure it will help you too!

The ability to articulate cybersecurity risks, strategies and solutions to both technical and non-technical

In 2023, I took a Leap of Faith. To start my

stakeholders is crucial for fostering collaboration and

entrepreneurial journey in cybersecurity in India.

gaining support for cybersecurity initiatives.

With many things running through my mind then, I Building strong relationships with stakeholders

decided it’s time to do something better and bigger

is equally critical. Leaders who can articulate the

than what I was doing in my various job roles. Hence,

business value of cybersecurity initiatives and engage

I founded SyberNow with a Mission to “Make Every

stakeholders in meaningful conversations are well-

Human the Strongest Defense against cybercrime.”

positioned to secure and retain their seat.

We go beyond awareness, guiding individuals towards Networking and mentorship

mindfulness. A mindful individual not only protects

Building a strong professional network is essential

themselves and their family but also strengthens the

for anyone aspiring to reach a leadership role

entire organisation’s cybersecurity.

in cybersecurity. Attend industry events, join cybersecurity organisations and engage with professionals both online and offline. Mentorship

www.linkedin.com/in/poojashimpi

sybernow.com/services

58

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

JO STEWART-RATTRAY

MANAGING AI BIAS AND THE VITAL NEED FOR UPSKILLING AND RESKILLING IN TECHNOLOGY: OUR INDUSTRY DEPENDS ON IT

by Jo Stewart-Rattray, Oceania Ambassador at ISACA

In recent years AI has manifested in various forms,

AI’s rapidly growing capabilities represent a double-

from smart speakers to sophisticated chatbots like

edged sword. On the one hand, AI has the capacity to

ChatGPT. We have seen significant strides in machine

transform social norms, amplify under-represented

learning and problem-solving capabilities that hold

voices, create jobs we have not yet dreamt of and

immense potential to positively impact and simplify

contribute to positive change. On the other hand, it

our lives.

has the potential to exacerbate existing inequalities, particularly when these are the result of gender bias,

However, as we delve deeper into the realms

and it has the potential to eradicate some lower-

of AI, it becomes apparent that the power of AI

level jobs. This is where upskilling and reskilling—in

technologies also creates many challenges and

cybersecurity and the wider tech industry—plays a

ethical considerations. AI operates on algorithms

crucial role.

created by human beings, and these algorithms can inadvertently perpetuate biases, particularly when

THE INFILTRATION OF AI BIAS

applied to questions of gender, social norms and

One of the significant challenges we face is the under-

cultural equality.

representation of women in AI. According to the World Economic Forum, only 22 percent of people working

I S S U E 19

WOMEN IN SECURITY MAGAZINE

59

in AI globally are women. This lack of diversity leads

REDEFINING CYBERSECURITY

to biased algorithms, reinforces gender stereotypes

Security professionals today operate in an

and perpetuates inequalities.

environment without precedent. They are dealing with rapidly evolving digital threats. The pace of

The consequences of gender bias in AI are far-

change in this sector and the new knowledge and

reaching, affecting everything from recruitment

new skills required by security professionals are

systems to the design of technology-enabled

without precedent.

services. Inclusive AI development is not just a matter of ethics but also a necessity to ensure fair, secure

Reskilling and upskilling provide three profound

and unbiased digital interactions. Companies must

benefits: they will ensure the security workforce

take concrete steps to foster diversity within their

continues to grow in numbers and expertise; they will

teams and to ensure the design and deployment of

provide a pathway for professionals whose jobs are

technology benefits everyone.

threatened by AI; they will help to reduce gender and other biases.

While national policies and initiatives play a crucial role in addressing these challenges, individuals in

Interestingly, half the global respondents surveyed

the tech sector can make a difference within their

for ISACA’s recent Privacy in Practice 2024 report said

spheres of influence. Mentorship programs, especially

their organisation was offering training to enable non-

for women interested in technology, can break down

privacy staff to move into privacy roles. This is a trend

harmful gender norms and provide the guidance

that must continue to accelerate.

women need to pursue STEM careers. The creation of gender-balanced project teams and the adoption

Reskilling programs should focus on increasing the

of participatory approaches in technology design are

representation of women in technology, which is

practical steps towards fostering inclusivity.

critical if we are to address, and one day eliminate, gender bias.

Here are some key ways to achieve this: Inclusive education initiatives: establish educational initiatives that foster interest and inclusivity in STEM subjects from an early age.

Encourage girls to pursue technologyrelated studies by providing mentorship, resources and exposure to successful women in the field.

Mentorship and networking opportunities: create mentorship programs connecting experienced cybersecurity professionals, both men and women, with aspiring female talent. These mentorship opportunities can provide guidance, career advice and a supportive network.

60

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

I N D U S T R Y

P E R S P E C T I V E S

Promote gender diversity in leadership: actively promote gender diversity in leadership roles within cybersecurity organisations. Having visible female leaders can serve as inspiration and motivation for women pursuing or considering careers in cybersecurity.

Flexible learning options: recognise the diverse responsibilities that women often juggle. Provide flexible learning options such as online courses and part-time programs to accommodate these responsibilities.

Develop partnerships with industry: forge partnerships between educational institutions and industry stakeholders to ensure educational programs align with the current needs of the cybersecurity workforce.

reskilling in technology fields and cybersecurity

This collaboration can facilitate internships,

are not needed only to adapt to technological

apprenticeships and practical experiences.

advancements but to shape a future where AI

Address gender stereotypes: actively challenge

benefits all, leaving no one behind. This requires a

and break down gender stereotypes within the

collective commitment to inclusivity, diversity and

field. Highlight successful female cybersecurity

ethical considerations. As we champion this future, let

professionals, showcase their achievements, and

us remember that small changes within our spheres

emphasise the varied skillsets that make women

of interest can accumulate into significant positive

valuable contributors to the industry.

transformations for the common good.

Create supportive workplace cultures: foster workplace cultures that prioritise diversity and

ABOUT THE AUTHOR

inclusion. Encourage organisations to implement

Jo Stewart-Rattray has over 25 years’ experience

policies that prevent discrimination and to create

in the security industry. As a director of BRM

environments where women feel valued and heard.

Advisory she consults in risk and technology issues with a particular emphasis on governance

Support continuous professional development:

and IT security in businesses. She regularly

establish mechanisms that encourage women to

provides strategic advice and consulting to

pursue certifications, attend conferences and engage

the banking and finance, utilities, healthcare,

in ongoing learning opportunities to stay abreast of

manufacturing, tertiary education, retail and

evolving cybersecurity trends.

government sectors.

HUMANITY MUST CONTROL TECHNOLOGY The UN Secretary General’s call for a future where

www.linkedin.com/in/jo-stewart-rattray-4991a12

humanity controls technology rather than the other way around resonates profoundly. Upskilling and

I S S U E 19

WOMEN IN SECURITY MAGAZINE

61

DR VICKI GIBBS

FOSTERING DIVERSE AND INCLUSIVE WORKPLACES: EMBRACING NEURODIVERSITY

By Dr Vicki Gibbs, Head of Research, Aspect Research Centre for Autism Practice In their quest to boost a cybersecurity workforce

Research by the Aspect Research Centre for Autism

in Australia that is currently under-resourced and

Practice (ARCAP) demonstrated the complexities

insufficiently diverse, organisations are recognising

involved in a decision to disclose, particularly in

the importance of prioritising diversity and inclusion.

the workplace. Following disclosure, autistic adults

While diversity is generally seen as embracing

described reactions that ranged from negative (shock,

differences in gender, age, culture, ethnicity and

disbelief they were autistic), neutral (no reaction)

religion, organisations are increasingly acknowledging

to positive. In the latter case, they felt liberated,

neurodiversity and taking steps to understand it and

accepted, celebrated and valued, and their workmates

how it can be fully embraced in the workplace.

were curious to learn more. However, negative experiences were reported much more often.

Strictly speaking, neurodiversity simply refers to the fact that there is no single “normal” or “typical” way

It was also clear from this research that disclosure

for the brain to work and that there is a wide variety in

experiences were influenced by context. Therefore,

the way individuals experience and interact with the

organisations that wish to benefit from the

world around them.

advantages of a neurodiverse workforce need to ensure an inclusive and supportive environment.

Autism is one form of neurodiversity, characterised

62

by differences in social relating, communication and

CREATING AN AUTISM-FRIENDLY WORKPLACE

sensory processing. In Australia at least one in 70

The creation of an inclusive workplace that embraces

individuals is autistic, yet only a minority disclose their

neurodiversity requires more than mere compliance

diagnosis because of their concerns over how it may

with diversity and inclusion policies. It requires active

be received.

welcoming and celebration of the unique strengths

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

I N D U S T R Y

P E R S P E C T I V E S

that neurodivergent individuals bring to the workforce:

can contribute valuable insights that drive innovation

a rich pool of talents, different perspectives and

and competitive advantage.

innovative thinking. The benefits of embracing neurodiversity are particularly evident in problem-

Many neurodivergent individuals exhibit qualities that

solving, creativity and overall team dynamics.

align closely with the demands of the cybersecurity sector. Attention to detail, pattern recognition

While policies for inclusivity are important, there are

and focus are traits well-suited to roles involving

also practical steps organisations can take to foster

code analysis, threat detection and vulnerability

autism-friendly workplaces.

assessment. Non-traditional thinking in cybersecurity can be a game-changer, and the unique strengths and

Understanding experiences from the perspectives of

perspectives of autistic adults can be valuable.

neurodivergent individuals is critical. Environmental or activity assessments conducted by experts, including

Ultimately, fostering inclusive workplaces that

neurodivergence consultants, provide insights into the

embrace neurodiversity is not just an ethical

specific needs and challenges faced by individuals

imperative, it’s a strategic advantage. Organisations

with diverse neurological profiles. The insights gained

that prioritise diversity and inclusion position

can be used to design workplaces that accommodate

themselves as leaders in innovation, adaptability

and support all employees and that foster a sense

and employee satisfaction. Environments that value

of belonging.

the unique contributions of every individual produce stronger teams and contribute to a more equitable

Making adaptations to the environment and

and compassionate society.

workplace processes can help create a workplace that accommodates neurodiversity. These adaptations might include workspace modification, minimisation

ABOUT THE AUTHOR

of sensory experience—which can be overwhelming

Dr Vicki Gibbs is a Clinical Psychologist and

for neurodiverse workers—and the provision of

Head of Research at Autism Spectrum Australia

resources such as quiet areas. By reducing unnecessary

(Aspect). Vicki is also the parent of a young

stimuli and creating an environment that supports

man on the autism spectrum and is passionate

and is comfortable for neurodivergent individuals,

about research that aims to make a difference

organisations can make their workplaces more inclusive.

in the everyday lives of autistic people and their families. Vicki has specific training and expertise

Training and information sessions about autism

in diagnostic assessment as well as qualitative

are crucial to breaking down barriers and dispelling

and quantitative research methods. Vicki’s PhD

misconceptions. Training, developed and delivered

thesis focused on exploring violent victimization

with neurodivergent individuals, ensures information

of autistic adults, investigating the extent, nature

is positive, relevant and respectful. By demystifying

and impact of these experiences and resulted in five

autism, organisations create a foundation for open

published papers. Vicki has also led or supported

communication and understanding.

research projects on a wide range of topics, including several autism and criminal justice related

NEURODIVERSITY AND CYBERSECURITY

projects and projects related to autism screening

The benefits of embracing neurodiversity become

and assessment practices, employment, education,

especially pronounced in the realm of innovation.

financial well-being, and self-compassion.

Many neurodivergent individuals possess unique perspectives, unconventional problem-solving skills and a talent for thinking outside the box. In fields such as technology, design and research, where

www.linkedin.com/in/dr-vicki-gibbs-06a9296a

creativity is paramount, neurodivergent individuals

I S S U E 19

WOMEN IN SECURITY MAGAZINE

63

DAHYE BAKER

EMBRACING NEURODIVERSITY IN CYBERSECURITY

by DaHye Baker, Web Developer | Consultant at deyst solutions

"If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained, you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle."

— Sun Tzu, The Art of War

A

ccording to Deloitte, 10-20 percent of

My own journey, particularly my late attention-deficit/

the global population is neurodiverse,

hyperactivity disorder/autism spectrum disorder

so it is likely a significant portion of

(ADHD/ASD) diagnosis, reshaped my perspective

cyberattacks will be orchestrated by

of myself and others. Through overcoming initial

neurodiverse individuals. Recognising

hesitations rooted in societal stigmas I’ve come

this, a logical step to enhance cybersecurity would

to appreciate the compassion and strong sense

be to assemble a team that mirrors the diversity

of justice that often characterise neurodivergent

of potential threat actors. It is therefore crucial to

individuals. In the realm of cybersecurity these traits

understand how neurodiverse individuals can thrive

can pivot a neurodiverse individual’s focus towards

in cybersecurity.

people-centric solutions and away from the norm of corporate-centric approaches.

64

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

F E A T U R E

Individuals who must navigate the nuances of neurodivergence develop adaptability and resourcefulness. Creative problem-solving becomes second nature, producing unconventional approaches to address challenges that traditional methods might overlook. This innovative mindset can help neurodiverse individuals devise new solutions to complex security issues.

Neurodivergent individuals excel in pattern recognition, logical thinking and in the parsing of large amounts of information with their meticulous attention to detail. Their skills are particularly valuable in threat detection and vulnerability identification where subtle patterns and anomalies may elude typical security tools.

Contrary to common misconceptions about ADHD, the ability to hyperfocus on areas of interest can be a tremendous asset in security analysis and monitoring.

However, this ability comes with challenges; neurodivergent individuals may struggle in typical

In conclusion, neurodivergent individuals not only

work environments due to their heightened response

fit well in cybersecurity but can excel, offering cost

to sensory stimulation, making remote work an

savings and innovative solutions, and addressing

attractive and productive alternative.

societal employment challenges. The neurodiversity spectrum is wide: there can be great variation in how

The number of neurodivergent individuals in

individuals manifest their neurodiversity. Creating an

cybersecurity remains low. A significant factor may be

environment that is truly inclusive of these individuals

the unsuitability of traditional recruitment processes

can enable them to make significant contributions to

and behavioural expectations. Interviews, which

an effective cybersecurity industry.

require candidates to demonstrate high social skills and quick responses if they are to be successful, can disadvantage neurodivergent candidates.

www.linkedin.com/in/dahye-baker

A more inclusive and accessible recruitment process could unlock the untapped potential of neurodiverse individuals.

I S S U E 19

WOMEN IN SECURITY MAGAZINE

65

GILY NETZER

GETTING MORE WOMEN INTO CYBERSECURITY

by Gily Netzer, 3X CMO, Advisory Board and Member of Forbes Communication Council

My fascination with computers and technology was

Today, the battlefield has expanded into the virtual

ignited during my early childhood. As one of three

realm, emphasising the significance of cybersecurity.

sisters, I spent a considerable part of my youth

Yet, it’s disheartening that the majority of defenders in

alongside my father, an avid enthusiast of technology,

this field are still men.

electronics and crafts. My days were filled with joyous activities such as wiring, welding, sorting electronic

Recognising the shortage of cybersecurity

components, dismantling keyboards, crafting

professionals globally, the Israeli government

furniture, painting and renovating antique radios.

established the Council for Advancement of Women in Science and Technology in 2000. The aim was

Three decades ago, while I was still in high school, my

to change the narrative in the belief that inclusivity

father—who was employed by the Israeli Ministry of

would not only be a game-changer but would

Defense—was relocated to the US. Living in New York

also enhance the nation’s GDP and quality of life.

presented an incredible cultural and language-building

Initiatives like these should start at the educational

opportunity that was a rarity at the time. My love for

level, raising awareness of gender bias in schools

physics, chemistry, statistics and maths enabled

and organisations.

me to skip the 10th grade and to graduate from high school in just three years.

The dynamic nature of the IT environment calls for increased investment in women’s development

On turning 18, in line with the duty of Israeli citizens, I

within the cybersecurity industry by all countries and

joined the Israeli Defense Forces (IDF). My desire was

governments. While progress has been made with

to become a pilot, but women barred from this role

more women in leading positions, the data shows

at the time. I found an alternative by serving in an IDF

that we are still a minority. Diversity in education, the

Air Force F-15 squadron operation command centre.

workplace, and mindsets is crucial.

Although the unit was open to both genders, I was

66

among the few women in the unit. The operations

EXPANDING THE TALENT POOL

command centre, being the heart of the squadron,

As leaders, we hold the power to make a difference.

was responsible for managing missions, preparing

Setting goals to address the gender gap in

materials for pilots’ flights, real-time communication,

cybersecurity, promoting skill development and

and addressing unexpected situations.

education, creating scholarships and offering

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

I N D U S T R Y

P E R S P E C T I V E S

STEPS TO INCREASE DIVERSITY For example, you could create scholarships and incentives for women to study computer science and engineering in high school and college. If you are a leader in your company, find ways to recruit more female candidates. Notice whether your company is talking about gender bias as a trendy topic or actually doing something about it. Are you taking real measures to drive change? Here are some ideas.

• Can you introduce flexible working conditions to accommodate caregivers?

• Are you sure you are offering equal and fair compensation benefits, regardless of gender? incentives for women to pursue computer science

• Perhaps you could define a target such a 50

and engineering are steps in the right direction.

percent female workforce to reduce the gender

Company leaders can expand the talent pool

bias associated with roles within research and

by actively recruiting more female candidates,

other technology-oriented departments and put

implementing flexible working conditions, ensuring

more women into leadership positions.

equal compensation benefits, setting targets to reduce gender bias, placing women in leadership

• Offer career development programs for women in your company.

roles, and providing career development programs.

If we as leaders become role models and take action, By becoming role models and taking action, leaders

our teams can enjoy a culture of diversity and foster

can foster a culture of diversity within their teams,

a heterogeneous environment which can lead to more

leading to innovation and progress. It is their

innovation and progress.

collective responsibility to unlock the untapped potential of women in cybersecurity for the benefit of everyone.

ABOUT THE AUTHOR Gily Netzer, CMO, brings marketing leadership

In the last few years, I have seen strong women in

to Cybersecurity and DevSecOps companies.

leading positions in many companies. However, data

Passionate, innovative and results driven

analysed by Pew Research shows that we are still

marketing strategist and veteran leader with

a minority. Diversity in education, in the workplace

20 years of international B2B Cybersecurity

and in people’s minds is key. If you own a company,

experience. Building teams across regions,

if you are an investor in companies, or if you are in a

establishing new technological categories,

leadership position, you can help the world.

forming a marketing machine for consistent rapid growth, market leadership, partner and customer

Here are some ways countries, companies and

relationships. Gily is a contributor to publications

leaders can understand the unfulfilled potential

such as Forbes, Help Net Security, CyberSecurity

for women in cybersecurity and act upon it for

Ventures, IT Toolbox, and serves on the advisory

everyone’s benefit. Based on my personal journey

board and mentor.

and the insights I have offered into Israel’s efforts, I would urge leaders to address the gender gap in cybersecurity by assisting with skill development and education.

I S S U E 19

www. linkedin.com/in/gilynetzer

WOMEN IN SECURITY MAGAZINE

67

KAREN STEPHENS Karen Stephens is the co-founder and CEO of BCyber. After more than 25 years in financial services, Karen moved into SME cybersecurity risk management.

She works with SMEs to protect and grow their businesses by demystifying the technical aspects of cybersecurity and helping them to identify and address cybersecurity and governance risk gaps. She was recently named inaugural Female Cyber Leader of the Year at the 2023 CyberSecurity Connect Awards in Canberra.

C O L U M N

Who should be in security?

Who should be in security? That’s a big question

Good cybersecurity means acknowledging the risks

with a simple answer. And the answer is…

and getting the basics right, all the time.

absolutely everyone!

It is all well and good to say we all need to harden our 2024 started with the proverbial Big Bang. We had

cyber resilience to be more cyber safe, but sometimes

the mother of all breaches with 26 billion records

even getting started is the most confusing and

leaked from multiple sites, including Tencent, Weibo,

challenging part. Looking beyond security software

Twitter, LinkedIn, Adobe and Canva; a mind blowing

and all it entails, here are four steps to get you (and

12 terabytes of data. It is difficult to comprehend

your family) started:

such massive data volumes. This will provide some perspective: Many ISPs cap monthly data usage at

Good password hygiene. Passwords are an

one terabyte the Hubble Space Telescope generates

important line of defence when it comes to protecting

about 10 terabytes of new data every year(1) and IBM’s

your data. Increase your personal cyber resilience by:

(1)

famous Watson game-playing supercomputer has 16 terabytes of RAM(1). So it was a mega leak, and it

1.

may not include recent Australian based breaches like

Keeping your passwords safe. Do not write them on sticky notes, reuse them or share them.

Nissan Australia, the Victorian courts or The Iconic.

2.

If you are thinking, “well so what?”, these breaches

3.

Choose complex passwords. Have at least 16 random characters.

Keep an eye out for news of major breaches/

have given cybercriminals access to a huge database

leaks and update your passwords if you think

of personal information that can be used for

you have been caught up in one.

credential stuffing activities, where cybercriminals use the leaked customer credentials to try to log into

4.

Never use any personal details in your passwords.

other websites. Some will be successful because many people reuse login credentials for more than

Responsible social media use. Social media is a

one website. It was this type of breach that saw

great source of useful information for cybercriminals.

customers of The Iconic flood its Facebook page with

Be aware of what you share online, not only about

complaints of fraudulent orders placed in their names.

yourself but about your family and friends. Remember everything you share on social media can and will be

So, in my opinion, we are now all casualties of

used against you. A quick preventative measure is to

the data privacy wars. No one is left untouched,

lie (yes lie) when completing security questions, just

and security is now the responsibility of us all.

in case you have overshared personal information on

Cybercriminals do not respect age, gender, or

a social media account.

geographical boundaries. If you are connected to

68

the Internet, you are fair game. And the risks are

Cyber awareness training. This is not needed only

unavoidable unless you are living totally off the grid

by workers. Everyone, young and old, need to have

with no Internet. Nor can cybersecurity give you 100

some cybersecurity training. There are many free

percent foolproof protection, 100 percent of the time.

online training programs available where the only cost

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

is time. Being informed is a great way to strengthen your cyber resilience.

Secure online buying. We all love a bargain, but we need to keep our wits about us when bagging that online deal.

1.

Purchase only from online retailers you are familiar with and have confidence in.

2.

Before providing any information, verify the website address and site details.

3.

dotm.com.au/

Do not click on emails or SMS messages offering

Join Today for FREE

“special deals”. Type in the entire website address or use a store’s official app.

4.

Use a secure online payment platform to make your purchases or have a separate debit card that is used for online purchases only.

Maintaining continual vigilance is hard, but only by constantly doing our bit can we create a safer cyber environment for all.

Notes

To NETWORK with other like-minded people To MEET prospective candidates for graduate programs

(1) Terabytes, Gigabytes, & Petabytes: How Big Are They? (lifewire.com) www.linkedin.com/in/karen-stephens-bcyber

www.bcyber.com.au

twitter.com/bcyber2

karen@bcyber.com.au

youtube.bcyber.com.au/2mux

I S S U E 19

To MEET prospective employers of graduate programs The club is for security professionals (present, future and past)

WOMEN IN SECURITY MAGAZINE

69

Our Services Nurture Programs

Event Management

Magazines

Speaker Acquisition

Digital Marketing

Website Creation

Data Admin Services

Lead Generation

Programmatic

Podcasts

No job is too big or too small.

Get connected and take control of your business success today!

REACH OUT TODAY

charlie@source2create.com.au

aby@source2create.com.au

CAREER PERSPECTIVES

JASMINE MCCRUDDEN

DECODING CYBER ROLES IN 2024

by Jasmine McCrudden, Cyber Security Recruitment Specialist @ Decipher Bureau Cybersecurity is an industry in a state of constant

cyber industry professional, here’s a list of some of

flux. Since its humble beginnings in the 1970s with

the most commonly recruited roles in cybersecurity,

the advent of computer networks and Bob Thomas’s

with the certifications most often sought for each.

Creeper worm cybersecurity has developed into a fully-fledged industry in its own right.

DEFENSIVE SECURITY Roles: security or soc analyst, blue teamer,

In the past there was no specific career path one

defensive security specialist, incident responder.

could take to become a cybersecurity professional.

Certifications: GCIH, GCFA

Even now, senior cybersecurity professionals, including those in the C-suite, are mostly people

Defensive security is a subspecialty of cybersecurity

who started out in computer science, network

that focuses on protection. Think of defensive

administration, software development or information

security specialists as the security guards of

technology-related fields. Over time, and through the

data and networks. People in these roles provide

evolution of technology, they have learnt the skills

vulnerability analysis, respond to incidents, investigate

necessary to deal with cybersecurity issues.

alerts, and in some cases conduct threat hunting.

When threats arise, people in these roles will monitor

It’s easy to see, with the rapidly expanding list

and analyse the event and often, in real-time, initiate a

of specialised job titles and acronyms, how the

response to try and mitigate it.

cybersecurity industry can remain something of an enigma to those seeking to join it. As a specialist

OFFENSIVE SECURITY

cyber recruitment consultant, it’s my job to keep

Roles: penetration tester, red teamer

up with the industry at large and break down those

Certification: OSCP, GPEN

barriers. It’s important to highlight that not every role in cybersecurity requires deep technical skills or

Offensive security, also known as OffSec, is all about

needs someone who looks like a hacker in a hoodie

actively seeking out vulnerabilities in an organisation’s

writing scripts.

environment. Offensive security experts, often known as ‘ethical hackers’, look for cracks in the security

72

Whether you’re a new graduate, an experienced

armour to identify any weaknesses a malicious

worker looking for a career change, or a seasoned

hacker might find and endeavour to exploit in a cyber

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

C A R E E R

P E R S P E C T I V E S

attack. They work to strengthen network security by

SIEM AND SOAR ENGINEERS

performing simulated breaches for a company.

SIEM (security incident event monitoring) engineers design, deploy and configure SIEM tools to aggregate

SECURITY ENGINEERING AND ARCHITECTURE

and correlate data, enabling the security operations

Roles: security engineer, security architect

team to detect anomalies, identify potential threats

Certifications: SABSA, TOGAF

and respond swiftly to security incidents. SOAR (security orchestration and automation response)

Security engineering and architecture refers to the

engineers develop, implement and manage the

design, development and implementation of security

automation, scripts and playbook content for the

systems, tools and processes for an organisation. A

defensive security teams. SOAR engineers require

security engineer will generally employ engineering

a level of scripting skill, often in Python and, ideally,

principles to deploy systems. An architect will

extensive security operations experience.

often have a background in engineering and have progressed to designing security systems rather than

APPLICATION SECURITY AND DEVSECOPS:

implementing them. Some security architect roles are

Application security (AppSec) engineers are

consultative, and an increasing number require the

responsible for ensuring security is embedded into

architect to have an engineering background, enabling

the development process of an organisation (aka

them to influence the wider technology audience

‘shifting security to the left’) to prevent security

within a large enterprise.

vulnerabilities or unauthorised access, whereas

I S S U E 19

WOMEN IN SECURITY MAGAZINE

73

DevSecOps engineers are responsible for integrating security testing at every stage of the DevOps development process. They use tools and processes that encourage collaboration between developers, security specialists and operation teams to build software that is both secure and efficient to roll out.

GOVERNANCE, RISK AND COMPLIANCE (GRC) Roles: cyber risk GRC officer, cyber risk GRC consultant, GRC analyst Certifications: CISSP, CISA, CISM Governance, risk and compliance is a subspecialty of cybersecurity that focuses on aligning an organisation’s business objectives with IT. Policies and process are monitored and their security risks assessed and managed to make sure any action undertaken is consistent with the strategic goals of the business, and meets all industry and government regulations. GRC professionals spend a lot of time reviewing compliance frameworks such as ISO27001

Some organisations will have a CSO who has a role

or SOC2 standards and ensuring projects are aligned

slightly different to that of a CISO. Whereas a CISO

with these. They also examine code, model threats

will be focused on an organisation’s data, systems

and conduct risk assessments to identify potential

and information security, the CSO is responsible

vulnerabilities in an organisation’s systems.

for physical and corporate security as well as information security.

LEADERSHIP AND THE C-SUITE Roles: CISO (chief information security officer),

The cybersecurity industry is as varied as it is

CSO (chief security officer), head of security,

dynamic. As the field continues to grow, it will need

security manager

individuals who bring with them a whole host of talents from all different backgrounds to fill these

The chief information security officer is responsible

roles. As a cybersecurity recruitment specialist I can

for establishing a strong security strategy for an

confirm that there are plenty of jobs on offer from

organisation and ensuring all digital assets and

entry-level positions to senior leadership, to the board

information systems are protected. They oversee the

room for those seeking these. I can only hope, with

entire information security function within a company

better education around the various opportunities

and their job requires a broad range of technical

available for workers, excitement for this industry

and soft skills, including great leadership skills,

will continue to build and bring with it a whole new

communication skills and an in-depth understanding

generation of diverse cyber professionals.

of cybersecurity that enables them to communicate well with both a technical and non-technical audience. They are required to engage with the

https://www.linkedin.com/in/j-mccrudden

C-suite and board members to ensure these people understand the cyber threat landscape to the extent that the company takes appropriate measures to mitigate threats.

74

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

Source2Create Spotlight

Podcasts

We can GENERATE LEADS from your PODCAST

We can SCRIPT & CREATE your PODCAST

We can ADVERTISE & SOCIALISE your PODCAST

5 SERIE S PODCA ST AUD$10 ,000 Ex GST

REACH OUT TODAY

charlie@source2create.com.au

aby@source2create.com.au

SIMON CARABETTA

CULTURAL BLIPS SINK SHIPS

by Simon Carabetta, Business Development Manager Cyber Security at Digital Resources Australia

I’m still confused as to why in 2024 many

WHY THE NEGATIVITY?

organisational leaders think culture is something that

I wrote an article back in November of last year in

exists only in a tub of yoghurt.

which I called out the toxic situation at a former workplace and the type of comments I was hearing

No matter how many experts in psychology,

from senior management. I still firmly believe there

business and leadership continue to provide

was a deeply rooted issue of culture there that, from

mountains of evidence showing us how important

what I am hearing from others, still exists today.

culture is to an organisation, we are still faced with

However, this article is not about that particular

micromanagement enablers and meaningless

workplace, it is merely going to use it as an example

exercises in futility that lead nowhere.

for why there are still senior managers who drive an organisation into the cultural abyss.

So, here are two questions I’d like to pose and try my utmost to answer:

Let’s talk about business strategy. Many businesses in the tech space—whether they be consulting, selling

1.

2.

Why do some leaders still ignore the importance

a solution, or helping drive an industry—have their

of organisational culture?

own unique processes and procedures, all driven by

Are they even aware that the culture they’ve

an overall strategy. Are they sales driven? Are they

created has become toxic?

relationship and customer focused? Do they have a long-term vision based on a sustainable business

The eternal optimist in me would like to think that a

model? Are they purely motivated by their ‘Why’?

‘No’ answer to the second question is the reason why

These questions are important to ask, because I’ve

some organisations across Australia still possess a

worked for each of these types of organisations and

negative culture. However, having had a professional

have seen the difference their drivers make.

career for 21 years now, I can understand why some ‘leaders’ would not touch learnings about culture with

A cybersecurity business that is purely sales-focused

a 60-metre pole.

and driven by profits will not last. It will either go under or play a short-term game in which being

76

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

C A R E E R

P E R S P E C T I V E S

acquired is part of its overall plan. All power to those leaders, and good on them, but what they are unknowingly doing is building a culture of toxicity and hyper-competitiveness within their own team members and producing a high staff turnover. These companies are a dime a dozen and, as someone who has worked for them in the past and who is now taking a high-level view as a recruiter, I can tell you: the people in such organisations suffer.

WORK HARD, PLAY HARD IS GROSS Yes, the people suffer. And this is still something that happens frequently in our industry. I’m not here writing about whether business leaders should or should not have some kind of acquisition strategy in mind. Nor am I saying we should not be focused on sales. To do so would be crazy: sales are what keep a business going. What I am saying is that these are typically the type of organisations that get culture wrong.

• Flexible working options for all staff regardless of their role, or flexible working rosters

These are the organisations that raise a flag which

This is not an exhaustive list, and there are many,

states very bluntly: work hard, play hard. This type

many other amazing incentives business leaders can

of culture absolutely needs to die. The reason is

offer if they want the right people to join them, and

that these leaders see the play hard element as the

the right people to stay.

reward for burnout and the toxic competitiveness that comes from their overall strategy. In a post-

LET’S BE MORE AWARE

COVID world where the cost of living is rising and a

I would really like to open the conversation with

number of other external factors are accelerating that

business leaders in the cybersecurity sector. This is

burnout, we need to start taking a more employee-

certainly not an attack on them and their practices, it’s

centric approach. Surely these leaders recognise

more an observation on why things are not working

that there are other incentives than opening a bar

in some businesses but working really well in others.

tab at the local pub on a Friday afternoon or holding

The question of employee retention often comes up in

team building exercises every few months which they

my discussions with various candidates and clients,

believe to be ‘fun’ and ‘engaging’.

yet many cannot pinpoint why there is such a rapidly revolving door at the front of their office.

I have nothing against putting on a few drinks for staff every now and again, and certainly nothing against

As a community and as an industry, we need to raise

team-building exercises, but these are NOT rewards

awareness about toxic cultures. We will then be better

for hard work.

placed to address issues such as lack of diversity and inclusivity, and the many other cultural issues that

These leaders should think about:

bedevil cybersecurity in general.

• Financial bonuses for exceeding KPIs • Paid training

www.linkedin.com/in/simoncarabetta

• Paid overtime or time in lieu

I S S U E 19

WOMEN IN SECURITY MAGAZINE

77

LISA VENTURA

CYBERSECURITY: AN INCLUSIVE INDUSTRY FOR EVERYONE AND HOW TO BREAK INTO IT

by Lisa Ventura MBE, Founder – Cyber Security Unity Cybersecurity is a rapidly growing industry that plays

on a multifaceted skillset that extends beyond

a crucial role in safeguarding digital assets and

traditional programming or network management

information from ever-evolving cyber threats. The

capabilities. Communication skills are crucial for

cybersecurity industry—traditionally perceived as

effectively conveying complex security concepts to

the domain of tech-savvy individuals with a strong

non-technical stakeholders, making cybersecurity

background in computer science—is evolving. The

accessible and understandable to individuals across

importance of diversity and inclusivity is increasingly

various departments within an organisation.

being recognised. In this article we explore the idea that cybersecurity is an industry for everyone. We

Problem-solving abilities enable professionals

delve into the qualities that make individuals from

to think critically and strategically and devise

diverse backgrounds valuable contributors to the field

innovative solutions to tackle emerging threats. Risk

and cover some ways to break into the industry.

management expertise enables the identification and prioritisation of potential vulnerabilities, ensuring

THE IMPORTANCE OF DIVERSE SKILLSETS IN CYBERSECURITY

resources are allocated efficiently to mitigate the

One of the common misconceptions about

skills diversity means combining technical expertise

cybersecurity is that it is exclusively for individuals

with a range of soft skills that collectively fortify an

with a deep technical background. While technical

organisation’s cybersecurity posture.

most significant risks. Taking a holistic approach to

skills are undoubtedly essential, a successful cybersecurity team requires a diverse set of skills

Crucially, the ability to think critically and engage

and perspectives.

in continuous learning is paramount in an industry where threats constantly evolve. Cybersecurity

78

Diverse skillsets are the backbone of a robust

professionals must stay ahead of the curve, adapting

and effective defence against ever-evolving cyber

to new technologies and emerging attack vectors.

threats. A successful cybersecurity team thrives

This adaptability, coupled with a curiosity-driven

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

C A R E E R

P E R S P E C T I V E S

mindset, allows individuals

Inclusivity in cybersecurity

to proactively anticipate

is therefore essential for

and respond to the dynamic

building a resilient defence

nature of cyber threats. A

against cyber threats on a

successful cybersecurity team

global scale. Cybersecurity

will embrace diversity not

is a collaborative effort

only diversity of backgrounds

that requires input

and experiences but also in

from individuals with

the amalgamation of skills

various perspectives and

that collectively support

experiences. A diverse

a comprehensive defence

workforce can better

strategy. As the cyber

anticipate and understand

landscape continues to morph, the value of diverse

the motivations behind cyber attacks, allowing for

skillsets becomes increasingly evident, emphasising

more effective prevention and response strategies.

the need for a well-rounded and versatile workforce to

Inclusive teams are better equipped to devise holistic

safeguard digital assets in the modern era.

security measures that consider the needs and vulnerabilities of a diverse user base. Ultimately,

GOING BEYOND SKILLSETS FOR TRUE INCLUSIVITY IN CYBERSECURITY

fostering inclusivity in cybersecurity not only

As cyber threats become more sophisticated the

assets but also aligns with principles of fairness

industry benefits from a variety of perspectives and

and equity.

strengthens the industry’s ability to protect digital

experiences. Diverse teams can approach problems and respond to a wide range of cyber threats.

BREAKING DOWN STEREOTYPES IN CYBERSECURITY FOR GREATER INCLUSIVITY

Inclusivity in cybersecurity also extends to gender,

Historically, the image of a cybersecurity professional

race, ethnicity and other demographics. It requires

has been that of a script kiddie, wearing a hoodie

fostering a workplace culture that values different

and sitting in a dark room surrounded by screens

backgrounds and ideas.

filled with lines of code. This stereotype has deterred

from different angles, making it easier to anticipate

many from considering a career in cybersecurity, Inclusivity is the cornerstone of a resilient and effective

especially those who do not fit that mould. The reality

cybersecurity environment. Embracing diversity in

is that cybersecurity encompasses a broad range of

terms of gender, race, ethnicity and background not

roles, including policy and compliance, risk analysis,

only contributes to a richer pool of talent but also

incident response and security awareness training.

fosters a variety of perspectives crucial for tackling the

Countering this stereotype is therefore essential to

diverse and complex challenges in cybersecurity.

attract a diverse pool of talent to the industry.

Inclusivity in cybersecurity extends beyond

This means promoting positions that require

demographics to encompass diverse career paths,

skills other than coding, such as those focused on

recognising that individuals with non-traditional

policy development, risk management and security

backgrounds can bring unique insights to the field.

awareness training. By raising awareness of the

This approach helps break down stereotypes and

diversity of cybersecurity experts, the industry can

dispels the notion that a specific educational or

encourage individuals of all genders, ethnicities and

professional trajectory is a prerequisite for success in

backgrounds to envision themselves as contributors

cybersecurity. By creating an inclusive environment

integral to the field. This shift in representation not

the industry promotes innovation, creativity and

only attracts a wider talent pool but also challenges

adaptability; qualities essential to combating rapidly

biases that may hinder diversity in recruitment.

evolving cyber threats.

Emphasising the human-centric aspects of

I S S U E 19

WOMEN IN SECURITY MAGAZINE

79

cybersecurity, such as problem-solving, critical

accessibility and training integral components

thinking and communication skills, contributes to a

of cybersecurity practices, the industry can take

more inclusive narrative that encourages individuals

significant strides toward building a more inclusive

from various walks of life to recognise their potential

and resilient cybersecurity workforce.

in shaping the future of cybersecurity.

BREAKING INTO CYBERSECURITY: AN INDUSTRY FOR EVERYONE

ENSURING ACCESSIBILITY AND TRAINING FOR INCLUSIVITY IN CYBERSECURITY

Cybersecurity is not reserved for a select few. It offers

Ensuring accessibility and providing comprehensive

opportunities for everyone interested in safeguarding

training are fundament to fostering inclusivity in

the digital realm. Contrary to those lingering

cybersecurity. There is a need for educational

stereotypes already discussed, the cybersecurity

programs and training initiatives that cater to

industry is diverse and inclusive, welcoming

different learning styles and backgrounds and make

individuals with various educational backgrounds,

the industry more accessible to a diverse range of

experiences and skillsets. The industry values a

individuals. Cybersecurity bootcamps, online courses

broad spectrum of talents, ranging from technical

and mentorship programs can play a pivotal role in

proficiency to effective communication and critical

providing accessible pathways for individuals who

thinking skills. The industry thrives on diversity, and

may not have followed traditional educational routes

by acknowledging that cybersecurity is indeed for

into the field. By breaking down barriers to entry the

everyone, we can build a stronger, more resilient

industry can tap into a broader talent pool, bringing

defence against cyber threats. To help you break into

in fresh perspectives and insights that contribute to a

the industry, here are a few things to help you.

more inclusive cybersecurity landscape.

NETWORKING MATTERS In addition, companies and organisations within the

Building a professional network is crucial in any

cybersecurity sector should prioritise ongoing training

industry. Attend, in person and virtually, industry

and professional development opportunities for their

conferences, seminars and workshops that are

workforces. This commitment to continuous learning

dedicated to the industry. These events provide

not only ensures that cybersecurity professionals

opportunities to connect with industry professionals

stay abreast of the latest threats and technologies

and peers, to learn about the latest trends and gather

but also promotes inclusivity by offering pathways

insights that can help you excel in your career. I’ve

for career growth and skill enhancement. Investing

invested a lot in building my professional network in

in training programs that accommodate different

cybersecurity and have spent much time developing

learning styles and preferences contributes to a

my network on LinkedIn and Twitter in particular, as

workplace culture that values diversity and recognises

well as at face-to-face and virtual events.

the potential of individuals from various backgrounds to excel in cybersecurity roles. Ultimately, by making

JOIN ONLINE COMMUNITIES There are many online forums, social media groups, Discord channels, Slack groups and platforms where cybersecurity enthusiasts can gather to discuss topics, share insights and ask questions. Join these to engage in discussions, ask for advice and share your experiences. LinkedIn, Twitter, Reddit and specialised cybersecurity forums are great places to start.

GAIN SOME HANDS-ON EXPERIENCE Theory alone is not sufficient in cybersecurity.

Practical experience is highly valued. Consider setting up a home lab where you can experiment with tools

80

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

C A R E E R

P E R S P E C T I V E S

and techniques in a controlled environment. ‘Capture

penetration testing and threat analysis to security

the Flag’ (CTF) competitions and platforms like ‘Hack

consulting and incident response. Tailor your CV and

the Box’ provide hands-on challenges that can help

cover letter to align your skills and experience with the

you refine your skills.

specific role you are applying for.

FIND A MENTOR A mentor can provide guidance, motivation and

CONFIDENCE, RESILIENCE, AND PERSEVERANCE

a valuable perspective. Seek out experienced

Lastly, believe in yourself and your abilities. The

professionals in cybersecurity who can offer advice,

cybersecurity field may have challenges, but

share their experiences and help you navigate your

perseverance is key. Don’t be discouraged by

career path. Mentorship can significantly accelerate

setbacks; instead, view them as opportunities to grow,

your career growth. If there is a particular person you

learn and improve.

would like to have as a mentor, do not be afraid to ask them. The worst that can happen is they say no, and

FINAL THOUGHTS

you never know, they might say yes.

Cybersecurity is an industry that should be open to everyone. Beyond technical expertise, the field values

STAY UP TO DATE WITH INDUSTRY NEWS

diverse skillsets, backgrounds and perspectives.

Cybersecurity is a rapidly evolving field. New threats

Breaking down stereotypes, fostering inclusivity

and technologies emerge by the second, never mind

and providing accessible training are essential

daily or weekly, and there is much to keep up to

steps toward creating a cybersecurity workforce

date on. Subscribe to industry newsletters, follow

that can effectively tackle the evolving landscape of

cybersecurity blogs, listen to industry podcasts and

cyber threats. As we look to the future, embracing

keep an eye on reputable news sources to stay up to

diversity in cybersecurity will not only enhance the

date with the latest developments.

industry’s ability to protect digital assets but also contribute to a more inclusive and dynamic global

DEVELOP YOUR SOFT SKILLS

cybersecurity community.

While technical skills are important, soft skills like communication, problem-solving, and teamwork are essential for cybersecurity. Effective communication

LISA VENTURA MBE

is especially important in explaining complex

Lisa Ventura MBE is an award-winning

technical concepts to non-technical stakeholders.

cybersecurity specialist, writer and speaker. She is the founder of Cyber Security Unity, a global

DIVERSITY IS AN ASSET

community organisation dedicated to bringing

Remember that diversity brings a range of

together individuals and organisations who

perspectives to the table, and is incredibly valuable in

actively work in cybersecurity to help combat the

cybersecurity. Embrace your unique viewpoint and use

growing cyber threat. As a consultant Lisa also

it to contribute to the industry’s growth and innovation.

works with cybersecurity leadership teams to help

The cybersecurity industry is perfect for those

them work together more effectively. She also

who are neurodivergent, because those who have

provides training on the benefits of hiring those

autism spectrum disorder or ADHD, for example, can

who are neurodiverse. She is a mindset and mental

often spot patterns and idiosyncrasies that may be

health coach and offers help and support to those

overlooked and critical. In addition, their hyperfocus

affected by stress, burnout, bullying/abuse and

can be a great asset to cybersecurity when it comes

mental health issues in cybersecurity and Infosec.

to navigating through any attacks or data breaches.

FIND JOB OPPORTUNITIES

www.linkedin.com/in/lisasventura

When you feel ready, start looking for job opportunities. Cybersecurity roles vary widely, from

I S S U E 19

www.lisaventura.co.uk

WOMEN IN SECURITY MAGAZINE

81

ANNIE-MEI FORSTER

HOW JOURNALISM SET ME UP FOR A CAREER IN CYBERSECURITY

by Annie-Mei Forster, Senior Cybersecurity Consultant at oobe

It’s not uncommon to speak to people working in the

I interned at a contemporary art gallery, the United

cybersecurity industry who started their careers doing

States where I spent a summer living in New York

something completely unrelated. The military, law

studying art at Sotheby’s and drinking (excessively)

and finance are just a few of the industries I know of

at bars in the Lower East Side, and to Europe where

people having worked in before moving into cyber.

I backpacked.

When I look at the twists and turns my own career

When I eventually decided to come home, I moved to

has taken, I wonder how I ended up where I am

Melbourne. After living in Melbourne for a few years

now. Sometimes I feel my life to be one of those

I was in a job I did not like, so I decided it was time

Choose‑Your-Own-Adventure books. I chose a

to go back to university. I had long held a passion for

cybersecurity career but could have chosen one

writing, so I thought I would enrol in a postgraduate

of many others.

communications degree course at RMIT. After telling me the grade point average from my undergraduate

When I gained my undergraduate degree a BA with

degree was too low to apply for a full masters,

majors in art history and Mandarin, I had no idea what

RMIT suggested I apply for a Graduate Diploma in

I wanted to do with my life. Everyone I knew at ANU

Journalism because the entry requirements were

was applying for graduate roles in the public service.

less strict, and it would give me an easy path into the

All I knew was I did not want to do that or stay

master’s program.

in Canberra.

I decided to apply and was called to an interview with

82

Over the next couple of years, I did what a lot of

the program coordinator. Thinking I would be asked

young people do when they don’t know what to do

only general questions on why I wanted to do the

with their lives: I saved money and went travelling.

program, I did nothing to prepare. Boy, was I in for a

My travels took me to Asia, including Beijing where

rude shock.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

C A R E E R

P E R S P E C T I V E S

The interviewer asked me for well-known names: from

Finally, it was journalism first sparked my interest in

prime ministers to sporting teams. I still remember

working in technology. When studying for my degree

having no clue as to who was Prime Minister of India.

I shot a TV news story about a robotic ice-cream bar,

That interview made me realise how little I did to

and wrote an article on women who worked in tech.

stay up to date with the news. I now make a point of

Only while interviewing women for that assignment

knowing the names of the world’s leaders.

did I wonder why I had never considered a career in tech. The answer was: I did not know I could work with

Today, my journalism skills help me in my current role

computers. It seems strange to say that now, when

in many ways. One thing newspaper writing taught

almost all jobs involve using computers in some way.

me was to understand my audience: who am I writing for and the main point I want to get across.

When I look back at all the different jobs I’ve had: waitressing, bartending, digital marketing,

A problem I see a lot with technical people—

communications, English teaching, software testing

cybersecurity, IT, networking, developers, etc—is they

and, now, cybersecurity, I sometimes wonder how I

are often tasked with writing documentation without

ended up here.

being told its purpose.

My career path was not linear, but I learnt so much I often review documents designed to explain why a

along the way. It might be a cliché, but the journey is

system is important to the business and how it aligns

more important than the destination. Funnily enough,

with the goals of the organisation’s executives and

I have ended up back in Canberra, despite desperately

find the writer getting bogged down in the nitty-gritty

wanting to leave after finishing my university studies.

details of how products are configured; details an

Canberra has improved a lot since then.

executive will neither understand nor care about.

One thing you should take away from reading this Journalism also taught me to think critically: to not

is that everything you’ve done in your life to date

simply believe what people tell me but do my own

will help you in the future. I always say the skills I

research and find proof of what they are saying.

learnt in hospitality, including dealing with the public

I’ve found, especially in government departments,

and working under pressure, are very valuable, and

that internal politics can lead to many blame

applicable to any industry.

games. Learning how to interview people when I studied journalism has helped me when speaking

Also, remember to read the news (hopefully my journo

to stakeholders to gather information. I learnt

professors see this).

it is essential to take notes during meetings for later reference.

I S S U E 19

www.linkedin.com/in/annie-mei-forster

WOMEN IN SECURITY MAGAZINE

83

Need Data Admin Services

Tell us more about your data Need Data appending services?

Need database admin cleaning Data enrichment services

Data Entry Admin services Data Verification services

LET US HELP YOU OVERCOME YOUR BUSINESS DATA CHALLENGES PARTNER WITH A QUALITATIVE FAST-WORKING TEAM Our team understand the importance of time and efficiency when it comes to data projects.

With:

aby@source2create.com.au charlie@source2create.com.au source2create.com.au

STUDENT IN SECURITY SPOTLIGHT

financial loss, compromised health data and threats to personal privacy.

What makes cybersecurity particularly exciting is that it’s a dynamic field that constantly evolves to counter YASAMAN SAMADI

emerging threats. Professionals in this field are like digital guardians, using cutting-edge technology

Yasaman Samadi was born in Iran and now lives in Melbourne where she is a PhD student in Computer Science at RMIT University.

PhD student in Computer Science at RMIT University

to stay one step ahead of cybercriminals. It’s not just about addressing current challenges but also anticipating and mitigating future risks. In essence, a career in cybersecurity is not just a job; it’s a mission to ensure the integrity, availability and confidentiality of information that underpins our modern society.

By contributing to the cybersecurity landscape, professionals become key players in the ongoing

Yasaman is a Cyber Security Researcher and a

battle to create a secure digital environment for

former Quantum Computer Engineer, passionate

individuals, businesses and organisations alike. In the

about advancing technology. Proud member of STEM

digital age it’s a field where one’s skills directly impact

Women Global Network and STEM Women Australia

the safety and wellbeing of individuals, making it

Network. Focused on CyberSecurity, Blockchain,

both rewarding and essential in today’s technology

Cryptocurrency, Machine Learning, Distributed

driven world.

Systems, and Quantum Encryption.

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

When I initially embarked on my academic journey,

Cybersecurity plays a crucial role in safeguarding our

delving into computer hardware engineering for my

everyday lives by protecting sensitive information

bachelor’s degree and subsequently specialising in

we often take for granted. Imagine the vast amount

computer architecture for my master’s, I naturally

of personal data stored online; from bank accounts

encountered the realm of security as an integral

and social media profiles to insurance and medical

component of my studies. At first, it seemed like

records. This information is integral to our daily

an interesting but somewhat specialised aspect

activities and its security is paramount.

of the broader field. However, as I delved deeper into the intricacies of cybersecurity my perspective

In a world where our lives are increasingly

underwent a significant transformation.

interconnected through digital platforms,

86

cybersecurity has become the frontline defence

What caught my attention initially was the realisation

against potential threats. It’s not just about

that security is not merely an optional layer but

preventing unauthorised access; it’s about securing

an indispensable element of the functionality and

our assets, preserving the confidentiality of our

integrity of any software, application, network or

health records and safeguarding our personal

architectural design. It is not confined to a niche;

identities. Think about the potential consequences

instead, it permeates every facet of the technological

if this information were to fall into the wrong hands:

landscape. Witnessing its significance across diverse

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

domains and within various companies heightened

As organisations and governments increasingly

my appreciation of the critical role cybersecurity

recognise the critical need to secure their data the

plays in safeguarding digital assets.

demand for skilled cybersecurity experts is on the rise. One of the distinctive aspects of cybersecurity

One aspect that continues to intrigue me is the

is its versatility; it is a field that spans almost every

ever-evolving nature of cybersecurity. The landscape

industry. There is a broad spectrum of employment

is dynamic, presenting new challenges and threats,

opportunities: from established organisations and

despite our best efforts to fortify data and systems.

government agencies to emerging startups dedicated

This perpetual state of flux keeps the field engaging

to data security.

and ensures there is always more to learn and discover. It’s fascinating to observe how, even with

This wide-ranging applicability excites me because

advancements in security measures, there are

it means I can apply my skills and knowledge in

constant innovations in cyber threats that demand

a variety of contexts, contributing to the security

our attention and expertise.

landscape in different ways. Specifically, my preference lies in the R&D sections of companies

What started as an interesting component of my

and organisations. This choice is motivated by a

academic curriculum has evolved into a passion and

desire to stay close to academia and research while

a career path I find both challenging and rewarding.

simultaneously addressing real-world challenges.

My realisation that the work in cybersecurity is never truly done, that there are always new frontiers to

The R&D environment offers a unique blend of

explore and potential vulnerabilities to address adds

innovation and practical problem-solving allowing me

a layer of excitement to the field. It’s this ongoing

to contribute to the advancement of cybersecurity

pursuit of knowledge and the dynamic nature of

solutions. It provides the opportunity to explore

cybersecurity that has solidified my commitment to

cutting-edge technologies, analyse emerging

the discipline, making it a continually evolving and

threats and develop proactive measures to counter

captivating aspect of my professional journey.

evolving risks. Moreover, being part of an R&D team allows for continuous learning and adaptation to

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

the ever-changing cybersecurity landscape. It aligns

Upon graduation my aspiration is to secure

development of novel and effective solutions.

with my intrinsic motivation to not only understand existing security issues but also to contribute to the

employment in a cybersecurity role that aligns with my passion for research and development.

My post-graduation career goal is to immerse

The dynamic nature of cybersecurity and its

myself in an R&D role within cybersecurity. This

pervasive importance across diverse sectors have

choice is driven by the desire to combine my

opened up unique opportunities for professionals.

academic background with hands-on problemsolving, and to make meaningful contributions to the ongoing evolution of cybersecurity practices and technologies.”

When you decided to pursue a career in cybersecurity, how did your parents, peers or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

I S S U E 19

WOMEN IN SECURITY MAGAZINE

87

YASAMAN SAMADI I consider myself fortunate to have been born

has allowed me to focus on my goals without

into a family that has consistently provided

unnecessary obstacles.

unwavering support for its children and their

Their unwavering support became a cornerstone

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

of my journey into this field and I am grateful

The most influential factor shaping my journey in

for the positive influence they have had on my

cybersecurity has been the opportunity to encourage

career choices.

and empower other women and young girls who are

dreams. When I made the decision to pursue a career in cybersecurity, my parents were not only understanding but also incredibly encouraging.

embarking on their own life journeys. From the early My parents, recognising the evolving landscape

stages of my career, I recognised the importance of

of technology and the increasing significance of

fostering inclusivity and diversity in cybersecurity.

cybersecurity, actively encouraged my sister and I to

Being a woman in a traditionally male-dominated

pursue our dreams. Their support was both financial

industry, I felt a responsibility to not only excel in

and emotional, because they took a genuine interest

my own pursuits but also to serve as a source of

in understanding the field and its potential for growth.

inspiration for others.

Their belief in our abilities and aspirations instilled confidence and determination in us, enabling us to

Sharing my personal journey, experiences and

pursue our chosen paths with enthusiasm.

achievements with other women and young girls has been a deeply rewarding aspect of my career. I’ve

Fortunately, I did not encounter any opposition or

actively sought opportunities to mentor, support and

negative challenges from my family, peers or career

advocate for gender diversity in cybersecurity. This

advisors. This lack of resistance allowed me to focus

commitment has allowed me to build connections

wholeheartedly on my studies and professional

within the community and create a network of

development in cybersecurity. It created a positive

support for those who may face unique challenges in

environment that nurtured my passion for the field

pursuing a career in technology.

and facilitated my pursuit of knowledge and skills.

While I did not face direct opposition, I am aware that

Having a strong voice as a woman in cybersecurity

not everyone may have the same experience.

has not only empowered me, it has also contributed to breaking down stereotypes and barriers in

In navigating potential challenges, I believe open

the field. It has inspired me to be a trailblazer,

communication and education are essential.

demonstrating that women can thrive and excel in

Having conversations with family members, peers

technical and security-focused roles. Witnessing the

or advisors about the importance of cybersecurity

impact of my advocacy on the aspirations of other

and the opportunities it offers can help dispel

women has become a driving force in my career.

misconceptions and build support. Sharing success stories and illustrating the impact of cybersecurity on

The experience of encouraging diversity has

the modern world can also contribute to creating a

broadened my perspective on the potential impact

more positive and informed perspective.

of cybersecurity on a global scale. It has heightened my awareness of the need for diverse voices

88

My decision to pursue a career in cybersecurity

and perspectives to address complex security

was met with wholehearted support from my

challenges. As a result, my career aspirations have

family. Their encouragement has been a driving

evolved beyond personal success to include a

force in my journey, and the absence of opposition

commitment to fostering an inclusive cybersecurity

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

community. The most influential factor shaping my

best practices. This holistic

journey in cybersecurity has been the opportunity

approach ensures graduates

to empower other women and young girls. This has

are well-prepared to navigate

not only strengthened my own sense of purpose

the ever-changing landscape of

and determination, it has also influenced my

cybersecurity when they enter

career aspirations by emphasising the importance

the workforce.

of diversity, inclusivity and advocacy in the cybersecurity landscape.

I am confident my academic program is effectively keeping

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape?

pace with the industry’s current

Yes. The alignment between academic projects

research and collaborative

and industry needs is a testament to the proactive

initiatives contributes to a comprehensive and up-to-

approach taken by the program. Cybersecurity

date educational experience, preparing students to

research within the academic realm is consistently

address the dynamic challenges of the cybersecurity

geared towards addressing real-world industry

field.

landscape. The integration of industry-driven projects, active engagement in cybersecurity

challenges, fostering a dynamic and responsive learning environment.

What aspect of your cybersecurity studies excites you the most, and why?

In my academic journey, I have witnessed

What excites me most is the dynamic intersection

a concerted effort to integrate the latest

of cybersecurity with other domains such as

advancements, methodologies and tools relevant

finance, blockchain and quantum computing. While

to the contemporary cybersecurity landscape.

cybersecurity is inherently captivating, exploring its

Faculty members and researchers actively engage

integration with emerging technologies and critical

with industry trends, emerging threats and evolving

sectors adds a layer of novelty and challenge I find

technologies to ensure the curriculum remains

particularly thrilling.

current and reflects the challenges professionals face in the field.

The fusion of cybersecurity with finance introduces a fascinating dimension because financial systems

Moreover, the emphasis on cybersecurity research

have become prime targets for cyber attacks in

further enhances the program’s ability to adapt to

today’s digital era. The intricate nature of financial

industry demands. Faculty members are involved in

transactions, the vast amounts of sensitive data and

cutting-edge projects that explore novel solutions

the interconnectedness of global financial networks

and strategies to counteract evolving threats. This

creates a complex landscape that demands

not only enriches the academic experience for

innovative cybersecurity solutions.

students but also ensures that the knowledge and skills they acquire are directly applicable to the

Being at the forefront of securing financial systems

challenges faced by cybersecurity professionals in

involves not only understanding traditional

the industry. The collaboration between academia

cybersecurity principles but also navigating the

and industry is a key strength of my academic

unique challenges posed by the financial sector.

program. Through partnerships, internships and

Similarly, the integration of cybersecurity with

collaborative projects, students are exposed to

blockchain technology presents an exciting

real-world scenarios and gain insights into industry

challenge. As blockchain gains prominence in

I S S U E 19

WOMEN IN SECURITY MAGAZINE

89

YASAMAN SAMADI various industries including finance, healthcare, and

a static discipline; it’s a continuous, evolving battle

supply chain, ensuring the security of decentralised

against adversaries who are constantly refining their

and distributed systems becomes paramount.

techniques. Cybercriminals are quick to leverage

The decentralised nature of blockchain creates

new technologies, exploit vulnerabilities and devise

both opportunities and challenges, and addressing

sophisticated attack vectors. As a result, staying

the security aspects of this technology requires a

ahead of these threats requires a proactive and

nuanced understanding of cryptographic principles

strategic approach.

and consensus mechanisms.

To overcome these challenges, I adopt a multifaceted The evolving landscape of quantum computing

approach. Firstly, I prioritise ongoing education

introduces a paradigm shift in cybersecurity.

and professional development. Staying abreast of

Quantum computing has the potential to render

the latest developments in cybersecurity through

existing cryptographic algorithms obsolete,

continuous learning helps me understand emerging

necessitating the development of quantum-resistant

threats and evolving attack vectors. Engaging in

encryption techniques. This area of study is not only

regular training programs, attending conferences and

cutting-edge but also holds the key to ensuring the

participating in webinars are essential components

future security of digital communications.

of this strategy, as is collaboration with peers and industry professionals.

What excites me the most is the prospect of applying cybersecurity principles at these new

Building a network within the cybersecurity

and challenging frontiers. It’s the combination

community allows for the exchange of insights,

of traditional cybersecurity knowledge with the

sharing of best practices and collective problem-

exploration of ground-breaking technologies that

solving. Collaborative efforts provide a valuable

fuels my enthusiasm. I am eager to contribute to the

resource for gaining diverse perspectives on tackling

development of innovative solutions that address

new challenges and staying informed about the

the specific security concerns posed by these

latest threat intelligence. Also, it is essential to

emerging areas, ultimately playing a role in shaping

cultivate a mindset of curiosity and adaptability.

the future of cybersecurity in an ever-evolving

Embracing the dynamic nature of cybersecurity as an

technological landscape.

opportunity for growth rather than a hindrance helps in navigating challenges with resilience. This involves

Are there specific aspects of your cybersecurity studies that you find particularly challenging? If so, what are they, and how do you approach overcoming these challenges?

developing a proactive mindset that anticipates potential threats and focuses on implementing preemptive security measures.

One of the most challenging yet intriguing aspects of my cybersecurity studies is the relentless innovation of cybercriminals. The continual emergence of new tactics and ideas to compromise our systems and data means every cybersecurity model must be continually updated to stay ahead of evolving threats.

This dynamic nature poses a dual challenge, one that demands constant vigilance and adaptability but also makes the field endlessly fascinating.

The challenge lies in the fact that cybersecurity is not

90

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

Lastly, leveraging automation and advanced

Cybersecurity is not just about technical proficiency;

technologies is an integral part of my strategy.

it’s about building a collective defence against cyber

Implementing automated tools for threat detection,

threats, and effective communication is integral to

analysis and response can significantly enhance the

this collaborative effort.

efficiency of cybersecurity defences. This allows for a more agile response to emerging threats, freeing

Management skills also become increasingly

up time for cybersecurity professionals to focus on

relevant as people progress in their cybersecurity

strategic initiatives and proactive measures. While

careers. The ability to manage projects, teams

the evolution of cyber threats poses a continuous

and resources is crucial for implementing

challenge, my approach involves a commitment to

comprehensive cybersecurity strategies. Because

ongoing education, collaboration, adaptability and

cybersecurity professionals often find themselves

the strategic use of technology. By staying informed,

in leadership roles or involved in decision-making

connected and proactive, I aim to navigate the ever-

processes, managerial skills are essential for

changing landscape of cybersecurity with resilience

driving initiatives, allocating resources effectively

and effectiveness.

and ensuring the successful implementation of cybersecurity measures.

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management?

If yes, why?

Furthermore, possessing a broad understanding of business processes, risk management and compliance frameworks enhances one’s ability to align cybersecurity initiatives with organisational

Absolutely. The rapidly evolving nature of technology,

goals. This holistic perspective allows for the

with new techniques emerging daily, underscores

development of more comprehensive and effective

the necessity for professionals to continually update

security strategies. While technical expertise is

their skillsets. While technical proficiency remains a

foundational, additional training in non-cyber skills is

cornerstone of success in the field, a well-rounded

vital for a well-rounded cybersecurity professional.

cybersecurity professional should also possess

The combination of technical proficiency

a range of non-technical skills. Interpersonal

with effective interpersonal communication

communication skills are crucial in a cybersecurity

and management skills enhances individual

role for several reasons. First and foremost, effective

career prospects and contributes to the overall

communication is essential for conveying complex

effectiveness of cybersecurity initiatives within

technical concepts to non-technical stakeholders,

an organisation. Embracing a holistic approach to

such as executives, clients or regulatory bodies. The

professional development ensures that cybersecurity

ability to articulate cybersecurity risks, strategies and

professionals can navigate the complexities of

solutions in a clear and understandable manner is

the field and actively contribute to the success of

paramount for fostering collaboration and securing

their organisations.

organisational buy-in.

Additionally, strong interpersonal skills contribute

www.linkedin.com/in/yasaman-samadi-209714187

to effective teamwork within cybersecurity teams.

As the field often involves collaboration with

scholar.google.com/citations?user=zrm6njIAAAAJ&hl=en

professionals from diverse backgrounds and with differing expertise, being able to communicate and

stemwomen.global/profile/yasaman-samadi

collaborate efficiently fosters a culture of shared understanding and collective problem-solving.

I S S U E 19

www.stemwomen.org.au/profile/yasaman-samadi

WOMEN IN SECURITY MAGAZINE

91

My first impression of cybersecurity, like many students, was primarily pen-testing and ethical hacking. I guess that’s the sexy side that lures a lot of young people into the industry, but it’s also the most accessible, with many resources like Hack BERNIE GARNELL

The Box, TryHackMe and YouTube videos. However, as I’ve spent time in this space, I have realised that

Bernie is currently pursuing a Bachelor’s degree in Computer Science, with a major in Networks and Cybersecurity at AUT. Apart from her university studies, she is also the Co-Founder of Faraday.

Bachelor of Computer Science at Auckland University of Technology

people-facing roles such as educating people on cybersecurity awareness and creating business policies to keep data safe are just as pivotal, and probably account for the majority of roles in the industry.

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

I’m currently working at a startup called Faraday with

92

Bernie Garnell was born in USA and grew up

my co-founder Jacques Cantin. I got cyber-stalked

spending time in the USA, Japan, India, Germany

and harassed a year ago and through that experience

and, now, New Zealand because her father’s work

I realised there is a lack for support around

as a consultant took him around the world. She is

documenting and reporting cyber harm incidents.

studying for a bachelor’s degree in computer science

Through Faraday I have been talking to organisations

at Auckland University of Technology majoring in

and people across the world about the challenges

networks and cybersecurity, in addition to working at

they face, which motivates me even more to continue

Faraday, a company that helps high-risk individuals

our mission to help people gain control of their cyber-

take control of their privacy, which she cofounded.

harm situations.

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

Personally, I find social engineering fascinating, and

When you decided to pursue a career in cybersecurity, how did your parents, peers or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

I think it’s the most relatable and relevant aspect

I left high school a year early to go to university to

to those outside security. I like to talk about the

pursue security. I had some opposition from teachers

different types of phishing attacks or online scams

who said I should stay to finish my high school

and the methods attackers use to trick users into

experience. However, this was during COVID, so I

giving away sensitive information. Most of my peers

don’t think I missed out on much. My parents, friends

have not yet had formal corporate cybersecurity

and digital teacher were my biggest supporters. It

awareness training, so it’s relatively new information

was also a time when the job market was showing

for them.

strong demand for security staff.

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experience today compare?

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

immensely grateful to have had the opportunity to

Are there specific aspects of your cybersecurity studies that you find particularly challenging? If so, what are they, and how do you approach overcoming these challenges?

work with such a remarkable group of experts. They

After completing my internship, I realised there

helped expand my knowledge and understanding

were certain skills required for the job I had at the

of cybersecurity. I would never have learnt in a

time, and that I would not learn in my courses. This

classroom what I learnt working there: the questions

demotivated me because I felt my studies were not

that get asked in an audit, a consultant’s thought

preparing me for the real world. However, I came to

processes during a red team audit, and how to write

the realisation that, while my courses may not have

a report for clients.

taught me specific skills such as web-app auditing or

I can’t name a particular person, but the team at Aura Information Security—where I did two summer internships—definitely helped shape my journey. I am

how to write framework guidelines, they provided me

Recount the most memorable or significant event in your cybersecurity journey to date, highlighting why it left a lasting impression.

with a foundation of knowledge I could use to better

During my time at Aura Information Security I

training. It was extremely exciting to see both the

Do you believe there are areas in cybersecurity that deserve more emphasis in your coursework or areas that could receive less focus?

red and blue teams working at the same time. It also

My security coursework focused a lot on policy,

demonstrated how little things, like not enabling

which I thought was pretty relevant. We did not have

MFA or changing a default password, can put an

any courses on pen testing even though it’s a popular

organisation at risk.

area. I would have liked to have taken a class or two

watched my mentor, Lachlan Davis, perform a live attack simulation on a security operation team in

inform my thinking.

focused solely on that.

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

I gained practical experience through my summer internships at Aura Information Security, which I

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management?

If yes, why?

undertook through Summer of Tech, a New Zealand organisation that connects employers with local students and graduates for paid work experience and graduate jobs.

What aspect of your cybersecurity studies excites you the most, and why? Conversely, which aspect of your studies do you find least interesting or useful, and how do you navigate through it?

I find my studies require a lot of memorisation which can take up a lot of time. I also find it difficult studying some topics that are not extremely relevant to the roles I want. I use Quizlet and write things down verbatim and find that helps.

I S S U E 19

WOMEN IN SECURITY MAGAZINE

93

BERNIE GARNELL

that’s understandable and relevant to them not only

What measures do you have in place to enhance your personal cybersecurity in today’s digital landscape?

helps keep companies safe but can help people avoid

I use 2mfa and password managers consistently

becoming victims of cyber attacks in their personal

and avoid duplicating passwords. I use different

lives. Often, when people think of cybersecurity, they

usernames on accounts. I am not active on social

think of big nation-state attacks. However, I think it’s

media other than LinkedIn and I try to keep my digital

important to shed light on the smaller things, such as

footprint low.

One hundred percent. Helping people understand different security risks by explaining them in a way

having better privacy on social media to prevent an attacker from creating a convincing pretext to enable a social engineering attack.

Are you actively engaged in the broader cybersecurity community? If so, what has been your involvement, and how has it enriched your experience?

Have you actively sought employment opportunities in the cybersecurity field, and if so, what has been your experience with the application and interview process?

Summer of Tech has been a great resource and something I highly recommend to all computer science students in New Zealand. Setting up an

Yes. I’ve been going to New Zealand’s Information

account can be somewhat tedious, but it gives you

Security Interest Group (ISIG) and trying to keep up to

the opportunity to apply for many security jobs. I

date with the latest security trends through different

did not have a strong technical background, but I

news platforms and RSS feeds. My Faraday co-

found being involved with security interest groups

founder and I did our first ISIG presentation late last

and having an interest in security outside my

year and got some great feedback. Going to ISIG has

particular role demonstrated to my interviewers I was

also really helped me expand my network and get to

passionate about the industry, which I think made me

know the wider Auckland community.

stand out.

What is your preferred source for staying informed about cybersecurity trends and general information?

www.linkedin.com/in/bernie-g-1b4847207

LinkedIn is great. I get to see the topics that people are most actively talking about. Also, Krebs on Security, Security Week for updates, and Darknet Diaries for when I want a podcast binge.

Have you ever encountered situations where being a woman in cybersecurity made you feel disadvantaged or discriminated against? If so, please share your experiences.

I don’t know If I have felt disadvantaged or discriminated against, but there was definitely a feeling of not belonging. I would walk into a class and be one of only three, or sometimes the only girl in the room. That could be nerve-racking and uncomfortable, but I found having a support system of friends to talk to helped.

94

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

combine their respective strengths. We unite our skills to be the guardians of the digital age, securing the online world from unseen dangers through the power of teamwork.

TIAN SANG Tian Sang was born and grew up in China and moved to Australia in 2013 to pursue her studies. She lives in Melbourne. She recently gained a Cert IV in Cyber Security from Holmesglen Institute of TAFE and is now studying to gain industry certifications, including CompTIA Security+ and Network+, whilst seeking employment in cybersecurity.

Cert IV in Cyber Security Graduate at Holmesglen Institute of TAFE

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

My experience since I started my journey has helped deepen my understanding of the field.

Initially, I perceived cybersecurity to be a highly technical, focused field. As I progressed my studies and connected with people already in the field, I discovered its multidisciplinary nature.

Cybersecurity goes beyond technical skills; it weaves together technical expertise, strategic thinking, communication and collaboration skills, and a deep understanding of human behaviour. This realisation

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

broadened my perspective. I started to shift my focus

I like to use superhero stories to explain to my kids

meaningful contributions to the field.

beyond acquiring only technical skills to rediscover and leverage my transferable skills, seeking ways to use my existing skillset to make positive impacts and

what I’m studying and what I want to be in the future. the field.

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

Cybersecurity is like stepping into the shoes of

Upon graduation my aim is to secure a position

a digital superhero where every day presents an

within a cyber defence team. I believe working in

opportunity to be the guardian of the digital realm.

this area will not only allow me to establish a robust

Just like Iron Man engineering his suits to protect

foundation of technical skills, analytical skills and

the world, a cybersecurity professional engineers

problem-solving skills, but will also enhance my

defences to shield organisations from cyber threats.

resilience, my ability to learn and adapt, and my

We also have the Black Widows of the digital world,

ability to communicate and coordinate in swiftly

unravelling the intricate webs of cybercriminals

changing situations. These competencies closely

and ensuring the safety of sensitive information.

align with my current skillset and will contribute to

And when there are malicious forces, Thor of

my long-term career goal.

I think it applies to anyone who is unfamiliar with

cybersecurity will jump in and wield his mighty

exhilarating journey of collaboration that allows

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

individuals to channel their inner superhero and

I have been fortunate to connect with exceptional

hammer of threat detection and response.

In essence, a career in cybersecurity is an

I S S U E 19

WOMEN IN SECURITY MAGAZINE

95

TIAN SANG

applications, bringing unique insights from

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management? If yes, why?

their areas of expertise. From these mentors I

Yes. Technical proficiency is indeed important,

learnt that purpose, persistence and resilience

but it alone is not sufficient for success. Soft

are the most important factors for a successful

skills, particularly interpersonal communication

career in cybersecurity. The valuable advice and

and management skills, are essential. Effective

encouragement I’ve received from them have been

communication is pivotal for translating complex

very helpful as I navigated my career path. They have

technical information into understandable terms, for

also enriched various aspects of my life.

facilitating collaboration with diverse teams, and for

mentors from various domains of cybersecurity during my cyber journey. They have provided guidance in my learning, the development of my practical skills, and my preparation for job

building relationships with stakeholders. Moreover,

Recount the most memorable or significant event in your cybersecurity journey to date, highlighting why it left a lasting impression.

as I advance in my career, management skills will

Engaging in the Purple Team Program stands out as

cybersecurity measures. During the early stages of

a memorable highlight in my journey. This program

my career I aim to improve my technical expertise

focused on empowering women in cybersecurity.

and to cultivate a well-rounded skillset that will

It offered theoretical and practical training and

contribute to my competence in a future role.

become crucial for leading projects and teams, and for ensuring the strategic implementation of

mentorship that significantly shaped my skills and

network. I gained a great deal from this program and

Are you actively engaged in the broader cybersecurity community? If so, what has been your involvement, and how has it enriched your experience?

would recommend it to every woman who is looking

Yes. I have participated in industry events like BSides,

to navigate a career in cybersecurity.

volunteered at

understanding of the field. The hands-on experiences provided a valuable perspective, while connecting with mentors and peers expanded my professional

CyberCons, and I am

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

a member of AWSN.

While I have not yet secured employment or an

providing networking opportunities,

internship my active involvement in programs such

mentorship and exposure to diverse

as the Digital Jobs Program, Purple Team Program

perspectives.

My involvement has enriched my experience by

(providing incident response simulations and CTF

contributing immensely to my overall readiness for a

Reflecting on your journey thus far, would you, with the benefit of hindsight, make any changes to your career trajectory? If yes, what adjustments would you consider?

professional role.

Reflecting on my journey, I would not

challenges), and the AWSN Incident Response Competition has greatly enhanced my practical experience. These initiatives gave me opportunities to apply theoretical knowledge, to sharpen my technical skills and to navigate real-world scenarios,

96

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

alter my career trajectory. Every step, from my past job experience and my recent academic pursuits to my participation in competitions and community engagement, has been integral to my growth in cybersecurity. I deeply appreciate the diverse range of experiences that have steered my path, providing me with a comprehensive skillset and a profound understanding of, and passion for, the industry.

Have you actively sought employment opportunities in cybersecurity, and if so, what has been your experience with the application and interview process?

Yes, I have been actively pursuing entry-level positions in both the private and public sectors, ranging from internship programs, graduate programs and cadetship programs to entrylevel analyst roles. The application and interview processes proved to be highly competitive and challenging. While I have not yet secured a role, I see these experiences as valuable learning opportunities.

I gained practical insights during my preparations for interview, and the feedback provided always gave me a fresh perspective, enabling me to identify areas for improvement.

www.linkedin.com/in/tian-sang-42856079

I S S U E 19

WOMEN IN SECURITY MAGAZINE

97

Big Picture Easy Reliable No job is too big or too small.

We look after your marketing & content needs so you can get on with what you do best.

GET CONNECTED AND TAKE CONTROL OF YOUR BUSINESS SUCCESS TODAY!

charlie@source2create.com.au

aby@source2create.com.au

Need a professional marketing, strategy and implementation agency that is dedicated, responsive, professional, creative, innovative, hardworking, and really cares about your business outcomes?

Then let us help YOU. REACH OUT TODAY FOR AN INSTANT QUOTE. The team at Source2Create has all the necessary skills to get the job done for you, so your time can be reserved to focus on other things.

With:

aby@source2create.com.au charlie@source2create.com.au source2create.com.au

My journey into cybersecurity started when I saw the complexity and mystery surrounding code. However, my view has changed significantly. I now see that cybersecurity entails much more than the intricacies of coding. It encompasses strategic thinking, risk BASILA SHAMSUDEEN SHAFFI

management and technological competence. It serves as a dynamic guardian of digital landscapes,

Basila Shamsudeen Shaffi grew up in Chennai (formerly Madras) in South India. Her career began in education, teaching ICT, Computing and STEM subjects to students from diverse cultural backgrounds at schools in India. She now lives in the United Arab Emirates, where she has been an ICT/computing/STEM educator in several institutions, including Raffles International School, Victoria English School, and GEMS Winchester School.

involving ethical considerations, legal frameworks

Basila holds a master's degree in cybersecurity from Cyber Heals Academy, an MSc in computer science and bachelor's degrees in education and computer applications.

community engagement. I am particularly motivated

and an understanding of the human element. Today, cybersecurity is a blend of technical skills, strategic thinking and ethical awareness.

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

I aspire to a role that aligns with my multifaceted skillset and fervent commitment to education and to contribute to defensive cybersecurity domains, focusing on roles such as security awareness and training, security analysis, security architecture, and digital forensics. This choice is driven by my desire to leverage my mentoring, classroom management and communication skills to instil security awareness

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

into student communities and empower women in

When introducing cybersecurity to beginners, it’s vital

alignment between the diverse landscape of

to craft compelling narratives emphasising the field’s

defensive cybersecurity and my personality

significance. Cybersecurity professionals operate

traits, which include confidence, empathy and an

on the frontline, defending digital systems against

adventurous spirit. I envision a role where I can

diverse threats. Their role extends beyond finance,

actively address the evolving challenges in the

impacting national security and societal resilience.

field while also making a meaningful impact on

Cybersecurity is not only a job; it’s a position at the

individuals facing mental challenges. This aspiration

forefront of digital defence, offering the excitement

is not merely a career choice but a commitment to

of combating new threats. I would aim to spark

fostering an inclusive and secure digital environment.

the field.

My journey in cybersecurity represents a meticulous

curiosity and highlight the career’s importance, emphasising the feeling of being on the front line of a

In actively seeking employment opportunities, I

dynamic digital battlefield.

approach the application and interview process with a tailored resumé, highlighting my adaptability and

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

100

W O M E N I N S E C U R I T Y M A G A Z I N E

my diverse skillset. By undertaking thorough research on each role and by actively engaging in interviews I aim to convey my passion for cybersecurity, my readiness for continuous learning and my dedication

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

to contributing meaningfully to the cybersecurity

Maitha Al Shamsi, information security analyst,

community. Each step in this process is a valuable

Telecommunications and Digital Government

learning experience, reinforcing my determination

Regulatory Authority (TDRA) - UAE

to make a successful career transition into this critical domain.

Aisha Al-Marzooqi, cybersecurity capacity development analyst, Telecommunications

When you decided to pursue a career in cybersecurity, how did your parents, peers or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

and Digital Government Regulatory Authority

My parents, peers and career advisors initially

Park (DCIP) - UAE

(TDRA) – UAE Dr Bushra Al-Blooshi: advisory board, senior consultant, and chairwoman, Dubai Cyber Innovation

expressed some objections and unfavourable perceptions. Despite a successful decade in

Dr Huda Al-Khuzaimi: assistant professor of research

teaching, my passion for cybersecurity persisted. I

and director of the Cyber Security Centre at New York

encountered challenges, but my unwavering interest

University Abu Dhabi (NYUAB) – UAE

triumphed over obstacles. The master’s program at Cyber Heals Academy aligned with my financial

Dr Reem Faraj Al-Shammari: global thought leader

considerations and provided extensive exposure to

in cybersecurity and digital transformation; director

the cybersecurity domain.

of research and innovation Department of Dubai Electronic Security Centre (DESC) – UAE

Today, I stand confident and accomplished, empowered by a diverse educational background

Simultaneously, my career journey has been

and a profound understanding of cybersecurity.

significantly shaped during my tenure at Victoria

My vision is to instil security awareness into the

English School, UAE by senior leader Keith Sykes. In

student community and support individuals facing

addition, the unwavering support from my mentor,

challenges, combining my teaching expertise with

Dr Mohamed Ibrahim, in the Cyber Heals Academy

cybersecurity skills.

master’s program significantly influenced my approach to cybersecurity. His excellence in course

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

delivery and steadfast support inspired me to aspire

The most influential people in my cybersecurity

impactful contributions to the cybersecurity

journey are the inspiring women leaders and mentors

landscape. The combined influence of all these

listed below.

figures underscores the importance of diversity

to leadership roles.

Both figures contributed to my goal of making

and mentorship in shaping successful careers in cybersecurity.

Recount the most memorable or significant event in your cybersecurity journey to date, highlighting why it left a lasting impression.

The most memorable event in my cybersecurity learning journey occurred during my time at Cyber Heals Academy where I embarked on a

I S S U E 19

WOMEN IN SECURITY MAGAZINE

101

BASILA SHAMSUDEEN SHAFFI hands-on project that simulated a real-world

In my dedicated pursuit of professional growth, I

cyber threat scenario. This experience exposed

am strategically mapping out my journey to acquire

me to the complexities of incident response and

certifications that will significantly elevate my

the requirement for swift decision-making and

cybersecurity expertise. Currently, my focal points

collaboration. The project enhanced my technical

are the ISC2 Certified in Cybersecurity (CC), Certified

skills and provided a profound understanding of the

Information Systems Security Professional (CISSP)

challenges faced in the field.

and EC Council’s Certified Ethical Hacker (CEH) Master. These certifications, renowned for their

Additionally, my personal exploration involved in-

stringent standards and industry relevance, mark

depth research on emerging cybersecurity topics

essential milestones in my commitment to staying

such as AI-driven threats and blockchain security.

ahead in the dynamic field of cybersecurity.

Unravelling these complexities not only broadened my knowledge but also instilled a deep appreciation

My certification roadmap extends to specialised

for the ever-evolving nature of cybersecurity. These

credentials in cyber defence, such as CRISC and

combined experiences have significantly shaped my

GSEC to enhance my skills in incident response,

learning journey and demonstrated the importance

threat intelligence and security architecture. This

of practical application and continuous exploration in

deliberate approach reflects my proactive dedication

the dynamic realm of cybersecurity.

to continuous learning, ensuring preparedness for the evolving challenges in cybersecurity.

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

Beyond certifications, my future plans are to immerse myself in hands-on experiences through cybersecurity internships and defence projects,

I have actively sought practical experiences to

actively participating in lab exercises to hone my

complement my theoretical knowledge through lab

skills. These practical engagements will not only

exercises and projects on various capture the flag

provide valuable insights but also function as a

(CTF) platforms. By engaging in practical projects

catalyst for my career transformation.

at Cyber Heals Academy I have contributed to implementing security measures and analysing

My initiative-taking pursuit of certifications and

network traffic. Today, I participate in penetration

practical experiences aims to fortify my knowledge

testing and threat intelligence projects.

base, positioning me to contribute effectively to the dynamic cybersecurity landscape. I am eager to

These experiences have enhanced my technical

leverage these skills to make a meaningful impact in

skills and fostered effective communication and

my future endeavours and contribute to the broader

collaboration in a professional cybersecurity setting.

cybersecurity community.

They have provided a comprehensive understanding of challenges and responsibilities in the field, strengthening my dedication to a successful cybersecurity career.

The cybersecurity industry offers various certifications from different organisations.

Have you pursued, or do you plan to pursue any of these certifications? If so, which ones, and what factors influenced your choice?

102

W O M E N I N S E C U R I T Y M A G A Z I N E

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape?

Yes, the program at Cyber Heals consistently aligns with the rapidly evolving cybersecurity landscape.

The curriculum is forward-looking, integrating the latest industry trends and cutting-edge technologies.

Regular updates ensure relevance to current threats

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

and practical experiences such as hands-on projects

current with evolving technology

and internships, provide a real-world perspective.

through industry publications and

Networking opportunities with industry professionals

webinars.

further enrich my understanding. Overall, the program effectively keeps pace with the dynamic nature of

I take a holistic approach to

cybersecurity threats, ensuring I am well-prepared for

cybersecurity through cross-

the professional realm.

disciplinary research and active participation in industry events. I

What aspect of your cybersecurity studies excites you the most, and why? Conversely, which aspect of your studies do you find least interesting or useful, and how do you navigate through it?

apply my theoretical knowledge through hands-on experiences, engagement in projects and participation in capture the flag challenges.

I am most enthusiastic about the exploration of network security. Initially, I perceived it as being

I am grateful to the Cyber Heals master’s program

intricate, but through resource exploration, hands-

and to Dr Mohamed Ibrahim for his mentorship,

on labs and the use of tools like Wireshark and

for providing a structured learning path and

Metasploit I now find it captivating. The satisfaction

for helping me overcome challenges and build

I have derived from identifying network threats and

confidence. All these challenges served as catalysts

vulnerabilities through practical applications has

for improvement.

become a notable achievement.

standards initially held less appeal. However,

Do you believe there are areas in cybersecurity that deserve more emphasis in your coursework or areas that could receive less focus?

recognising their significance, I adjusted my

With the escalating threat landscape there needs

perspective and delved into privacy policies and

to be more emphasis on offensive security,

frameworks. This exploration kindled a particular

ethical hacking and penetration testing to equip

interest in formulating policies tailored for specific

professionals with the skills needed to identify and

demographics, such as students and women.

address vulnerabilities before malicious actors can

Overcoming the perceived monotony, I adopted

exploit them.

Certain topics such as security operations centre (SOC), firewall configuration and routine compliance

a growth mindset and approached learning with enthusiasm and dedication. The incorporation of

Moreover, with the pervasiveness of cloud

artificial intelligence into cybersecurity systems is

technologies and IoT devices, there is a compelling

equally exciting, facilitating real-time threat detection

need to accentuate coverage of cloud security and

and response.

the integration of robust cybersecurity measures into IoT ecosystems.

Are there specific aspects of your cybersecurity studies that you find particularly challenging? If so, what are they, and how do you approach overcoming these challenges?

The human factor is also a critical vulnerability, making training on cybersecurity awareness and the psychology of social engineering essential.

I address challenges with a systematic approach,

I also believe a profound understanding of

breaking down complex topics, collaborating with

human psychology is necessary to counter social

peers, and gaining hands-on experience through

engineering attacks. Training on mitigation strategies

platforms like TryHackMe and Cybrary. I stay

and training using simulated social engineering

I S S U E 19

WOMEN IN SECURITY MAGAZINE

103

BASILA SHAMSUDEEN SHAFFI attacks should be integral to coursework, because

Cybersecurity professionals equipped with these

social engineering attacks are on the rise.

non-cyber skills can proactively respond to challenges, assess risks, and formulate effective

However, the focus on new threats should not be

solutions, fostering a resilient cybersecurity posture.

at the expense of traditional topics. A well-rounded cybersecurity curriculum should strike a balance between emerging trends and foundational principles to prepare professionals for the evolving challenges of the field.

Are you actively engaged in the broader cybersecurity community? If so, what has been your involvement, and how has it enriched your experience?

I have gained valuable insights from my involvement

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management?

If yes, why?

in diverse cybersecurity communities such as

In the evolving field of cybersecurity, a well-

engagements have significantly enhanced my

rounded skillset is vital. Proficiency in interpersonal

comprehension of the industry and its evolving

communication is crucial. It enables cybersecurity

technologies. Moreover, I have had the privilege of

professionals to convey complex technical

being able to establish connections with exceptional

concepts to diverse stakeholders. Leadership

leaders and female role models within the

and management skills are equally important to

cybersecurity domain.

Women in Cybersecurity Middle East, Women in Cybersecurity Australia, Women Know Cyber Group, Ibby Mentorship Inner Circle, Dark Reading, and various cyber conferences and forums. These

facilitate effective team coordination and advocacy for cybersecurity initiatives at organisational

I believe active participation in broader communities,

levels. These skills contribute to strategic thinking,

especially those communities focused on women,

prioritisation and the guidance of teams towards

is conducive to career growth and can create a

successful security outcomes.

supportive atmosphere for aspiring individuals.

Such an extended network assures professionals

The integration of non-cyber skills with technical

of support from their peers and mentors. Access

proficiency is needed to align security efforts with

to the knowledge, connections and experiences

broader business objectives. This alignment is

of seasoned leaders enables more informed and

essential for gaining executive support, securing

strategic conversations. The broader cybersecurity

resources and ensuring cybersecurity aligns with

community, beyond the confines of the workplace,

organisational goals. Additionally, adaptability

serves as a secure space for networking,

and critical thinking skills are indispensable for

fostering valuable connections and nurturing

addressing the dynamic nature of cyber threats.

professional relationships.

What is your preferred source for staying informed about cybersecurity trends and general information?

To stay informed about cybersecurity and gain a comprehensive understanding of the evolving cybersecurity landscape: • I follow key publications like Dark Reading and Cyber Scoop for in-depth analyses and real-time

104

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

updates on emerging threats; • I use platforms such as Coursera, LinkedIn

S P O T L I G H T

security of my digital identity. I regularly update my software, including operating systems and security

Learning and Udacity for curated courses by

applications to ensure I benefit from the latest

industry experts;

patches and enhancements, reducing vulnerabilities.

• I read thought-provoking blogs from industry

I have implemented multifactor authentication for

leaders like Brian Krebs (KrebsOnSecurity) for

access to critical accounts, adding an extra layer of

nuanced insights;

security and enhancing overall resilience. I exercise

• I listen to cybersecurity podcasts like Security

caution in my online activities, especially on social

Now and The Cyber Wire for engaging

media. To mitigate potential privacy threats I refrain

auditory learning;

from oversharing personal information. I conduct

• I stay updated in real-time by following reputable

regular audits of my online accounts and activities,

experts, organisations and thought leaders on

including scrutinising access logs and monitoring

platforms like Twitter;

financial statements, enabling me to promptly

• I participate in cybersecurity events like Black Hat and RSA Conference for live interactions and

identify irregularities and take swift action in case of unauthorised access or suspicious activity.

networking.

Have you ever encountered situations where being a woman in cybersecurity made you feel disadvantaged or discriminated against? If so, please share your experiences.

Reflecting on your journey thus far, would you, with the benefit of hindsight, make any changes to your career trajectory? If yes, what adjustments would you consider?

A few years ago, recognising the need for a shift,

I am fortunate not to have encountered noticeable

I strategically explored cybersecurity’s diverse

instances of gender imbalance. Despite some

domains and shifted my focus from penetration

isolated incidents, my overall experience has been

testing to defensive cybersecurity. This transition

positive and supportive, largely due to the inclusive

allowed me to contribute to student communities,

work environments I have been part of.

empower women and support individuals with mental challenges.

Open dialogue and advocacy are required to address diversity and inclusion issues. Fortunately,

My advice to aspiring cybersecurity professionals,

the institutions I have been part of have been

especially women, is to align their skills and

proactive in addressing gender-related challenges

aspirations with the evolving landscape of

by implementing programs to foster an inclusive

cybersecurity. Challenges are learning opportunities,

environment. I acknowledge the gender disparity

and seeking support from mentors and colleagues is

in cybersecurity, but I see it as an opportunity for

crucial in this constantly changing field. Embracing

positive change. By promoting inclusivity, engaging

the evolving nature of cybersecurity and staying

in open conversations and advocating for diversity,

focused on aspirations can produce both emotional

we can contribute to cultivating a more balanced and

and financial rewards.

innovative cybersecurity landscape.

My career trajectory, marked by introspection and

What measures do you have in place to enhance your personal cybersecurity in today’s digital landscape?

adaptability, underscores the significance of aligning one’s professional path with personal aspirations in the ever-changing field of cybersecurity.

I employ a sophisticated password manager to generate and manage complex, unique passwords for each online account, bolstering the overall

I S S U E 19

Have you actively sought employment opportunities in the cybersecurity field, and

WOMEN IN SECURITY MAGAZINE

105

BASILA SHAMSUDEEN SHAFFI

if so, what has been your experience with the application and interview process?

In my pursuit of a career transition into cybersecurity I have encountered both challenges and enriching experiences. Applying for jobs required me to tailor my resumé to various cybersecurity job domains in order to showcase my diverse skill set and adaptability. By thoroughly researching each role I was able to fine tune my application and hold informed discussions during interviews.

Interviews, though demanding, proved to be valuable learning experiences. Engaging with industry professionals allowed me to express my passion for cybersecurity and demonstrate how my educational background aligned with the field. Emphasising a commitment to continuous learning and a proactive mindset, I demonstrated my readiness for the dynamic cybersecurity environment. Each application and interview has contributed to my growth, reinforcing my dedication to a successful career transition into this critical domain.

www.linkedin.com/in/basila-shamsudeen-shaffi

106

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

ELISABETH CHEN Elisabeth Chen studied cybersecurity at Liberty University Online, based in Virginia, US. She first gained a general information systems degree and then went on to gain a master’s in cybersecurity.

Young Cybersecurity Professional

“I’ve always wanted to work in IT but I didn’t know

She adds: “I believe soft skills are just as important

that I wanted to be in cybersecurity specifically until

as hard skills to being a good cybersecurity

I was in college,” she says. “My current job is my first

professional. Understanding how to communicate,

in the industry and I work as a cybersecurity analyst.

especially with people who aren’t very good with

I hope to work toward earning several certifications

technology is very important to being good at my job.

as I progress in my career. I’ve earned my CC from ISC2, and I hope to go on to earn my security + and

“Creativity makes all the difference, because

perhaps a networking + certification as well.”

solutions are rarely straightforward. While I did work towards these skills in my education, I also found communities in platforms like LinkedIn and publications where I could hear from others and read up on modern issues.”

Chen says she was one of the few females in her classes and is presently the only female cybersecurity professional in her workplace.

“However, I have been very lucky in that I never felt disadvantaged. My colleagues have been great and do a great job fostering equality. I have no regrets about my career choice, but I do wish I had taken more programming and networking classes at school.

www.linkedin.com/in/elisabeth-chen-6ba66126b

I S S U E 19

WOMEN IN SECURITY MAGAZINE

107

about understanding the intricate dance between attackers and defenders, constantly evolving strategies to outsmart adversaries and staying ahead of emerging threats.

AROOJ FATIMA

Through experiences in vulnerability analysis and threat detection I’ve learned the importance

Arooj Fatima grew up in Pakistan and now lives in Perth where she is in the final year of a Masters of Cybersecurity course at Edith Cowan University.

Masters of Cybersecurity Student at Edith Cowan University

of creative problem-solving, swift reaction and continuous learning in navigating the dynamic landscape of cybersecurity. These insights have fuelled my passion for the field, driving me to embrace resilience, innovation and to relentlessly pursue excellence in safeguarding digital environments.

My journey in cybersecurity has been a revelation,

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

transforming my initial perceptions into a deeper,

I say: picture being the defender of the digital

threats, has underscored the importance of

realm, safeguarding it against invisible threats

adaptability, critical thinking and proactive defence

and ensuring the security of this online world. I

strategies. My passion for cybersecurity remains

tell them cybersecurity is not only about code or

unwavering, despite the evolving nature of cyber

computer geeks; it’s about thinking strategically,

warfare. That desire is fuelled by a commitment to

collaborating effectively and adapting to an ever-

constant growth, innovation and the protection of

evolving landscape.

digital assets against ever-evolving threats.

I explain that my passion for cybersecurity stems a tangible impact in the digital space. I tell them

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

cybersecurity offers an exciting career path filled

My aspiration is to secure employment in

with opportunities to make a difference and be at the

vulnerability assessment and forensics. Motivating

forefront of innovation in the digital age.

this choice is the opportunity to delve into the

from the thrill of solving complex puzzles and making

more nuanced understanding of the field’s complexities and challenges. Each experience, from uncovering vulnerabilities to detecting emerging

intricate layers of digital systems, uncovering

108

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experience today compare?

vulnerabilities and fortifying defences against

My initial attraction to cybersecurity stemmed from

because it involves not only identifying weaknesses

a desire to protect digital assets and combat cyber

in digital infrastructures but also devising robust

threats. However, as I’ve delved deeper into the field,

strategies to mitigate risks and enhance overall

I’ve realised cybersecurity is a multifaceted domain

security postures. Similarly, the field of forensics

that extends far beyond conventional perceptions.

intrigues because it offers the chance to investigate

It is not only about building digital fortresses; it’s

cyber incidents, analyse digital evidence and piece

W O M E N I N S E C U R I T Y M A G A Z I N E

potential threats.

The role of a vulnerability assessor appeals to me

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

together the intricate puzzle of a cyberattack. The

of Finance, where I aim to further enhance my

prospect of contributing to the proactive defence of

practical skills and contribute effectively to the

digital assets and aiding in post-incident analysis

cybersecurity team.

drives my aspiration towards these specific cybersecurity roles.

When you decided to pursue a career in cybersecurity, how did your parents, peers, or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

The cybersecurity industry offers various certifications from different organisations.

Have you pursued, or do you plan to pursue any of these certifications? If so, which ones, and what factors influenced your choice?

I am working towards obtaining ISC2 certification and passing the Microsoft Exam SC-900. These

I was lucky to have strong support from my family,

align closely with my career goals and aspirations

professors and friends. My professors recognised

because they provide comprehensive coverage of

my knack for creative problem-solving and my

essential cybersecurity concepts and technologies.

love for tackling complex challenges. During my

Additionally, they are recognised and respected

undergraduate studies I discovered my passion for

within the industry, so will increase my credibility as

data science, where I enjoyed analysing data to find

a cybersecurity professional.

patterns and make predictions, especially with the help of artificial intelligence. It was during this time

I also plan to pursue CISSP certification, because it

I became interested in cybersecurity after working

is widely regarded as a benchmark for cybersecurity

on a project where I used data to detect malicious

expertise and leadership. By obtaining these

activities in networks. This experience ignited my

certifications, I aim to demonstrate my commitment

interest in cybersecurity and inspired me to pursue

to continuous learning and development in

a career protecting digital assets and fighting

cybersecurity while enhancing my skillset to

cyber threats.

meet the evolving demands of the industry.

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

I have actively sought practical experience through virtual internship programs during my semester breaks. I participated in programs offered by Forage for companies like ANZ and Deloitte, where I gained valuable insights into the field of cybersecurity and developed practical skills.

These experiences allowed me to apply my academic knowledge to realworld scenarios and understand the practical implications of cybersecurity in professional settings. Additionally, I am eagerly looking forward to starting my work placement this year with the Department

I S S U E 19

WOMEN IN SECURITY MAGAZINE

109

AROOJ FATIMA

Given the rapid evolution of cybersecurity threats, do you feel your academic program adequately keeps pace with the industry’s current landscape?

While my academic program provides a strong foundation in fundamental concepts and principles, I believe there is always room for improvement to ensure alignment with the industry’s current landscape. To address this, I actively seek out additional learning opportunities beyond the classroom, such as online courses, workshops and participation in cybersecurity communities.

theoretical frameworks and abstract concepts.

These endeavours allow me to stay informed about

However, recognising the importance of a

the latest developments, emerging threats and

comprehensive understanding, I navigate through

best practices. Additionally, by pursuing industry

these less stimulating areas by seeking practical

certifications and LinkedIn learning and engaging

applications or real-world examples that demonstrate

in hands-on project, I will further enhance my

their relevance. Additionally, I often engage in

practical skills and readiness to tackle real-world

discussions with peers and mentors to gain

cybersecurity challenges.

alternative perspectives and insights, which help me to contextualise the material and make it more

What aspect of your cybersecurity studies excites you the most, and why?

engaging. This approach ensures that, even in areas

The fusion of data analysis with security strategies

grasping the underlying principles and their practical

excites me the most. Coming from a computer

implications for the cybersecurity landscape.

where my interest might wane, I remain committed to

science background, I’m drawn to the practical application of analytic techniques to identify and mitigate cyber threats. This interest grew from my

www.linkedin.com/in/fzahoor13

involvement in projects where I used data analysis to proactively address vulnerabilities and enhance cybersecurity measures.

The ability to uncover patterns and anomalies within datasets not only enables potential cyber attacks to be predicted and prevented, it also underscores the critical role of data-driven decision-making in bolstering digital defences. This combination of analytical skills and cybersecurity expertise ignites my passion for exploring innovative solutions to safeguard digital assets and tackle emerging threats.

Conversely, which aspect of your studies do you find least interesting or useful, and how do you navigate through it?

I occasionally encounter topics that feel less captivating, particularly those centred around

110

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

a lack of initial qualifications or of experience.

She emphasises the importance of university study focusing on NICKY BRYANT

various aspects of cybersecurity to build a strong foundation. When

Student specialising in security and intelligence in Arizona, USA

contemplating job offers, she emphasises the significance of company culture.

She acknowledges the substantial

Nicky Bryant is a dedicated student specialising in

influence of her professors and

security and intelligence in Arizona, USA. Here, she

mentors on her cybersecurity

shares her journey into the realm of IT security. Her

career and recommends students build connections

insights provide a glimpse into the evolution of her

with educators who can serve as valuable mentors.

passion and the challenges she has faced.

The most satisfying aspect of Bryant’s current role When she was young her interest in public service

is her awareness that her work in cybersecurity

led her to consider law enforcement as a career.

has a genuine impact on the world and this

However, when she explored the diverse programs

compensates for the challenges of maintaining work/

in security, cyber and intelligence at her current

life balance and clear boundaries, and embracing

university, she discovered the captivating world

leadership roles.

of cybersecurity.

To stay current and effective in her role, Bryant During her university years, Bryant developed a deep

engages in daily briefings, subscribes to reputable

affinity for preventative security: averting incidents

sources and actively participates in cybersecurity

and attacks before they become real threats.

conferences. She emphasises the value of

Reflecting on the early stages of her career, she

belonging to industry groups and advises individuals

emphasises the complexity of constantly analysing

transitioning into the field to embrace their strengths

unforeseen aspects and biases, a challenge she finds

and apply their diverse skills.

both daunting and fascinating.

Her journey is an inspiration to those navigating the Bryant also has a passion for emergency medical

intricacies of cybersecurity, showcasing resilience,

services (EMS) and was uncertain whether to pursue

passion and a commitment to making a tangible

this as a career rather than cybersecurity. She feels

impact on the world.

fortunate to have found a balance between these two significant interests by pursuing EMS in a volunteer capacity.

Bryant’s journey in cybersecurity progressed without a predefined vision of specific roles. Her advice to her high school self and other aspiring cybersecurity professionals would be to start from the ground up, stay hungry for knowledge, and not be deterred by

I S S U E 19

WOMEN IN SECURITY MAGAZINE

111

studying it, how does the reality of your experiences today compare?

I initially envisioned a highly specialised and technical field, thanks in part to how cybersecurity is portrayed in the media. It seemed to be a mysterious domain, DEVYANI BHATTACHARYA

shrouded in complexity. Yet, as I embarked on this journey, I soon realised my assumptions were far

Devyani Bhattacharya was born in Madhya Pradesh, India and moved to Sydney when she was 10 years old. She is studying at Macquarie University for a Bachelor of Information Technology with a major in cybersecurity and a minor in AI. She is at the start of her third year and expects to graduate in June 2025. She also has an intern role as a cyber risk consultant at GuardWare Australia..

from reality. Cybersecurity professionals are not

Bachelor of Information Technology Student at Macquarie University

or background but an open mind. With plenty of

solitary figures hidden behind screens in dimly lit rooms. They are just like any other corporate individuals, collaborating with colleagues and making things happen.

I was initially pursuing psychology at university, so a switch to cybersecurity was daunting.

However, I decided to go ahead with no experience resources out there and a very supportive community keen to welcome me, I’ve never felt more passionate about anything.

As I delved deeper into the realm of cybersecurity

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

I quickly realised there’s a diverse range of roles to

Cybersecurity is a fast paced and captivating

and security operations centre analyst stood out.

industry. It offers challenges and opportunities and

Cybersecurity embraces a wide range of skillsets and

a chance to expand your knowledge and skills. With

preferences, whether you lean towards the technical

threats in the digital landscape constantly on the

aspects or prefer a more people-oriented role.

explore. For someone like me, who has an analytical mind and thrives on social interaction, positions such as consultant, incident response team member

rise, cybersecurity professionals are in high demand.

stability and financial rewards, cybersecurity has got

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

you covered.

My career aspirations in cybersecurity are driven by

This demand translates into promising salaries.

So, if you’re looking for a career path that offers

my passion for teamwork, my analytical mindset Lastly, one of the most striking aspects of the

and my desire to make a meaningful impact

cybersecurity community is its inclusivity. Regardless

defending against cyber threats. I am excited about

of your background or skill level there’s a place

the prospect of contributing to the security of

for you in this field. It’s a welcoming environment

organisations and helping to safeguard their digital

where diversity is celebrated and where everyone is

assets. Specifically, I’m drawn to security operations

encouraged to pursue their passions.

centre analyst, incident response, blue team and/or consulting roles.

Reflecting on your initial perceptions of cybersecurity when you first considered

112

W O M E N I N S E C U R I T Y M A G A Z I N E

My motivation for choosing these roles stems from

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

my preference for collaborative environments rather

by the investigative aspect of digital forensics and

than independent work. Additionally, I’m motivated

the crucial role it plays in incident response and

by the opportunity to use my analytical mind to

threat detection.

solve complex problems and mitigate security

my experience at the AWSN Incident Response

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

competition in 2023. During the competition my

The most influential factor thus far has undoubtedly

team and I were immersed in a simulated cyber crisis

been my aunt. Despite her living in the USA and me

scenario, mirroring real-world incidents. We had to

seeing her only every couple of years, her impact

respond swiftly and effectively using various skills

on my career path has been profound. She’s deeply

such as digital forensics, network traffic analysis

involved in cybersecurity, specialising in architecture.

and communication, with stakeholders such as

While she did not directly push me into cybersecurity,

board members. This experience provided invaluable

her passion for IT and technology certainly rubbed off

hands-on exposure and reinforced my desire to

on me. I was initially majoring in business analysis

pursue a career in incident response.

and information systems and, through a few elective

threats effectively.

My interest in incident response was sparked by

courses, I found myself drawn to cybersecurity. Now, Similarly, my internship experience at Sparke

our shared interest has given us even more to talk

Helmore exposed me to the world of blue teaming

about whenever we catch up.

and SOC where I gained valuable insights into defensive cybersecurity strategies and techniques. I

Growing up, I was always drawn to puzzles and

was inspired by the proactive approach of blue teams

mysteries, whether unravelling clues in murder

to identifying and mitigating security risks before

mystery games or piecing together evidence to

they escalate into incidents.

crack the case. Cybersecurity, as it turns out, is like a real-life puzzle-solving adventure, exceeding my

Lastly, subjects such as digital forensics, which I

expectations and constantly capturing my interest.

studied at university, further fuelled my interest in roles within SOC environments. I was fascinated

In addition to my aunt, my father played a significant role in my journey. Working in IT himself, he has been a constant source of motivation and support throughout my degree course. His unwavering encouragement meant the world to me, giving me the confidence and reassurance I needed to pursue my passion for cybersecurity.

In essence, the combined influence of my aunt’s expertise and shared mindset coupled with my father’s unwavering support have significantly shaped my path in cybersecurity, igniting my curiosity and fuelling my aspirations in this dynamic field.

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment

I S S U E 19

WOMEN IN SECURITY MAGAZINE

113

DEVYANI BHATTACHARYA

or internships?

excellent, it’s the sense of camaraderie and

Here’s a breakdown of my main experiences.

collaboration that truly sets Macquarie apart.

Internship at Sparke Helmore. This IT internship

Participating in hackathons, workshops and other

provided me with invaluable exposure to the

events has been incredibly rewarding. I’ve found

security and infrastructure teams. Job shadowing

people with more experience always willing to lend a

SOC analysts and infrastructure specialists

helping hand and provide encouragement, fostering a

gave me a firsthand perspective on how things

culture of continuous learning and growth.

operate in the cybersecurity realm outside of the academic environment.

In particular, my time as a marketing executive at the Women in Computing Society has been

Cisco Mentor Me Program. Participation in this

instrumental in sparking my interest in cybersecurity.

mentorship program equipped me with essential

Organising and collaborating in Introduction to

skills beyond technical expertise, such as interview

Hacking workshops has given me firsthand exposure

skills and LinkedIn profile writing. Additionally, it

to the fascinating world of cybersecurity and its

provided me with access to valuable resources and

vast potential.

helped expand my professional network, which is crucial in the cybersecurity industry.

Moreover, cybersecurity itself is an incredibly dynamic and stimulating field. The constant influx of

GuardWare Cyber Risk Consulting Internship. My

new threats and challenges means there are always

current internship at GuardWare is giving me hands-

unknowns to navigate, keeping me on my toes and

on experience in the consulting side of cybersecurity.

pushing me to stay ahead of the curve. I thrive in

Working with SMEs allows me to gain insights

environments where there’s never a dull moment,

into real-world consulting practices and helps me

and cybersecurity offers endless opportunities for

determine if this career path aligns with my interests

learning and professional development.

and goals.

graduates and actively works to provide practical

Are there specific aspects of your cybersecurity studies that you find particularly challenging? If so, what are they, and how do you approach overcoming these challenges?

experience beyond academic qualifications. The

I can relate to the challenge of coding in

biggest hurdle for anyone starting out in this industry

cybersecurity studies, especially when a semester

is that companies want to hire people with three

feels rushed due to the pressure of other academic

to four years’ experience. Because of this many

units. I’ve found the key to overcoming this challenge

newcomers struggle to get their initial breakthrough.

lies in proactive preparation and seeking out

By offering opportunities for hands-on learning and

additional resources for support. I make it a habit

mentorship, GuardWare is not only preparing interns

to familiarise myself with the syntax and language

like myself for the industry but also addressing the

usage well in advance. By reviewing a couple of

need for experienced personnel in cybersecurity.

weeks before the semester begins, I can hit the

It is commendable that GuardWare recognises the challenges facing cybersecurity interns and

ground running when classes start and have a solid

114

What aspect of your cybersecurity studies excites you the most, and why?

foundation to build upon.

What excites me the most is the vibrant and

Moreover, I actively seek out supplementary

supportive community at Macquarie University.

resources to reinforce my understanding of coding

While the coursework and lecturers are undoubtedly

concepts. This includes textbooks, online tutorials,

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

YouTube videos and other online resources that

With most of my accounts I use MFA for login

provide alternative explanations and examples.

purposes and I use devices with pre-installed antivirus software. Here are additional things I do

Lastly, I take advantage of the assistance and

that help me stay cybersafe.

support available to computing students at my university. Whether it’s attending office hours,

• By using a password manager I can generate and

seeking help from teaching assistants, or

store complex, unique passwords for each of my

participating in study groups.

accounts, minimising the risk of a breach if one password is compromised.

Do you believe there are areas in cybersecurity that deserve more emphasis in your coursework or areas that could receive less focus?

While technical skills are undeniably crucial

• By using different email addresses for different purposes (like one for shopping and another for banking) I can compartmentalise my online presence and reduce the impact of a potential breach.

in cybersecurity coursework, there’s room

• By ensuring my social media accounts are set

for additional emphasis on non-cyber skills,

to private I can control who has access to my

particularly interpersonal communication and

personal information and minimise the risk of

management skills.

identity theft or social engineering attacks.

• By avoiding public Wi-Fi networks like those in

In the real world, cybersecurity professionals are

malls or airports, or using my own hotspot, I

not sitting behind screens all day. They are often

reduce the risk of my data being intercepted.

required to communicate complex IT and security information to colleagues and stakeholders who may not have the same technical background, or

www.linkedin.com/in/devyani-bhattacharya-62a44a255

to manage cybersecurity programs. Therefore, strong interpersonal communication skills are essential for effectively conveying information, building relationships and gaining buy-in for security initiatives.

It’s also worth considering the potential pitfalls of solely focusing on technical coursework. Without exposure to non-cyber skills, students may struggle to adapt to the demands of the workplace where effective communication and leadership are often just as important as technical proficiency.

Therefore, integrating training in non-cyber skills into cybersecurity coursework can better prepare students for the holistic requirements of future roles and ensure they are equipped to excel in a variety of professional settings.

What measures do you have in place to enhance your personal cybersecurity in today’s digital landscape?

I S S U E 19

WOMEN IN SECURITY MAGAZINE

115

LISA ROTHFIELD-KIRSCHNER Author of How We Got Cyber Smart | Amazon Bestseller

How Olivia and Jack’s parents handle social media on a sleepover Sleepovers are very popular in Olivia’s and Jack’s circle of friends. Jack had been invited to a summer sleepover with a few other boys to celebrate the end of the school year. He had been previously and liked the adventure of going to a friend’s house. He always took his little bear with him. Even though he had almost finished primary school he liked having a small piece of home with him.

During the past year at school, Jack noticed that many of the children had started using a social media messaging app called Chit Chat. The app was recommended for people 13 and older. Even though none of the children had turned 13 many were using it. Jack was under a lot of pressure from his friends to get the app and use it to connect, and his friends without it were left out. Unfortunately, there were whispers going around about the extent of bullying on the app, and some children were taking photos of each other without permission and posting them in the app. Not everyone misused Chit Chat, but there were always some not doing the right thing.

Some of the parents contacted the school to complain and share their concerns. The school made some announcements and held a parent evening to educate parents and caregivers about the safe use of social media, what to watch out for and how to educate children in the appropriate use of apps and devices.

Olivia, Jack and some of the other girls and boys did not use Chit Chat because their parents did not think it was age appropriate and preferred to follow the recommended age guidelines set by Australia’s eSafety Commissioner.

Before Jack’s upcoming sleepover party at Oliver’s, his mother contacted Oliver’s parents to learn about his family’s house rules around social media and devices.

Oliver’s parents explained they had a “no device in bedrooms or bathrooms rule” and that devices were locked away in a special box overnight. They admitted that, in the past, there had been some problems with their older children spending too much time on Chit Chat, including being involved in online cyber bullying.

116

W O M E N I N S E C U R I T Y M A G A Z I N E

They had also set up time restrictions for their younger children and encouraged their older children to consider how they spent their time online.

In general, they tightly controlled the posting of photos on social media. They did not let their younger children post any photos online without parental permission, and they encouraged their older children to be very mindful of what they were posting online and, with photographs of people, ask permission from the subjects before posting. Issues related to people’s digital footprint were discussed regularly at the dinner table, along with the handling of interactions with strangers.

Olivia’s and Jack’s parents felt a lot more confident about Jack going for a sleepover at Oliver’s house.

They reiterated the following house rules and explained why they were important.

• Devices will be locked away at night and cannot be used in bedrooms or bathrooms, to remove any temptation to use devices when there are no adults around to supervise.

• Posting photos of other people should happen only with their permission.

• If you are contacted by a stranger online do not engage. If this happens, tell an adult and ask for help.

• If you experience cyber bullying, take a screen shot or save the post and tell a trusted adult so they can help you deal with it. You can report it to Chit Chat or the social media platform on which it happened, or to authorities such as the eSafety Commissioner.

• Do not share any personal information with any strangers online, such as where you live, and be very careful when accepting friend requests that the ‘friend’ is who they claim to be. If in doubt, ask a trusted adult for help. www.linkedin.com/in/lisarothfield-kirschner

howwegotcybersmart.com

M A R C H • A P R I L 2024

How We Got Cyber Smart addresses cyber safety, cyber bullying and online safety for elementary school-aged children.

Lisa has partnered with Cool.Org, and her content is found on the Department of Education website.

READ NOW

WOMEN IN SECURITY MAGAZINE CONTRIBUTORS 01

02

1. NATHAN CHUNG

Cloud Security Architect

2. AMANDA-JANE TURNER

03

04

Author of the Demystifying Cybercrime series and Women in Tech books. Conference Speaker and Cybercrime specialist

3. DR FAUZIA IDREES ABRO

Associate Professor, Director DL MSc in Cyber Security and Campus MSc in Information Security at Royal Holloway, University of London

4. KENIA CARVALHO

VP, Regional Information Security Lead at BNY Mellon

05

06

5. ROMA SINGH

Cyber Security Specialist

6. SHEAVY KAUR

Information Security Specialist at RAAFA WA

07

08

7. BETH DWYER

Senior Information Security Consultant, Cyber GRC at MYOB

8. FLORENCE MOTTAY

VP and CISO at Zalando

9. DR MOHUYA CHAKRABORTY

09

10

Director of the Cybersecurity Centre of Excellence at the University of Engineering and Management (UEM) in Kolkata

10. HEIDI MEJIA

Client Executive at Tesserent

11. NALINI JADIA

11

12

Sr Cyber Security Risk Leader

12. CHERYL POME’E

Digital Security Lead, GRC - ALGIM ICT Professional of the Year 2023

13. ASH MOHANAPRAKAS

13

14

Head of Information Security at Vault Platform

14. CRAIG FORD

Head Unicorn – Cofounder and Executive Director, Cyber Unicorns.

Australian Best Selling Author of A Hacker I Am, Foresight and The Shadow World book series. vCISO – Hungry Jacks, Wesley Mission, PCYC and Baidam Solutions

15

16

15. SASHA MULLINS

Strategy & Risk Consulting, CyberCX

16. POOJA SHIMPI

Founder & CEO, SyberNow | We specialise in Security Awareness to Mindfulness Trainings for corporates

17

18

17. JO STEWART-RATTRAY

ISACA’s Oceania Ambassador and Chief Security Officer of Silverchain Group

18. DR VICKI GIBBS

Head of Research, Aspect Research Centre for Autism Practice

118

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

19

20

19. DAHYE BAKER

Web Developer | Consultant at deyst solutions

20. GILY NETZER

21

22

3X CMO, Advisory Board and Member of Forbes Communication Council

21. KAREN STEPHENS

CEO and co-founder of BCyber

22. JASMINE MCCRUDDEN

Cyber Security Recruitment Specialist @ Decipher Bureau

23

24

23. SIMON CARABETTA

Business Development Manager - Cyber Security at Digital Resources Australia

24. LISA VENTURA

Founder, Cyber Security Unity

25

26

25. ANNIE-MEI FORSTER

Senior Cybersecurity Consultant at oobe

26. YASAMAN SAMADI

PhD student in Computer Science at RMIT University

27. BERNIE GARNELL

27

28

Bachelor of Computer Science at Auckland University of Technology

28. TIAN SANG

Cert IV in Cyber Security Graduate at Holmesglen Institute of TAFE

29. BASILA SHAMSUDEEN SHAFFI

29

30

Basila holds a master's degree in cybersecurity from Cyber Heals Academy, an MSc in computer science and bachelor's degrees in education and computer applications.

30. ELISABETH CHEN

Young Cybersecurity Professional

31. AROOJ FATIMA

31

32

Masters of Cybersecurity Student at Edith Cowan University

32. NICKY BRYANT

Student specialising in security and intelligence in Arizona, USA

33. DEVYANI BHATTACHARYA

33

34

Bachelor of Information Technology Student at Macquarie University

34. LISA ROTHFIELD-KIRSCHNER

Author of How We Got Cyber Smart | Amazon Bestseller

I S S U E 19

WOMEN IN SECURITY MAGAZINE

119

S E C U R I T Y E V E N TS

W H AT'S O N I N

March 2024

IETF 119 BRISBANE

In Person Brisbane, Australia 16-22 March

GARTNER SECURITY & RISK MANAGEMENT SUMMIT

In Person Sydney, Australia 18-19 March

VIEW HERE

VIEW HERE

MINORITIES IN CYBERSECURITY (MIC) ANNUAL CONFERENCE

AUSTRALIAN CYBER CONFERENCE

In Person NYLO Las Colinas | Dallas, TX 24-28 March

In Person Canberra, Australia 25-27 March

VIEW HERE

120

W O M E N I N S E C U R I T Y M A G A Z I N E

VIEW HERE

GARTNER IDENTITY & ACCESS MANAGEMENT SUMMIT 2024 UK In Person London, UK 4-5 March

INTERNATIONAL CONFERENCE ON CYBERSECURITY, CYBERCRIME AND CYBERTHREATS

In Person Miami, FL 11-12 March

VIEW HERE

VIEW HERE

APRES-CYBER SLOPES SUMMIT

GLOBAL CYBERSECURITY CONFERENCE 2024

In Person Park City, Utah 19-21 March

VIEW HERE

CISO ADELAIDE

In Person Adelaide, Australia 26 March

VIEW HERE

Online 20-22 March

VIEW HERE

SUNSHINE CYBER CON

In Person Tampa, FL 27-28 March

VIEW HERE

M A R C H • A P R I L 2024

W H AT'S O N I N

April 2024

COMFYCON AU: WINTER EDITION 2024

Online 6 April

VIEW HERE

CORINIUM: CISO PERTH 2024

In Person Perth Convention and Exhibition Centre 16 April

VIEW HERE

I S S U E 19

SECURITY EDGE

In Person Hyatt Regency, Sydney Australia 9 April

VIEW HERE

BLACK HAT

In Person Marina Bay Sands, Singapore 16-19 April

VIEW HERE

GOOGLE CLOUD NEXT'24

In Person Las Vegas, NV, USA 9-11 April

VIEW HERE

WICYS 2024

In Person Nashville, Tennessee 11-13 April

VIEW HERE

INTERNATIONAL THE CONFERENCE ON CYBER CYBERSECURITY SECURITY OF CYBER EXPO PHYSICAL SYSTEMS

In Person Boston, MA 22-23 April

VIEW HERE

In Person Bristol, UK 25 April

VIEW HERE

WOMEN IN SECURITY MAGAZINE

121

THE LEARNING HUB

DATA ANALYTICS COURSE ONLINE

122

This online course is taught by industry experts, so you can be confident that you’ll be learning from the best. By enrolling in this program, you will gain in-demand data analysis skills. Learn how to prepare data, perform data analysis, use data visualization techniques, and more in this Data Analyst course.

FULL STACK WEB AND MOBILE DEVELOPMENT

ONLINE CLOUD ENGINEERING BOOTCAMP

This 22-week course will help prospective job candidates impress employers with their robust knowledge of both backend and front end development. You will learn a wide range of technologies and their applications, including MongoDB and Node.js.

This is an accelerated, 24week training program for IT professionals who want to advance their careers. The curriculum includes live lectures, workshops, and weekly projects covering the concepts and theories of operating systems, networks, and cloud engineering.

VISIT HERE

VISIT HERE

VISIT HERE

SOFTWARE DEVELOPMENT

JAVASCRIPT SHORT COURSE: SYDNEY

INTRODUCTION TO CYBER SECURITY

This 28-week software development course will help you become a developer at a casual pace. In the first eight weeks, you’ll learn all about the basics of front end development, including HTML, CSS, and JavaScript.

If you want to become a web developer, a JavaScript course is a great place to start. Through this course, you will leverage JavaScript’s diverse features to build interactive apps and websites. With world-class practitioners as your instructors.

This two-hour class will give you a comprehensive overview of the concepts and principles of cyber security. Aside from that, you will also learn about cyber security risks and the challenges of designing a security program.

VISIT HERE

VISIT HERE

VISIT HERE

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

FEATURING SECURITY TRAINING RESOURCES THAT ARE AIMED AT INCREASING SECURITY AWARENESS AND HELPING PEOPLE BUILD AND UPSKILL THEIR SECURITY SKILLS.

ANALYZING WITH CLOUDERA DATA WAREHOUSE

BUSINESS ANALYTICS

CYBERSECURITY BASICS

Business Analytics is not based on rote memorization of equations or facts, but focuses on honing your understanding of key concepts, your managerial judgment, and your ability to apply course concepts to real business problems.

Cybersecurity basics covers the history of cybersecurity, types of cyberattacks, and key security concepts and tools. This class serves beginning learners.

Graduates can apply the course toward the requirements for the professional certificate in IBM cybersecurity fundamentals.

VISIT HERE

VISIT HERE

VISIT HERE

CYBER SECURITY FOR BEGINNERS

CYBERSECURITY SKILLS ONLINE

From the same firm that brought you The Daily Security tip comes Heimdal Security’s Cyber Security Course for Beginners. Although this, too, is email-based, its syllabus is significantly more extensive than that of The Daily Security Tip.

As the name suggests, Cybrary is an online library for cybersecurity, IT and other InfoSec-related study materials. After creating a free account, you get access to almost 500 courses, each ranked by their difficulty and all of them free.

MILITARY-GRADE CYBERSECURITY TRAINING

This four-day course will teach you to apply traditional data analytics and business intelligence skills to big data. This course presents the tools data professionals need to access, manipulate, transform, and analyze complex data sets using SQL and familiar scripting languages.

VISIT HERE

I S S U E 19

VISIT HERE

NexGenT was created by two US Air Force veterans with extensive experience teaching and training network engineering and cybersecurity.

VISIT HERE

WOMEN IN SECURITY MAGAZINE

123

TURN IT UP

TERRIBLE, THANKS FOR ASKING With Nora McInerny Delve into the raw and authentic realm of human emotions with "Terrible, Thanks For Asking," hosted by Nora McInerny. Through candid conversations, Nora navigates life's complexities, sharing stories of resilience and vulnerability that resonate universally, making it an indispensable addition to this collection of podcasts tailored for a female audience seeking diverse and meaningful narratives.

CLICK TO LISTEN

UNLOCKING US With Brene Brown This is an enriching podcast where meaningful conversations unravel insights on vulnerability, courage, and connection. With Brene's expertise in human behavior and engaging interview style, the podcast offers a valuable resource for women seeking self-improvement and genuine connections in everyday life.

CLICK TO LISTEN 124

W O M E N I N S E C U R I T Y M A G A Z I N E

FIERCE GIRLS With Amy Shark, Yael Stone and more From athletes to aviators, scientists to spies. From the deep blue sea to the dark, black skies.

Australia is full of girls who dare to do things differently. Adventurous girls. Girls with guts and spirit.

Join the amazing Amy Shark, Yael Stone, Dame Quentin Bryce, Claudia Karvan, Turia Pitt, Stephanie Gilmore, Leah Purcell and more as they tell the inspiring tales of some of Australia's most extraordinary women.

CLICK TO LISTEN

FEMINISM, WOMEN'S STORIES: THE CREATIVE PROCESS With Creative Process podcast Listen to Empowering Stories from Inspiring Women, discussing their lives, work & creative process.

CLICK TO LISTEN

WE CAN DO HARD THINGS With Glennon Doyle "We Can Do Hard Things," led

by Glennon Doyle, intricately weaves personal experiences with profound life lessons, resonating deeply with its female audience.

Through candid dialogues and introspective monologues, Glennon navigates complex themes, offering a source of inspiration and empowerment among the carefully curated assortment of podcasts tailored to women's diverse interests and aspirations.

CLICK TO LISTEN

SECOND LIFE With Hillary Kerr Hillary Kerr brings you "Second Life," an inspiring glimpse into the transformative journeys of women who have successfully pivoted careers.

CLICK TO LISTEN M A R C H • A P R I L 2024

THE GUILTY FEMINIST

THE MEL ROBBINS PODCAST

With Deborah Frances-White

With Mel Robbins

This podcast humorously and thoughtfully explores the intersection of feminism and everyday imperfections. It provides a distinctive perspective within the collection of podcasts designed to resonate with women, navigating the complexities of modern gender discourse with both honesty and levity.

This podcast is an empowering resource for women, combining actionable life advice with personal anecdotes to drive positive change. With Mel Robbins' engaging delivery and expertise in motivation, the podcast stands out as a treasure in the assortment of podcasts catering to the leadership and aspirations of women.

CLICK TO LISTEN

STUFF MOM NEVER TOLD YOU With Anney and Samantha With a balanced blend of research and personal stories, the podcast dives into chats about womanhood, history, and modern challenges, making it an enriching choice among the curated selection of women-centric podcasts.

CLICK TO LISTEN I S S U E 19

CLICK TO LISTEN

SHE WILL SHINE With Casey Benjamin The She Will Shine podcast brings you the real stories of female business owners. Discover their journey, their motivation, and the challenges they faced to create a successful business on their own terms.

CLICK TO LISTEN

THE HIDDEN ECONOMICS OF REMARKABLE WOMEN With Reena Ninan A Foreign Policy series about women creating change through economic empowerment, hosted

by Reena Ninan. This season, we have partnered with journalists around the world to cover underreported ways women are challenging the status quo.

CLICK TO LISTEN

THE ART OF SPEAKING UP With Jessica Guzik The Art of Speaking Up is a podcast that empowers professional women to achieve their wildest career goals by helping them strengthen their voices and find their inner power.

CLICK TO LISTEN WOMEN IN SECURITY MAGAZINE

125

OFF THE SHELF

SHIFTING TO THE POSITIVE: A WOMAN’S GUIDE TO POSITIVE THINKING Author // Nina Madsen Embark on an empowering exploration with a guide that's more than just a book; it's a beacon of hope and inspiration for women seeking to transform their lives. Shifting to the Positiveoffers a compassionate approach to rediscovering your inner strength and turning every challenge into an opportunity for growth.

BUY THE BOOK

THE LITTLE BOOK OF FEMINIST SAINTS Author // Julia Pierpont This book is filled with tidbits and facts about history’s most prominent women.

It's perfect for getting your daily dose of inspiration.

BUY THE BOOK

THE EMOTIONALLY ABUSED WOMAN: OVERCOMING DESTRUCTIVE PATTERNS AND RECLAIMING YOURSELF Author // Beverly Engel Does your husband or lover constantly criticize you and put his needs before yours?

Do you sometimes wonder if your best friend is truly a friend? Does your boss try to control your every move? Does your fear of being left alone keep you in chronically hurtful relationships? If any of these questions sound familiar, you could very well be suffering from emotional abuse--the most widespread but also the most hidden abuse that women experience. This type of abuse is just as damaging as physical or sexual abuse. But there is help in this invaluable compassionate sourcebook. As a marriage, family, and child therapist who has grappled with these issues herself, Beverly Engel guides you through a step-by-step recover process, helping you shed the habits begun in childhood and take the first few steps toward healthy change.

BUY THE BOOK

WOMEN, PEACE AND SECURITY Author // Joan Johnson-Freese This book offers an accessible overview of the issues related to the Women, Peace, and Security (WPS) global agenda. This new edition has been updated and includes new chapters on WPS and Environmental Change and on WPS in Regional and Security Organizations.

BUY THE BOOK

126

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

FREE WOMAN: LIFE, LIBERATION, AND DORIS LESSING Author // Lara Feigel Free Woman begins at a wedding and ends in the African bush. This is a memoir of Feigel's own journey as a writer, which becomes enmeshed with that of Doris Lessing.

Co-opting a dead novelist into an obsessive, ambivalent relationship, Feigel sets about learning from her about how to live.

BUY THE BOOK

CIRCE Author // Madeline Miller When I was born, the name for what I was did not exist.

Circe is the daughter of Helios, the sun god, and Perse, a beautiful naiad. Yet from the moment of her birth, she is an outsider in her father's halls, where the laughter of gossiping gods resounds. Named after a hawk for her yellow eyes and strange voice, she is mocked by her siblings - until her beloved brother Aeëtes is born.

BUY THE BOOK

MUMPRENEUR EVOLUTION - ON OUR TERMS Author // Erin Thomas Wong On Our Terms: An inspirational book for women in business: 23 success stories of building businesses around family life.

BUY THE BOOK

THE SOUL OF A WOMAN Author // Isabel Allende As a young woman who grew up in the first feminism wave in the 1960s, Isabel Allende has her fair share of accomplishments, including meditation power and what it mean to be a woman. This book offers unique insights into all of that.

BUY THE BOOK

I S S U E 19

WOMEN IN SECURITY MAGAZINE

127

OFF THE SHELF

ASK FOR IT: HOW WOMEN CAN USE THE POWER OF NEGOTIATION TO GET WHAT THEY REALLY WANT Author // Linda Babcock & Sara Laschever Women learn how to change their fear of negotiating into confidence that they’ll gain more if they ask for more—more pay, more status, more resources, more equitable treatment. Required reading for working women.

BUY THE BOOK

SECURING OUR FUTURE: EMBRACING THE RESILIENCE AND BRILLIANCE OF BLACK WOMEN IN CYBER Author // The Black Women In Cyber Collective This book offers solace, unity, and motivation for those who feel marginalized in the realm of technology and cyber, inviting them to discover a supportive community and the courage to amplify their voices. Moreover, it provides an eye-opening experience for those who are part of the majority and haven't experienced being "othered" in this industry.

BUY THE BOOK

BIG MAGIC: CREATIVE LIVING BEYOND FEAR Author // Elizabeth Gilbert Readers of all ages and walks of life have drawn inspiration and empowerment from Elizabeth Gilbert’s books for years. Now this beloved author digs deep into her own generative process to share her wisdom and unique perspective about creativity.

BUY THE BOOK

THE CONFIDENCE CODE: THE SCIENCE AND ART OF SELF-ASSURANCE---WHAT WOMEN SHOULD KNOW Author // Katty Kay & Claire Shipman Confidence. We want it. We need it. But it can be maddeningly enigmatic and out of reach. The authors of the New York Times bestseller Womenomics deconstruct this essential, elusive, and misunderstood quality and offer a blueprint for bringing more of it into our lives.

BUY THE BOOK

128

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2024

SAVE THE DATE

2024

10 OCT 2024

2024

WOMEN IN SECURITY AWARDS womeninsecurityawards.com.au www.womeninsecurityawards.co.nz

NEW ZEALAND WOMEN IN SECURITY AWARDS

SAVE THE DATE

7 NOV 2024