Women in Security Magazine Issue 29

29

MARCH • APRIL 2026

TRANSFERABLE SKILLS ASSESSMENT CHECKLIST P42

IMPOSTER TO 'EXPERT' P8 ARCHITECTS IN UNIFORM: HOW MILITARY SKILLS POWER THE FUTURE OF SECURITY P70

ARCHITECTS

OF OUR FUTURE W W W. W O M E N I N S E C U R I T Y M A G A Z I N E . C O M

FROM THE PUBLISHER

T

he theme of this edition, Architects

Through recent conversations in our industry, I’ve

of Our Future, is both a celebration

noticed a mix of hope and hesitation. While progress

and a wake-up call. It reminds us that

has been made, there’s a sense that diversity and

transformation, growth and courage,

inclusion efforts are losing momentum, that we’re

both for ourselves and for the security

slipping backwards. But now, more than ever, we need

industry as a whole, begin when we

to stand firm. We must not shrink for anyone. We

decide to take ownership of the paths we follow.

As we step into 2026, the Year of the Fire Horse, I’ve

must continue to push forward, to lead by example and to architect the inclusive, innovative future our industry deserves.

found myself deeply inspired. The last Fire Horse year was 1966, a time when women lit the spark of

In this issue we explore what it truly means to

a global feminist movement, demanding equality

be Architects of Our Future through the stories

and igniting a wave of feminine power that reshaped

and insights of remarkable women shaping the

society. This year carries that same energy: bold,

security landscape.

unapologetic and ready to dismantle what no longer serves us.

Jo Stewart-Rattray examines Why Security’s Skills Transformation is Being Driven by Career Changers

My personal focus this year is to read more, honour

and Brave Reinventors, highlighting how reinvention

my boundaries and fully embrace my voice. Fire

itself has become a cornerstone of progress in our

Horse years are about burning away old systems and

field. Adriana Jones, in Architects of Our Future:

birthing new paradigms, and that resonates deeply.

Building a Structural Solution to Child Protection in

I’ve decided to become visible, to use my voice, my

a Digital World, explores how design thinking and

greatest asset, and to embrace community like never

innovation are reshaping the protection of children

before. No more asking permission. It’s time to claim

online — proving that architecture is not just about

space unapologetically, to build in public rather than

structures, but about safeguarding people.

perfect in private, and to continuously evolve while designing the next decade of my future.

2

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

Abigail Swabey

Karen Stephens brings a thought-provoking perspective in The Power of the Pivot: Thriving Through Career Reinvention in Cybersecurity, unpacking the courage it takes to evolve in an industry that is moving faster than ever. Madhuri Nandi’s feature, Architecting What Comes Next, challenges us to think beyond the present and imagine what security can become when we build with foresight and heart.

In Betting on the Future: Why I Left my Secure Role

Together, these stories prove that the architecture of our future isn’t made of structures or systems alone — it’s built by people, by brave women who choose to stand tall, speak up and pave the way for others to rise.

to Protect the Next Generation, Marina Azar Toailoa shares her bold leap of faith, redefining what career

The Year of the Fire Horse reminds us that this is our

security truly means. Jaimee Mullins pulls back the

time, our moment to take the reins back. Just as the

curtain on self-perception in Imposter to ‘Expert’,

Fire Horse gallops forward fiercely, unhindered by old

a story that will resonate with anyone who’s ever

constraints, so too must we harness such energy.

questioned their value. And Nadia Veeran-Patel’s

It’s time to lead with purpose, fuelled by fire, intuition

Behind the Firewalls: A CISO’s Story of Growth,

and courage.

Grit and Leadership reminds us that strength and vulnerability often coexist in the same persona of leadership.

Abigail Swabey

Finally, we bring you a collection of What’s

PUBLISHER, and CEO of Source2Create

Her Journey, stories from women around the world — powerful reflections of courage, transformation and leadership in motion. Each voice contributes to a shared blueprint for the future, one built on authenticity, resilience and

www.linkedin.com/in/abigail-swabey-95145312

aby@source2create.com.au

unstoppable determination.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

3

CONTENTS

2

COLUMN

FROM THE PUBLISHER

New year, old crimes

12

Grab it by the horns

44

The power of the pivot: thriving through career reinvention in cybersecurity

74

Architecting what comes next 81

IMPOSTER TO ‘EXPERT’

8 WHAT’S HER JOURNEY? Jackie Orchard

16

Meegan Bryant

20

Nadia Veeran-Patel

24

Hajar Nachate

28

Koketso Rihlampfu

30

Laura Jones

34

Erin Blanchard

36

Cleo Faul

40

INDUSTRY PERSPECTIVES Architects of your future: building a structural solution to child protection in a digital world

48

Why security’s skill transformation is being built by career changers and brave reinventors

52

The trauma-informed security architect: redesigning awareness training

54

Say goodbye to the cyber cash cow

58

Architects for the future: continuous design for cyber resilience

62

Moltbook and the future we choose to design

68

TRANSFERABLE SKILLS ASSESSMENT CHECKLIST

42 112 THE LEARNING HUB 116 JOB BOARD

ARCHITECTS IN UNIFORM: HOW MILITARY SKILLS POWER THE FUTURE OF SECURITY

70

MARCH • APRIL 2026

CAREER PERSPECTIVES Betting on the future: why I left my secure role to protect the next generation 78

Support the Future of the

AUSTRALIAN WOMEN IN SECURITY AWARDS

®

We need your support to continue this important initiative into its 8th year.

FOUNDER & EDITOR Abigail Swabey

ADVERTISING Abigail Swabey Jane Saafi

SURFING THE NET 104

The 2026 Awards will be hosted in Melbourne. To ensure this initiative continues, we invite you to partner with us as a sponsor.

ONSORSH

I

Packages ava ilable from $6,000 to $50,000 Custom packa ges tailored to your organisa tion’s needs

PP

O

Your sponsorship will help us continue to celebrate and elevate the achievements of women in security across Australia.

SP

P

JOIN US IN MELBOURNE FOR 2026

ORT

U NIT

IE

S

M A G A Z I N E C O O R D I N ATO R Jane Saafi

JOURNALISTS Stuart Corner

99

To discuss how you can support and sponsor next year’s awards, please reach out to Aby at Aby@source2create.com.au.

We look forward to partnering with you to make the 2026 Australian Women in Security Awards our best yet.

SUB-EDITOR Stuart Corner

DESIGNER Rachel Lee

STUDENT IN SECURITY SPOTLIGHT

TURN IT UP 106

Sienna Smith

84

Uswah Rahman

88

Ugwoke Jennifer Sochima

90

Lethabo Sangweni

94

Om Venugopal

96

Source2Create Pty Ltd is the publisher of this magazine and its website (www.womeninsecuritymagazine.com).

©Copyright 2025 Source2Create. All rights reserved.

Reproduction in whole or part in any form or medium without express written permission of Source2Create is prohibited.

OFF THE SHELF 108

ASSOCIATIONS & GROUPS SUPPORTING THE WOMEN IN SECURITY MAGAZINE

Thank You

TO OUR SUPPORTING ASSOCIATIONS

JAIMEE MULLINS

IMPOSTER TO ‘EXPERT’

by Jaimee Mullins, Technical Consultant, Saepio Information Security

How confidence, curiosity and community quietly compound into mastery in Cybersecurity

W

hen I started my career I thought

THE MOVING GOALPOSTS OF ‘EXPERT’

an expert was someone who

In Atomic Habits James Clear talks about the power

knew everything, not most things,

of one percent gains compounding over time. At

everything. An expert, in my mind,

the start of my career, I didn’t feel those gains at all.

was a walking Google database.

Every day felt like a struggle for survival. Every new

Someone you could ask any question and receive an

acronym, tool or concept felt overwhelming.

immediate, confident, correct answer. I dreamt about being such a person.

Looking back now, it’s clear that those small, almost invisible improvements added up. But

Fast forward a few years, and something unexpected

here’s something no one really tells you: as your

happened. People do come to me for things now. For

knowledge grows, so do the goalposts of what you

advice. For opinions. For guidance in Cybersecurity.

consider “expert”.

Yet, the feeling of being an imposter hasn’t gone away. If anything, it has simply evolved. Somewhere

At the beginning of my career, I was assigned a

along the way, without consciously realising it, I

mentor. All I wanted was their knowledge. I believed

became someone I once considered an expert, while

they were the ‘expert’ I aimed to become. Then I

still feeling I am figuring things out as I go.

gained experience. I learnt. I asked questions. I made mistakes. And before I knew it, I had become

If you are reading this and you are interested

a mentor myself. At no point did I stop to reflect that,

in Cybersecurity but wondering whether you’re

along the way, I had become someone else’s ‘expert’.

“technical enough”, “smart enough” or “experienced

That there might be someone watching me thinking,

enough”, I want you to know: imposter syndrome

“If I could just know what she knows.”

doesn’t mean you don’t belong. Often, it means you are exactly where you should be.

8

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

F E A T U R E

"I believe strongly: no matter the field, the path to becoming an expert is far more universal than we think."

Funnily enough, that realisation came as I was writing this article. Today, I still feel like my own imposter, but I’m also someone else’s expert.

I have learnt that both things can be true at the same time.

A QUICK SNAPSHOT OF MY JOURNEY I didn’t start my career believing I belonged in Cybersecurity. I didn’t have a childhood dream of working in Cyber. I didn’t feel naturally technical or exceptionally gifted. What I did have was curiosity, a willingness to try, and the stubborn determination to keep going even when I felt out of my depth. And that’s important, because when we look at people we label as experts, on panels, podcasts, stages, or LinkedIn, we rarely see the messy middle. We see the highlights reel, not the selfdoubt, the failed exams, the awkward questions or the moments of thinking, “soon they’re going to realise I don’t know what I’m doing.”

For those of you reading this article at home, listening to podcasts, or watching videos of people you consider experts, I believe strongly: no matter the field, the path to becoming an expert is far more universal than we think. Here are the principles that quietly shaped my own journey.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

9

1. DEFINE WHAT ‘EXPERT’ MEANS TO YOU Before you can move towards expertise, you need to understand what that word means in your context.

Is it: • •

A specific job title?

Deep knowledge of a particular

product or technology?

• Being the go-to person for a niche area?

Being an expert doesn’t have to mean knowing everything about Cybersecurity. No one does.

Cybersecurity is too broad, too fast-moving and too complex for that. Most so-called experts are simply people who went deep in one area and stayed curious in the rest.

Once you define what expertise means to you, you can break it down into achievable steps. Suddenly, becoming an expert feels possible instead of overwhelming.

2. EXPOSURE IS EVERYTHING You cannot think your way into expertise. You have to experience your way there. Exposure to different technologies, environments, incidents, people, conversations and perspectives is what accelerates learning. This is why internships, entry-level roles, shadowing and simply being in the room matter so much early on. Even exposure you don’t fully understand at the time is valuable.

Your brain is quietly building context. I absorbed more than I realised just by listening to conversations I felt like I wasn’t yet qualified to participate in.

3. SHARE YOUR KNOWLEDGE, EVEN WHEN IT FEELS SMALL This was a game-changer for me. The fastest way to solidify learning is to teach it. Research consistently shows that people who explain concepts to others retain information far more effectively than those who passively consume it. Whether it’s: • A LinkedIn post • Explaining a concept to a colleague

10

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

F E A T U R E

• Giving a presentation

5. THIS IS NOT A SOLO JOURNEY

• Talking it through with a friend

No one becomes an expert alone. Mentors, colleagues, managers and communities shape us,

Share what you learn.

whether we realise it or not.

Like many people, I used to bulk-learn for exams, pass

6. NETWORKING IS NOT OPTIONAL

them and then quickly forget most of the content.

Conversations matter. Absorb the language. Listen

But, when I had to apply that knowledge, or convey it

to how people think. Confidence often comes

to others, it started to sink in. Sometimes I said the

from familiarity.

wrong thing and got corrected. That helped to further cement my learning.

REDEFINING THE FINISH LINE Here’s what I have come to accept: your ‘expert level’

During my internship, I was constantly told, “Fail fast.”

should always be unachievable. You may reach expert

The idea was simple: the faster you make mistakes,

status in someone else’s eyes, but if you want to

the faster you learn, recover and move forward. Those

keep growing, in life and in Cybersecurity, your own

words still guide me today.

goalposts should continue to move.

WHAT TO REMEMBER ALONG THE WAY

If being an imposter means I will forever be learning,

The path from imposter to expert isn’t linear, and

questioning, and improving, then I’m happy to be an

it isn’t easy, but there are a few truths I wish I had

imposter rather than an expert.

internalised earlier.

And if you ever feel you have truly arrived, that there is

1. IT’S OKAY TO BE VULNERABLE

nothing left to learn, maybe that is not the end of the

Not knowing something doesn’t disqualify you. Even

journey, but the start of the next chapter.

experts are still learning, especially in Cybersecurity.

Saying “I don’t know” is often the most honest and

FINAL REFLECTIONS: TAKE THESE WITH YOU

credible response you can give. You can always follow

• You don’t need to feel ready to begin; readiness

it up with “let me find out and get back to you”, to

comes after action.

show both curiosity and initiative.

• Imposter syndrome is not a weakness; it’s often a

2. BACK YOURSELF

• Expertise is built quietly, over time, through small,

sign of growth.

You are in the room for a reason. Your perspective matters, even if it’s still forming. I often remind myself that, if I ever feel like the smartest or most

consistent steps.

• One day, without realising it, you may become the person someone else looks up to.

knowledgeable person in the room, I’m probably in the wrong room.

And when that happens, I hope you remember the early version of yourself, the one who wondered

3. EVERYONE’S TIMEFRAME IS DIFFERENT

if they belonged, and realise just how far you

Experience takes time. Exposure takes time. You

have come.

can accelerate learning, but you cannot shortcut lived experience.

www.linkedin.com/in/jaimeemullins

4. COMMITMENT DETERMINES PROGRESS If you want something badly enough, you will prioritise it. If you don’t, that’s okay too, but your expectations need to match your effort.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

11

AMANDA-JANE TURNER Adjunct Lecturer School of Social Science (Cyber-Criminology) Cybercrime is big business, thanks to technical advancement and interconnectivity creating more opportunities. This regular column will explore various aspects of cybercrime in an easy-to-understand manner to help everyone become more cyber safe.

C O L U M N

New year, old crimes It is 2026. Technology is ever developing; the geopolitical landscape is uneasy and the socio-economic

• Deviant sexual behaviours that may be motivators for online child exploitation or grooming.

environment is unsettled. It seems nothing is certain,

• Revenge seekers indulging in doxxing and cyber

but of one thing we can be sure: criminals and nation

bullying and those who are motivated by the thrill

state threat actors somewhere, at some time, will

of breaking into restricted systems.

misuse technology and human psychology for their own malicious agendas.

These are just a few examples of motivators, but, as you can see, even as technology and the world

While technology develops and new ways to commit

seem to change rapidly, the foundational motivators

crime emerge, the motivations seem to stay the

for crime and cybercrime remain the same. What

same. Examples are:

changes is how criminals achieve their results, such as the technologies they use and target.

• Ideologies which can create the impetus for hacktivism, cyber espionage, online radicalisation,

Cyber threat actors are using GenAI powered

cyber terrorism and disruption.

automation to facilitate their campaigns efficiently

• Financial motivators which can lead to data

and effectively. Many have a lot of resources, a lot of

extortion, ransomware, romance fraud and

skills and the strong motivation to tirelessly locate

invoice fraud.

potential targets and unleash their creations.

So, how do we, the fighters of cybercrime along

"Instead of falling in a heap of despair and waiting for the next data breach or deepfake invoice fraud, we need to become the architects of our own futures, making deliberate choices on how we engage with technology, what we share online and how we prepare for potential cyber threats, whether at home or work."

with everyday citizens, stay safe from this veritable onslaught of motivated threat actors who seem to have a great many resources at their fingertips?

Instead of falling in a heap of despair and waiting for the next data breach or deepfake invoice fraud, we need to become the architects of our own futures, making deliberate choices on how we engage with technology, what we share online and how we prepare for potential cyber threats, whether at home or work.

Cyber risk is not just technical, it is also human, behavioural, psychological and strategic. We need to think long term resilience. As owners of our own future we can then encourage a mindset of understanding why security mechanisms are in place,

12

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

rather than just applying these because we are told to

Cybersecurity, whether at home or work, is something

do so.

me must consciously think about, not bolt on in a panic during a compromise. Cybersecurity must

We need to think critically by questioning what

become part of our everyday decision making, just

we read or hear on social media, thinking about

like the equivalent of looking both ways before we

messages or emails we receive, and making the

cross the road.

conscious choice to treat all personal data as the valuable property it is.

Becoming architects of our own future represents a powerful mind shift that can be used to significantly

As architects of our own future we should not assume

strengthen our own understanding of cybersecurity

we will never be victims of cybercrime, but instead

and how we, as everyday end users, can make

plan for potential eventualities. We must think about

conscious decisions to support our own online

the online services we use, we must ask ourselves:

privacy and security.

“What do I do if my account is compromised?” “What is the fallout if my personal phone is stolen?” “What if

Stay safe everyone.

this online service disappears tomorrow?”

If individuals (the everyday person) and organisations

www.linkedin.com/in/amandajane1

see themselves as future builders then security becomes a shared, understood, and positive value

www.empressbat.com

rather than an onerous and confusing checklist.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

13

IS NOW AISA'S NEW PUBLISHING PARTNER

Wa t c h this space!

SOURCE2CREATE.COM.AU WOMENINSECURITYMAGAZINE.COM WOMENINSECURITYAWARDS.COM.AU

WHAT’S HER JOURNEY?

Jackie Orchard Head of Information and Data Security Advisory, Team Global Express

L

ong before Jackie Orchard ever wrote a

“Security work offered similar investigative

security policy or advised executives on

opportunities,” she says. “It required the same

AI governance, she was drawn to the art

meticulous attention to evidence and systematic

of investigation itself. As a student, she

investigation that originally drew me to forensics.”

imagined a future in forensic pathology,

captivated by the discipline of examining evidence

As her career evolved, so too did the nature of the

and uncovering truth.

investigations. Jackie transitioned into information security roles, where she encountered digital

“My journey into cybersecurity began from an

forensics and eDiscovery for the first time.

unexpected place,” she reflects. “Originally, I wanted to be a forensic pathologist. I was fascinated by the

“When I discovered digital forensics and eDiscovery,

investigative process, the attention to detail, and

it felt like coming home,” she explains. “Here was

uncovering the truth from evidence. While life took

forensics, but in the digital realm examining logs,

me in a different direction, that analytical mindset and

tracking data flows, reconstructing events from

love of forensics never left me.”

digital evidence.”

That instinct would find its home in technology.

She immersed herself in building frameworks

In 2001, Jackie entered the security profession at

and strengthening governance, redesigning

Westpac Group, where she began as a Security

technology codes of use, reengineering information

Analyst and Liaison Manager. There, she worked

security policies, and driving awareness programs

closely with law enforcement on theft, holdups,

that achieved engagement levels well beyond

and physical security incidents, discovering that

industry norms. Yet even in these early years,

cybersecurity was, at its core, investigative work.

Jackie understood that technical capability alone wasn’t enough.

16

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

W H A T ’ S

H E R

J O U R N E Y ?

“What helped me navigate those doubts was reframing them. Instead of seeing uncertainty as a sign I was in the wrong place, I recognised it as evidence I was doing something genuinely challenging and worthwhile.”

“I recognised early that cybersecurity isn’t purely

“That initiative demonstrated not just technical

technical, it’s about understanding people, processes,

capability but strategic leadership,” she says.

and organisational dynamics,” she says. “You need to

“It showed that security can deliver genuine

speak multiple languages: technology, legal, business,

business value.”

and compliance.”

Yet Jackie’s path was never linear. Along the way, she Her ability to translate between these worlds became

stepped into roles outside traditional cybersecurity,

one of her defining strengths. In 2003, when she

including business development at Dimension Data,

stepped into a senior consulting role focused on

branch leadership at Commonwealth Bank and

security communications and compliance, she was

National Australia Bank, and project coordination

tasked with enhancing enterprise-wide frameworks. It

for the National Breast Cancer Foundation. Each

was a daunting responsibility, but she approached it

experience added a new dimension to her leadership.

with curiosity rather than hesitation.

“These experiences reinforced that uncertainty and “Rather than being intimidated, I immersed myself

discomfort are often signals that you’re expanding

in learning,” she recalls. “I developed policies aligned

your capabilities rather than signs you should retreat,”

with international standards, obtained executive

she says.

stakeholder concurrence, and implemented communication strategies that fundamentally

Like many in cybersecurity, Jackie experienced

changed how the organisation engaged with security.”

moments of doubt, particularly when stepping into unfamiliar territory or building new capabilities

Still, the most transformative moment of her career

from nothing.

came more than a decade later, when she was asked to build something that did not yet exist.

“I remember thinking, ‘Am I the right person for this?

Do I have what it takes?’” she says candidly. “What

“The most transformational step came in 2015 when

helped me navigate those doubts was reframing

I was appointed to build Westpac’s comprehensive

them. Instead of seeing uncertainty as a sign I

internal eDiscovery capability from scratch,” she

was in the wrong place, I recognised it as evidence

says. “There was no playbook, no established team,

I was doing something genuinely challenging

no precedent.”

and worthwhile.”

The scale of the challenge was immense. Jackie

Today, as Head of Information and Data Security

and her team operationalised a mature capability

Advisory at Team Global Express, Jackie operates

within just 20 weeks, ultimately delivering millions

at the intersection of technology, governance, and

in cost savings and supporting over 100 regulatory

business strategy. Her work involves assessing

responses. The achievement earned national

emerging technologies, advising leadership, and

recognition, including Australia’s Legal IT Team of

building frameworks that allow organisations to

the Year.

innovate safely.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

17

“The most satisfying aspect of my role is being able

“My path definitely unfolded organically,” she reflects.

to say ‘yes, here’s how’ rather than just ‘no, that’s too

“I didn’t start my career thinking I wanted to be a Head

risky,’” she says. “Too often, security is positioned

of Security. Instead, I followed opportunities that

as the department that blocks innovation. I find it

aligned with my interests and allowed me to make a

far more rewarding to help organisations adopt

meaningful impact.”

new technologies safely while ensuring appropriate controls are in place.”

She believes that openness to opportunity, combined with continuous learning, is essential for anyone

This philosophy has shaped her entire leadership

entering the field.

approach. Rather than acting as a gatekeeper, she sees security as an enabler of progress.

“Your network, your credibility, and your track record of delivering results will open more doors than any

“When I conduct a comprehensive security

certification,” she says. “People remember whether

assessment, I’m helping leadership understand

you delivered value, communicated clearly, and

complex risks and make informed decisions,” she

approached challenges with integrity.”

explains. “The goal is always to enable innovation while maintaining appropriate guardrails.”

Despite the demands of senior leadership, Jackie has learned the importance of balance and perspective.

Her advisory work increasingly focuses on emerging technologies like artificial intelligence, which she

“Balance in cybersecurity is challenging,” she

believes will reshape the cybersecurity landscape in

acknowledges. “Security incidents don’t respect

profound ways.

business hours, and there’s always more work to do. What’s helped me is being intentional

“AI is going to fundamentally reshape both

about boundaries while remaining flexible when

cybersecurity threats and defences,” she says. “The

genuinely needed.”

challenge will be governance. Organisations are rushing to adopt AI tools, often without adequate

For Jackie, resilience comes not just from technical

security frameworks. We need to ensure these

expertise, but from maintaining curiosity and purpose.

technologies are secure, compliant, and don’t create new vulnerabilities.”

“What continues to fascinate me is the constant evolution,” she says. “Every new technology presents

At the same time, Jackie remains deeply aware of the

new security challenges and opportunities. The field

human dimension of security. She has seen firsthand

never stops demanding that you learn, adapt, and

how culture, communication, and leadership influence

think critically.”

security outcomes.

It is, in many ways, the same investigative journey “The most elegant security framework is worthless

that first captured her imagination. Only now, instead

if people won’t use it or if leadership won’t support

of examining physical evidence, she is shaping

it,” she says. “Effective security is about alignment,

the frameworks that protect entire organisations

communication, and trust.”

following the digital trail, uncovering hidden risks, and enabling a safer future.

Looking back, she sees her unconventional path not as a deviation, but as an advantage.

18

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/jackieorchard

M A R C H • A P R I L 2026

Meegan Bryant Defence Security Consultant

F

or Meegan Bryant, cybersecurity was never

allowed her to translate abstract frameworks into

a sudden pivot. It was the natural evolution

meaningful action, ensuring security wasn’t just

of a career built on understanding security

documented, but operationalised.

in its fullest sense not as isolated controls, but as a connected system of people,

“I deliberately sought roles where I could translate

policy, and protection. Beginning in physical and

policy into practice,” she says. “Managing

information security before transitioning into cyber,

Australian defence programs and serving as CSO

she saw early on that true resilience required more

and CISO gave me exposure to both strategic

than technical solutions. It required strategy, clarity,

oversight and operational realities. I built

and integration.

credibility by simplifying complex frameworks and operationalising compliance.”

“My interest grew out of a broader career in security starting with physical and information security, then

In her current role as a Defence Security Consultant,

evolving into cyber,” she explains. “Over time, I saw

Meegan operates at the intersection of governance

how interconnected these domains are, and how

and reality, a space where even the most well-

strategy must bridge them. That sparked my drive

designed regulations can fail without practical

to ensure organisations, especially in defence and

implementation. Meegan sees first hand how smaller

government, had holistic protection.”

organisations, often with limited resources, struggle to meet growing compliance expectations.

That mindset would define her career. Rather than

20

chasing technical depth alone, Meegan deliberately

“The most complex aspect is balancing regulatory

positioned herself where she could influence how

alignment with operational reality,” she says.

security functioned at scale. She sought roles that

“Small organisations often lack resources, so I

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

W H A T ’ S

H E R

overcome this by creating templates, checklists, and workflows that make compliance achievable without overwhelming staff.”

This commitment to accessibility reflects a deeper belief that security should empower, not burden. For Meegan, success is measured not by the existence of policies, but by whether organisations feel confident using them.

J O U R N E Y ?

"Mentorship played a pivotal role in shaping her confidence and perspective. Leaders in defence and government demonstrated the importance of accountability and clarity, reinforcing the idea that security must be understood by everyone it protects."

“Seeing organisations confidently adopt security practices because policies are clear, usable, and empowering brings me the most satisfaction,” she says.

“Mentors in defence and government who highlight clarity and accountability shaped my journey,” she

Like many professionals who build careers outside

says. “Their influence reinforced my belief in practical,

purely technical roles, Meegan experienced moments

accessible security, and to trust my abilities.”

of uncertainty early on. She questioned whether specialising in governance and compliance would

Today, her work spans policy development, mentoring,

limit her opportunities in a field often associated with

risk oversight, and strategic alignment. Every task

technical mastery. But over time, she recognised

serves the same goal: embedding security into daily

that leadership in cybersecurity depends on strong

operations so it becomes a natural and sustainable

governance foundations.

part of organisational culture.

“Yes, I questioned whether specialising in governance

“My day is a mix of policy development, mentoring,

and compliance would limit me compared to more

risk oversight, and strategic alignment all with the

technical paths,” she reflects. “I navigated those

goal of making security compliance accessible,

doubts by recognising that leadership roles like CSO

effective, and embedded into everyday operations,”

and CISO depend on strong governance foundations.”

she explains.

Her career path, shaped less by rigid planning

Meegan relies on governance tools such as risk

and more by recognising where she could make a

registers, compliance tracking systems, and

meaningful impact.

vulnerability dashboards to support this mission. Yet she is quick to point out that effectiveness does not

“My path unfolded organically,” she says. “Each role

always depend on sophisticated technology.

built upon the last, and I leaned into opportunities where I could make security strategy practical

“Governance tools like risk registers, compliance

and effective.”

tracking systems, and vulnerability management dashboards are pivotal,” she says. “Even structured

Mentorship played a pivotal role in shaping her

spreadsheets can be powerful in small organisations.”

confidence and perspective. Leaders in defence and government demonstrated the importance of

Her approach reflects a broader philosophy:

accountability and clarity, reinforcing the idea that

security is not defined by complexity, but by clarity

security must be understood by everyone it protects.

and consistency.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

21

“Security is more than locks and firewalls; it’s about people, trust, and resilience. Build communication skills as much as technical ones,” she says. “Back yourself. Your upbringing doesn’t define you; what you do with it does.”

Looking ahead, Meegan sees rapid transformation

“The hardest roles to fill are those requiring both

across the cybersecurity landscape. Artificial

technical expertise and governance awareness,” she

intelligence, regulatory expansion, and supply chain

explains. “Many professionals lean heavily one way,

security will reshape how organisations defend

but the blend is rare and highly valuable.”

themselves, while adversaries adopt increasingly sophisticated tactics.

For those considering cybersecurity, especially those transitioning from other careers, her advice is

“AI-driven threat detection, supply chain security,

grounded in encouragement and realism.

and regulatory expansion in critical infrastructure will be highly impactful,” she says. “At the same time,

“Leverage your transferable skills whether

ransomware targeting small organisations, AI-enabled

communication, project management, or analytical

social engineering, and third-party/vendor risk will be

thinking,” she says. “Cybersecurity is broad; don’t feel

the most pressing threats.”

pressured to be ‘technical’ immediately. Find your niche and build from there.”

Staying ahead requires continuous learning. Meegan actively engages with professional networks,

If she could speak to her younger self, her message

conferences, and trusted industry sources, including

would be simple, but powerful.

advisories from the Australian Cyber Security Centre, ensuring her knowledge evolves alongside the

“Security is more than locks and firewalls; it’s about

threat landscape.

people, trust, and resilience. Build communication skills as much as technical ones,” she says. “Back

She also values the importance of community. Her

yourself. Your upbringing doesn’t define you; what you

involvement with organisations such as the Australian

do with it does.”

Women in Security Network provides connection, mentorship, and a shared sense of purpose in

It is this philosophy grounded in clarity, confidence,

an industry where representation and support

and purpose that defines Meegan Bryant’s journey.

matter deeply.

In a field often driven by rapid change and technical complexity, she has built her career on something

“Membership provides mentorship, networking, and a

more enduring: making security work, not just in

sense of community,” she says.

theory, but in practice.

Meegan is also deeply aware of the growing demand for professionals who can bridge governance and

www.linkedin.com/in/meegan-b-8aa75547

technical domains. While many individuals specialise in one or the other, she believes the future belongs to those who understand both.

22

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

Nadia Veeran-Patel LRMG as the CISO

I

remember my introduction to the tech world in

My first job was in a big financial services firm where

South Africa. Apartheid had ended a year prior

I struggled to find my passion and purpose in life.

and I was my parents’ hope for equality, which is

A year into that role my sister (who was already in

why they thrust me into a model C school over

tech) asked me if I’d like to work with her at a small

30kms from home. It was in Grade 10 that I chose

consulting firm. The job was as a systems trainer,

computer science as one of my subjects. I wasn’t

training staff at a large global mining company on

sure of my expectations at the start, but I was good

their procurement system.

at it, and when I started coding in Pascal, I was happy seeing my programs come to life.

Boy, did I fall in love with this job. Their procurement system was based on Lotus Notes and, during my five

Fast forward to my becoming an undergraduate

years working there, I trained on the system, was able

student at WITS University, where I was sure I would

to get certified to administer it and, later, to become

maintain my enthusiasm. The first year was the best

a Lotus Notes developer. I was one the few women

year of my life, until I discovered I hated information

at that time to gain both certifications, but I started

systems at a tertiary level (who knew studying

to hate the job. Whilst I was great at coding, I hated

involved so much theory!). I eventually dropped out

being stuck behind a computer all day.

due to illness and financial stress, but this was just

24

the beginning of my long love/hate relationship with

I am someone who needs conversation and people

the tech world.

to keep her going. Whilst I loved where I worked and

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

W H A T ’ S

H E R

J O U R N E Y ?

the people I worked with, I knew I had to spread my wings. So, I applied for a job 90kms away at another small IT consulting firm. Luckily for me one of my previous managers worked there and I landed a systems administrator position.

At the time I was the first person of colour and the only female employee, which meant I was in a team with 16 men. What an experience! Whilst it wasn’t the nurturing culture I had been accustomed to, I learnt to hold my own. My boss was one of my biggest supporters and is still someone I call a friend.

I managed to become an account manager and the liaison person between our clients and internal development teams. This is where my love for the

"Every road taken during my journey was bumpy, often intimidating and daunting, but the lessons learnt were fruitful and many. Today, I find myself more concerned about the safety of our world and often compare my life to a series of final destination movies."

tech world. started.

A few years later one of our clients was looking for a service delivery manager for its IT operations team

proved to be a very expensive exercise. So, it was

and my boss asked the client’s CIO to employ me.

decided one of us should go to the UK instead. I

Although sceptical, she decided to give me a chance.

was chosen, but, as luck would have it, only days

When I started I was in charge of six men who weren’t

after learning I would need to be there for a month,

entirely happy with the change in management,

I discovered I was pregnant with my first child, after

but we quickly became a solid team of 11 with

several years of infertility.

four females in the ranks. Service delivery greatly improved. Our statistics were phenomenal.

I gingerly approached my CIO thinking the opportunity would be taken from me because no one would

Towards the middle of 2015 our UK based parent

assign a pregnant woman to such an important

company expressed the need for our compliance

project. This, readers, is the point at which my life

expertise for an information assurance project they

changed, and my faith in humanity was restored.

were running. It was during this time I started to take a keen interest in information security and my

My female CIO discussed the situation with my

obsessive compulsive personality greatly assisted my

female CFO and they decided my pregnancy would

ability to learn. Another team member was originally

not impact my competence: they still wanted me

chosen to run the project, but I was asked to steer it

to go. At this point I did question if my fate would

because of my increasing knowledge of the field.

have been different if the circumstances had been reversed.

Towards the end of 2015 my CIO introduced me to the UK CISO, and this was the start of a beautiful

October 2016 saw me 28 weeks pregnant, packing

relationship and career.

my bags and travelling to the UK. The plan was for me to work in our offices in Southampton for three

By early 2016 I had already obtained my first

weeks then spend a week in Colico, on Lake Como

information security certification and was dealing

in Italy, for an audit. Suffice to say, I was extremely

with the UK security team every couple of months.

excited, overwhelmed and scared at the prospect of

The plan was to have the UK team come to South

this experience, which became the foundation of my

Africa and train us over a two week period, but this

security journey.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

25

He looked at me and said, “You do know we are on

"However, knowing what I know now, I would not change my path. I did learn to enjoy it and be thankful for my opportunities.

I have led teams, gone back to holding fully technical roles and then back to leading a team.

Overall, the experience and lessons learnt were fulfilling, and I finally found my place in the tech world."

ISIS’ hit list, right?”

No Tom, I did not know that, otherwise my very pregnant self would not be standing here. He assured me that we would be well guarded and would be fine.

A few bodyguards later, we were in fact fine, and what a glorious trip it turned out to be.

I returned to South Africa a month later, not so bushy tailed, because my eyes had been opened to the intense world of information security and how intelligence is treated. I spent the next few years leading the information assurance project across the organisation in different countries before going on to do the same for other organisations.

Every road taken during my journey was bumpy,

This is where my story gets wild and, sometimes,

often intimidating and daunting, but the lessons

I find it hard to believe myself: it felt like a scene

learnt were fruitful and many. Today, I find myself

from a movie. The organisation was dealing with

more concerned about the safety of our world and

highly classified and sensitive information (think MI5

often compare my life to a series of final destination

intelligence levels) and made sure I was escorted on

movies. However, knowing what I know now, I would

my bathroom visits, which were very frequent for my

not change my path. I did learn to enjoy it and be

pregnant self. I was given no time to linger anywhere

thankful for my opportunities. I have led teams, gone

near anything of significance.

back to holding fully technical roles and then back to leading a team. Overall, the experience and lessons

On one occasion when my UK colleague and I had

learnt were fulfilling, and I finally found my place in the

to travel to Colico, whilst waiting to board our flight

tech world.

at Heathrow, I received an SMS saying: “Please be on high alert: ISIS terrorist cell found 70kms outside

Throughout my, now 10-year, journey in information

Colico.” I turned to Tom (head of security at the

security, I have had to remain resilient, focused and

time and also the guy who led the team that, on one

forever learning. Today, the best advice I can give

occasion, had rescued Prince Harry in Afghanistan)

those wanting to take this path is: remain focused,

and asked him what the warning was about.

because none of us know everything, continue to learn on the job and tackle the challenges you will meet every day, fiercely, hands on.

And those of us who were lucky to have got into cybersecurity early on now have a duty to make sure we pave the way for others to follow. Lead always with heart, passion and morals, and enjoy the ride while it lasts. www.linkedin.com/in/nadiavp

26

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

Hajar Nachate Chief Information Security Officer (CISO IT/OT)

The future is often described as something we are waiting for. Yet, every day, it is already being shaped through decisions, resilience, courage, and vision.

The architects of our future are not only those who design buildings or technologies, but those who dare to imagine a better world and take responsibility for building it. Increasingly, women are standing at the heart of this transformation.

H

For a long time, women have been underrepresented ajar Nachate, Chief Information

in spaces where the future is designed: technology,

Security Officer, has built her career in

security, leadership, and strategic decision-making.

cybersecurity with one guiding principle:

Today, that narrative is changing. Across industries,

it’s not about age, but about skills and

women are redefining what leadership looks like

continuous growth. By embracing career

grounded not only in performance, but in purpose,

changes and reskilling, she has shaped herself into

ethics, and long-term impact.

the leader she is today.

“The future belongs to those who believe in the Working across diverse environments, she helps

beauty of their dreams.” — Eleanor Roosevelt

protect critical systems where reliability, safety, and continuity are essential. Her journey reflects the path

This belief is not abstract. It is embodied every time a

of many women in technology driven by curiosity,

woman chooses to step into spaces where she was

commitment, and the desire to make a real impact.

not expected, to speak up where silence was easier, and to build where others doubted.

Her experience reflects the path of many women in desire to make a meaningful impact. Through her

CYBERSECURITY: AN INVISIBLE ARCHITECTURE OF TRUST

work, she helps shape a future where innovation goes

In an increasingly digital world, cybersecurity has

hand in hand with trust and resilience.

become one of the most critical foundations of our

technology driven by commitment, curiosity, and the

future. Our cities, hospitals, industries, financial

28

This personal journey is part of a broader reality:

systems, and even our personal identities rely on

‘’The future is not something we wait for, but

digital infrastructures. Without trust and security,

something we actively shape every day’’.

innovation cannot survive.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

W H A T ’ S

H E R

J O U R N E Y ?

Cybersecurity is often seen as purely technical, yet

fragile systems become when security is treated as

at its core, it is deeply human. It is about protecting

an afterthought.

people, data, and societies from disruption. It is about resilience, anticipation, and responsibility.

Each project, each incident, and each strategic

Cybersecurity professionals are the invisible

decision reinforces the same lesson: the future is

architects who ensure that progress remains safe,

not only about innovation, but about trust. Being

reliable, and sustainable.

part of this field means constantly balancing speed with caution, ambition with responsibility. It is a

For women in cybersecurity, the journey carries

demanding path, but also a deeply meaningful one

additional meaning. Entering a field historically

especially as a woman contributing to spaces where

dominated by men requires perseverance,

our voices matter more than ever.

continuous learning, and confidence. But it also brings a unique perspective, one that values

This journey is not just mine. It reflects the path

collaboration, risk awareness, and ethical design.

of many women who are quietly shaping the

Diversity in cybersecurity is no longer a “nice to

future in technology, security, education, health,

have”; it is essential for building systems that truly

and leadership, often without visibility, but with

serve everyone.

undeniable impact.

A PERSONAL JOURNEY OF PURPOSE My own journey into cybersecurity was driven by a

WOMEN AS ARCHITECTS OF SUSTAINABLE FUTURES

simple conviction: technology should empower, not

What distinguishes women architects of the future is

endanger. Working in cybersecurity management, I

not a single skill, but a mindset. A long-term vision.

have seen firsthand how digital transformation can

An ability to connect technical progress with human

unlock extraordinary opportunities but also how

values. Whether designing secure digital systems, leading teams, educating future generations, or influencing policy, women are redefining how the future is built.

"The future is often described as something we are waiting for. Yet, every day, it is already being shaped through decisions, resilience, courage, and vision.

The architects of our future are not only those who design buildings or technologies, but those who dare to imagine a better world and take responsibility for building it.

Increasingly, women are standing at the heart of this transformation."

I S S U E 29

The future needs architects who design with care, ethics, and inclusivity. It needs women who dare to claim their place not by imitating existing models, but by creating new ones.

BUILDING TOMORROW, TOGETHER The future is not a destination we will one day reach.

It is something we are constructing now, through daily choices and collective responsibility. By embracing cybersecurity, ethics, diversity, and resilience, we ensure that the world we build is not only advanced— but safe, fair, and human.

WOMEN ARE NOT ONLY PART OF THIS FUTURE. THEY ARE DESIGNING IT. www.linkedin.com/in/hajarnachate

WOMEN IN SECURITY MAGAZINE

29

Koketso Rihlampfu Senior Manager: Lead Information Security Officer

But curiosity alone does not build a career. Koketso made a deliberate choice to pursue hands-on experience, gravitating towards roles that allowed her to apply theory in real-world environments. “One of the most pivotal steps was intentionally seeking handson experience early in my career. I gravitated towards roles that exposed me to real-world environments

C

rather than purely theoretical work, including penetration testing and being a consultant. I got to uriosity has a way of opening doors long

experience the practical side of all that theoretical

before we realise we are standing at

work I learned and that expanded my knowledge and

the threshold of a career. For Koketso

skills greatly.”

Rihlampfu, now a Senior Manager: Lead Information Security Officer, that

She also understood early on that cybersecurity

curiosity began with a simple but powerful question:

demands constant evolution. “I invested heavily in

how do systems work, and what happens when

continuous learning and certifications, not just to

they fail?

build credibility, but to deepen my understanding across multiple security domains,” she says. Yet

“My initial interest in cybersecurity was sparked by

some of her most important growth came from

curiosity,” she explains. “I was fascinated by how

moments of discomfort. “Equally important was

systems worked, how they could be broken, and

surrounding myself with people who challenged

how weaknesses could be exploited if security

me, asking questions, and being willing to take on

was not really prioritised.” Early in her career, it was

opportunities that felt uncomfortable at the time.

the investigative nature of penetration testing that

That’s actually where I got to grow the most in those

captured her attention. “The technical challenge

uncomfortable positions.”

drew me in, particularly the investigative nature

30

of penetration testing and understanding attacker

Like many women in cybersecurity, Koketso’s journey

behaviour. This still remains one of the jobs,

was not without moments of doubt. “Cybersecurity

throughout my career, that I enjoyed doing the most.”

can be an intimidating field, particularly in

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

W H A T ’ S

H E R

J O U R N E Y ?

“Seeing users within our organisation start to make better decisions when it comes to information and cybersecurity and understanding that security is everyone’s responsibility is quite fulfilling. I find great satisfaction in mentoring others and contributing to a culture where cybersecurity is understood as a shared responsibility.”

environments where you may be the only woman

In her current role, Koketso navigates one of the

in the room or where expectations are constantly

most complex realities in modern cybersecurity:

shifting,” she reflects. One defining moment came

balancing protection with progress. “The most

during a period when she seriously considered

complex aspect of my current role is balancing risk,

leaving the field altogether. “I still remember a time

business enablement, and resource constraints in an

when a friend and then colleague of mine, his name

environment where threats evolve daily,” she says.

is Aadil, who once had a talk with me one day when I

“Cybersecurity decisions rarely exist in isolation,

was ready to give up and change careers altogether

they affect operations, customers, revenue, and

because I felt it was all just too much for me at that

reputation.” Her approach is rooted in clarity and

time. We were standing by the parking lot and he

alignment. “I focus on risk-based decision-making,

spoke so much life into me the voice of reason I didn’t

clear communication with executives, and ensuring

know I needed.”

my team understands not just the ‘what’ but the ‘why’ behind security initiatives. Building trust with

That conversation became a turning point. “He

stakeholders and aligning security objectives with

reminded me that growth often comes with

business outcomes has been critical.”

discomfort and that really stuck with me and helped shape me into the person I’ve become today. Over

That leadership perspective has also deepened

time, confidence replaced uncertainty as experience

her sense of fulfilment. “The most fulfilling

accumulated, but I’ve also learned that self-doubt

aspect of my role is seeing the tangible impact of

doesn’t disappear entirely, you simply learn to move

security initiatives, whether that’s a team growing

forward despite it.”

in confidence, improved resilience across the organisation, or executives making informed

Her career path unfolded organically rather than

risk decisions,” she says. “Seeing users within

through a fixed plan. “I didn’t start out with the

our organisation start to make better decisions

goal of becoming a CISO. Instead, I focused on

when it comes to information and cybersecurity

mastering each role I stepped into and staying

and understanding that security is everyone’s

curious about other areas of security,” she explains.

responsibility is quite fulfilling. I find great

As her experience expanded from technical work

satisfaction in mentoring others and contributing

into governance, risk, and leadership, her perspective

to a culture where cybersecurity is understood as a

shifted. What once centred on solving technical

shared responsibility.”

problems grew into something broader and more strategic. “Today, my passion lies in building

Looking back, Koketso recognises that her success

secure, resilient organisations where cybersecurity

was not defined by fitting a predetermined mould. “I

is embedded into business strategy rather than

would tell my younger self not to be intimidated by the

operating as a standalone technical function.”

idea that cybersecurity is only for a certain ‘type’ of

I S S U E 29

WOMEN IN SECURITY MAGAZINE

31

person. I’d emphasise that curiosity, resilience, and a

Despite the demands of her role, Koketso has learned

willingness to learn are just as important as technical

the importance of balance. “Work/life balance

ability.” Her advice is simple but powerful: “This field

requires intentional boundaries. I prioritise what truly

is very broad, just figure out what excites you and run

matters, delegate where possible, and accept that

with it.”

perfection isn’t always achievable,” she says. “Being present for my family, especially as a mother, grounds

She also emphasises that strong foundations matter,

me and provides perspective. I’ve learned that

both technically and personally. “A strong foundation

sustainable performance comes from balance, not

starts with understanding computing fundamentals,

constant burnout.”

networking, and operating systems. Beyond that, exposure to information security principles, risk

For those considering entering the field, especially

management, and governance is essential. However,

from different professional backgrounds, she offers

equally important are soft skills such as critical

reassurance. “Cybersecurity benefits immensely

thinking, communication, and problem-solving.”

from diverse backgrounds,” she says. “Leverage your existing skills, whether in analysis, communication,

As cybersecurity continues to evolve, Koketso sees

or problem-solving, and build technical knowledge

transformation accelerating. “Over the next two years,

progressively. Be patient with yourself, seek

I anticipate a significant acceleration in the use of

mentorship, and don’t underestimate the value of your

artificial intelligence, both by defenders and attackers.

prior experience.”

We’ll also see greater emphasis on cyber resilience, not just prevention, as organisations accept that

Ultimately, Koketso’s journey reflects something

breaches are inevitable. These developments will

deeper than technical progression. It is a story

push cybersecurity further into the core of business

of resilience, growth, and purpose. What began

decision-making.”

as curiosity evolved into leadership. What once focused on finding weaknesses is now centred on

Her perspective on leadership extends beyond

building strength.

technical capability. When considering career opportunities, she looks beyond compensation. “I

“There is no single ‘right’ path into cybersecurity,” she

would consider the organisation’s leadership maturity

says. “This field is very broad. Do some research, self-

around cybersecurity, the support structure available

introspect, figure out what excites you within the field

to the role, and whether security is genuinely valued

and what would make you look forward to waking

at an executive level,” she explains. “Culture, ethical

up on Mondays and going to work, and then run with

alignment, and the opportunity to make a meaningful

that. It’s important to have a passion for what you do

impact are also important.”

because when it all starts getting a bit too much, it’s the passion that will keep you going.”

In the end, her journey is not defined by a single moment, but by a mindset: stay curious, stay resilient, and keep moving forward.

www.linkedin.com/in/koketso-rihlampfu-820888100

32

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

DO YOU WANT TO CONTRIBUTE? EDITORIAL THEMING & DEADLINES MONTH

THEME

EDITORIAL SUBMISSION

ISSUE LIVE

MAY/JUNE 2026 ISSUE 30

BRIDGE BUILDERS

MARCH 25TH

APRIL 28TH

JULY/AUG 2026 ISSUE 31

COURAGEOUS CONVERSATIONS

MAY 24TH

JUNE 28TH

SEPT / OCT 2026 ISSUE 32

UNLEASHED

SEPTEMBER 3RD

OCTOBER 24TH

NOV/DEC 2026 ISSUE 33

UNCHARTED TERRITORY

NOVEMBER 14TH

DECEMBER 19TH

Send submissions to: Jane@source2create.com.au

Aby@source2create.com.au

WOMENINSECURITYMAGAZINE.COM

awareness and an understanding of human systems skills that would later become the backbone of her cybersecurity leadership.

Yet stepping fully into cybersecurity was not without doubt.

“I experienced uncertainty for sure,” she says candidly.

“I’m a generalist rather than technical, and my university studies were in Politics and Anthropological Science. I really never thought I’d be the right fit for something that sounded so technical from the outside.”

Laura Jones CISO at Transdev Australasia

Like many women entering the field from nontraditional backgrounds, she initially questioned whether she belonged. But as her exposure to the discipline deepened, so too did her perspective.

“The more I learned about it, the more I realised cybersecurity is a lot broader than computer science and as an industry, it’s crying out for

L 34

more generalists.” aura Jone’s pathway to becoming CISO

That realisation shaped the trajectory of her career.

at Transdev Australasia did not begin in a

Rather than trying to mould herself into a technical

server room or a computer science lab. It

specialist, she leaned into her strengths.

began in drug intelligence.

“Definitely not a clear vision!” she says of her early “I initially began my career in drug

ambitions. “My roles have covered cybercrime,

intelligence, back in the mid 2010s when

intelligence, cyber awareness, cyber risk and now

cryptocurrencies were just coming out and online

managing the whole programme for my business.

drug markets like Silk Road were booming,” she

What I’ll say is that I didn’t try to make myself fit in a

explains. “So following and researching cybercrime

technical specialist box that’s a fit for plenty of other

was my first foray into the cyber world.”

people, but not me.”

At a time when digital currencies were reshaping

Today, as CISO in the public transport sector, she

criminal enterprise and law enforcement alike, she

oversees the cyber programme for Transdev’s

found herself tracking emerging patterns of online

Australian and New Zealand operations, a vast

behaviour, illicit marketplaces and the rapidly evolving

ecosystem that includes trams, heavy rail, light rail,

intersection between technology and organised

buses and ferries. The operational complexity mirrors

crime. The work demanded analytical rigour, political

the complexity of modern cyber risk.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

W H A T ’ S

H E R

J O U R N E Y ?

“We have trams, heavy rail, light rail, bus and ferries

to manage expectations about what AI can, cannot

so the cybersecurity demands are as varied as

and should not do.”

our business,” she explains. “Mine is a ‘many hats’ role covering everything from incident response to

In other words, leadership in this era will require

training and awareness, governance and compliance,

measured guidance as much as innovation.

business continuity, and overall security uplift.”

Hype management will become as important as threat management.

Despite the breadth of responsibilities, her core priority remains distinctly human.

When considering career progression herself, remuneration is not the defining factor.

“My priority is always that my fellow journey-makers never feel panicked, embarrassed or silly in their

“Definitely flexibility!” she says. “I think cybersecurity

cybersecurity concerns. Shaming is a cybercriminal’s

is an industry which requires a remote mindset;

goal, not mine!”

cybersecurity problems hardly ever arise in the location you happen to be in. To be able to problem

It is a philosophy rooted in psychology as much

solve, manage remediation and connect with and

as policy. In environments where public safety

influence colleagues remotely is its own skill set, and

and service continuity are paramount, cultivating

one that should be treated as such.”

trust is not optional, it is foundational. By removing shame from the equation, she strengthens the

For her, flexibility is not a perk; it is operationally

organisation’s defensive posture. People report earlier.

aligned with the nature of cyber risk.

Conversations happen faster. Risk is surfaced before it escalates.

For those transitioning into the field from other professions, her message is both practical

Her belief in the broader context of cybersecurity

and empowering.

extends to education as well.

“Don’t let the technical aspects of our industry “Don’t overlook humanities!” She advises

overwhelm you or turn you away from the industry

aspiring professionals. “Everything is political,

if it’s not your strong suit,” she says. “Most of my

including cybersecurity.”

day to day is communication, customer resolution, prioritisation and risk management. There’s a huge

In her view, the field is not simply about systems and

pool of skills to draw from that are useful in our

code, but about power, governance, influence and

industry, so find yours.”

decision-making. Understanding human behaviour, institutional structures and societal drivers is just

Laura Jones’ journey is a reminder that cybersecurity

as critical as understanding vulnerabilities and

is not defined by code alone. It is defined by curiosity,

patch cycles.

courage and the willingness to claim space in a field that is still evolving. From drug intelligence

Looking ahead, she sees artificial intelligence

to leading cybersecurity across public transport

dominating industry conversations but not always in

networks spanning two countries, her path illustrates

the right way.

that sometimes the strongest signal to follow is not technical at all, it is human.

“AI of course,” she says, when asked about the most impactful developments in the next two years. “But mainly from an executive stakeholder perspective I

www.linkedin.com/in/laura-j-325961122

think cybersecurity professionals have a responsibility

I S S U E 29

WOMEN IN SECURITY MAGAZINE

35

“My interest in cybersecurity was first sparked during high school when I chose Information Processes & Technology as an HSC subject,” Erin explains.

“This subject introduced me to the fundamentals of information systems, data management, and communication frameworks, which gave me an appreciation for how technology supports everyday processes and impacts various industries.”

The defining moment came during Year 12, when Erin secured a week-long work experience placement at the Australian Signals Directorate in Canberra.

Immersed in real-world challenges, she was exposed to the practical side of cybersecurity in ways that few students encounter so early.

“This program was hands-on and allowed me to extend my knowledge through practical challenges

Erin Blanchard Technology Risk Consulting Vacationer

such as identifying security intrusions on computer systems, analysing logs for suspicious activity, and using open-source tools to recover encryption keys and decrypt data,” she says. “It was fascinating to see how cybersecurity professionals protect national interests and how technical skills can be applied to solve real-world security problems.”

F

When Erin began university, she faced the difficult task of choosing a specialisation. With options or Erin Blanchard, cybersecurity was

ranging from Business Information Systems

never just about technology. It was about

Management to Interaction Design, it was ultimately

understanding systems, uncovering hidden

cybersecurity that captured her attention. The

risks, and discovering how technical

intellectual challenge and relevance of the subject

knowledge could be applied to protect

matter made the decision clear.

something far greater than code. What began as a high school subject would ultimately evolve into a

“After exploring the introductory subjects, I found

purposeful and fast-developing career path shaped

the content in my cybersecurity courses to be both

by curiosity, initiative, and a willingness to learn at

engaging and intellectually challenging, which

every opportunity.

solidified my decision to major in Networking & Cybersecurity,” she says.

Her introduction came through studying Information

36

Processes & Technology during high school, a subject

Her academic journey soon expanded beyond the

that exposed her to the fundamentals of information

classroom. An internship with Origin Energy’s Identity

systems and data management. It gave her an early

and Access Management team allowed her to

appreciation for the invisible frameworks supporting

apply theory in a corporate environment, giving her

modern life. But it was a hands on experience that

firsthand experience with the systems that protect

transformed interest into passion.

organisational assets.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

W H A T ’ S

H E R

J O U R N E Y ?

“I worked on projects related to user provisioning,

improve my understanding. Additionally, I dedicate

access reviews, and implementing multi-factor

time outside of work to strengthen my technical

authentication solutions, which helped me understand

knowledge by studying for certifications such as

the importance of IAM in safeguarding organisational

CompTIA Security+. Combining on-the-job learning,

assets,” Erin explains. “This experience bridged the

mentorship, and self-study has been instrumental in

gap between theory and practice and confirmed that

bridging knowledge gaps and building confidence in

cybersecurity was the right career path for me.”

my role.”

Today, Erin continues to build on that foundation in

Unlike many who enter cybersecurity with a clearly

her role as a Technology Risk Consulting Vacationer,

defined destination, Erin’s path has unfolded

where each day brings new lessons and challenges.

organically. Her openness to exploration has allowed

The transition from university to industry has been

her to discover strengths and interests naturally.

both exciting and demanding.

“When I began my journey, I didn’t have a clear “One of the most challenging aspects of my current

vision of a specific role I wanted,” she reflects. “I

role is managing the steep learning curve that comes

simply wanted to explore as many areas as possible

with transitioning from university to the workplace,”

to understand what I enjoyed and what I didn’t.

she says. “While my academic background provides

Cybersecurity is such a broad field, encompassing

a solid foundation, the cybersecurity landscape is

everything from penetration testing and incident

vast and constantly evolving. Understanding how

response to governance, risk, and compliance.”

theoretical knowledge translates into practical, business-focused solutions has been both

Exposure to different domains, from Identity and

challenging and rewarding.”

Access Management to technology risk consulting, has allowed her to build a well-rounded perspective.

Rather than feeling overwhelmed, Erin has embraced the challenge with determination.

“My path has unfolded organically, with exposure

She has taken a proactive approach, seeking

to various domains happening naturally rather than

mentorship, asking questions, and investing in her

through a rigid plan,” she explains. “These experiences

professional development.

have helped me discover my strengths and interests, and they have shaped my focus on areas that

“To overcome these challenges, I take a proactive

align with both my technical skills and my passion

approach by building relationships with experienced

for problem-solving.”

colleagues who are willing to share their insights and mentor me,” she says. “I make it a point to ask

Beyond technical experience, Erin’s leadership role

questions during projects and seek feedback to

as president of the UTS Tech Society has played a transformative part in her development. Through leading the society, she has learned the importance of

“Understanding how theoretical knowledge translates into practical, business-focused solutions has been both challenging and rewarding.”

community, collaboration, and creating opportunities not only for herself but for others.

“Leading this society has given me the opportunity to engage with students, understand their aspirations, and create initiatives that provide them with industry exposure and learning opportunities,” she says.

“Networking with sponsors and collaborating on events with organisations such as ACS, PwC, and

I S S U E 29

WOMEN IN SECURITY MAGAZINE

37

Macquarie has provided me with insights into

Despite being early in her career, Erin already

the cybersecurity landscape and helped me build

finds deep satisfaction in the work itself. For her,

relationships with industry professionals.”

cybersecurity is not just intellectually stimulating, but meaningful.

These experiences reinforced a lesson that Erin believes is essential for anyone entering

“At this stage, I find the greatest satisfaction in

cybersecurity. Success is built not only on technical

learning and contributing to a variety of tasks,” she

ability, but on relationships, curiosity, and initiative.

says. “Every project presents an opportunity to gain new insights and develop practical skills.”

If she could offer advice to her younger self, it would be simple but powerful.

More importantly, she recognises the real-world impact of the work she is part of.

“I would tell my high school self to be proactive in seeking opportunities beyond the classroom,” she

“I also find fulfillment in seeing the broader impact

says. “While academic performance is important,

of cybersecurity work,” Erin adds. “Whether it’s

getting involved in co-curricular activities and

helping clients strengthen their security posture

networking early can make a significant difference.”

or contributing to risk assessments that protect sensitive data, knowing that our efforts make

She also emphasises the importance of confidence

a difference to organisations and society is

and curiosity.

incredibly motivating.”

“Don’t be afraid to ask questions, even if they seem

To stay ahead in such a fast-moving field, Erin

basic, and challenge yourself by taking on tasks

remains committed to continuous learning. She

that push you out of your comfort zone,” Erin says.

keeps informed through industry news, professional

“Growth in cybersecurity comes from continuous

connections, and ongoing engagement with the

learning and embracing challenges, so developing

cybersecurity community.

these habits early would set a strong foundation for future success.”

“Cybersecurity is a fast-moving field, so staying informed is essential,” she says. “Networking

That commitment to growth continues to shape

is another key strategy. Engaging with industry

her future plans. Erin is currently pursuing industry

professionals helps me learn about their roles,

certifications to strengthen her technical foundation

the challenges they encounter, and their career

and deepen her understanding of cybersecurity and

progression. These interactions provide practical

cloud environments.

insights that complement my technical learning.

“I plan to pursue certifications such as CompTIA

Erin Blanchard’s journey reflects the evolving nature

Security+ and Microsoft SC-900,” she explains. “These

of cybersecurity itself, dynamic, complex, and full of

certifications not only validate technical knowledge

opportunity for those willing to explore. Guided by

but also demonstrate a commitment to professional

curiosity, strengthened through experience, and driven

development. They provide a strong foundation for

by purpose, she is steadily building a career defined

understanding cybersecurity principles and can serve

not just by technical expertise, but by resilience,

as a stepping stone to more advanced certifications

leadership, and a genuine commitment to protecting

in the future.”

the systems that shape the modern world.

www.linkedin.com/in/erin-blanchard-290aab2a5

38

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

EXCLUSIVE

ADVERTISING PACKAGE For the past four years, Source2Create has proudly delivered Women in Security Magazine to the industry free of charge, championing diversity, inclusion, and the incredible contributions of women in cybersecurity. As we continue to grow, we now need partners to help us sustain and expand this vital platform.

By supporting this package, you’re not just backing us—you’re investing in the magazine, its community, and the future of women in security.

To ensure we can keep delivering this high-value publication, we’re introducing a nominal fee for $900 Ex GST, an exceptional package that provides extensive coverage and visibility.

WHAT'S INCLUDED? OFFICIAL PARTNER RECOGNITION Your logo will be prominently displayed at the beginning of the magazine in our “Partner of the Issue” panel.

GLOBAL AUDIENCE REACH Your brand will be seen by 5,000+ global subscribers through our free, bi-monthly digital publication, dedicated to supporting and showcasing women in security.

2 FULL-PAGE ADVERTS Feature your brand in two issues of your choice between March and December.

2 JOB POSTINGS Advertise up to two job opportunities in the magazine and across our social media platforms, reaching a highly engaged cybersecurity audience.

ONLINE BANNER ROTATION on WomenInSecurityMagazine.com

This high-value package ensures maximum visibility for your brand while directly supporting the continuation of Women in Security Magazine.

Join us in making an impact—partner with us today!

EMAIL JANE@SOURCE2CREATE.COM.AU

Doors continued to open. Cleo joined a women’s fellowship program at Startmate, an experience that immersed her in the startup ecosystem for the first time. Surrounded by founders, builders, and creative problem-solvers, she saw firsthand how technology could be harnessed to solve meaningful, realworld problems.

Cleo Faul Consultant (KPMG)

“Being surrounded by founders, builders, and problemsolvers showed me how technology could be used creatively to solve real problems,” she says. “I’m still learning every day and I’m excited about building a long-term career in this space.”

In the early stages of her professional journey, Cleo made a defining choice: she said yes to opportunities

C

that didn’t necessarily follow a traditional or linear path. While studying, she worked as a marketing leo Faul’s career in cybersecurity wasn’t

intern at a startup before moving into partnerships

mapped out in high school or carefully

and account management roles, where she

plotted from childhood. It unfolded

spent three years honing her commercial and

gradually, shaped by curiosity, courage,

communication skills.

and a willingness to begin again.

“Balancing full-time work while studying was a

“My journey into technology wasn’t something I had

hustle,” she admits. “But it taught me how to learn

planned from the start; it evolved,” she reflects.

quickly, take responsibility, and adapt in fastmoving environments.”

After finishing school, Cleo stepped into a world far

40

removed from IT audit and tech risk. She began her

Eventually, Cleo felt the pull toward the corporate

career as a personal trainer, drawn to the people’s

world. Not as a replacement for the startup

focused nature of the role. “I loved the people’s side of

experience she valued, but as a way to build a strong,

that work,” she says. But over time, curiosity stirred.

transferable foundation. “I was still young and wanted

She began to wonder what else was possible, what

to build strong, transferable skills,” she explains.

other paths might exist beyond the gym floor.

“Applying to KPMG felt like the right next step.”

That curiosity led her back to study, where she

Joining Tech Risk Consulting allowed her to

commenced a Commerce degree majoring in

combine her interests in technology, business, and

Information Systems. It was there that technology

continuous learning. Today, she works within IT Asset

shifted from an abstract concept to a genuine

Management, helping organisations understand

interest. “That’s where my interest in technology really

whether their software and hardware assets are being

began to grow,” she explains.

used appropriately and effectively.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

W H A T ’ S

H E R

J O U R N E Y ?

“For someone non-technical, I like to explain it like

to help. That mindset unlocked my confidence and

this,” she says with a smile. “Imagine a company

accelerated my growth. Once that clicked, I felt like I

has purchased 100 Netflix subscriptions. My role

could really fly.”

is to help check whether they’re actually using 100 subscriptions, not 80, and not 110. I do the same

For Cleo, one of the most fulfilling aspects of her

thing, but with software and hardware assets.”

current role is the sheer volume of knowledge she is absorbing. “The biggest source of fulfillment for

No two days look the same, and that variety is

me right now is learning,” she says. “I’m surrounded

something she relishes. But stepping into a highly

by incredibly talented people, and I know that the

technical environment as a graduate has not been

knowledge I’m building is foundational. It’s setting me

without its challenges.

up not just for this role, but for my entire career.”

“The most challenging part of my current role is

She approaches each day with what she calls

balancing the steep learning curve with the pressure

a “be a sponge” mindset absorbing insights,

I sometimes place on myself to perform,” she

connecting dots, and gradually building confidence

shares. “There is a lot to absorb new systems, new

through competence.

terminology, and new ways of thinking.”

If she could speak to her high school self, her advice Her approach has been deliberate and grounded. “I’m

would be simple yet powerful. “You don’t have to fit

overcoming this by reminding myself that learning

a mould to succeed,” she says. “You don’t need to

is the job right now. I focus on asking questions

have everything figured out, and you don’t need to

early, taking notes, and being proactive about

become someone else to belong in a professional

understanding the ‘why’ behind what I’m doing.

environment. Being yourself is enough. If you show

Accepting that growth takes time has helped me

up authentically, stay curious, and are willing to

manage both the technical challenge and the mental

learn, you’ll find your place even if the path there

load that comes with it.”

isn’t straight.”

Uncertainty, she admits, has been a constant

Her message to others transitioning into cybersecurity

companion. Moving between industries, starting over

from different industries echoes the same theme.

as a graduate, and navigating imposter syndrome all

“Your past experiences are not a disadvantage, they’re

tested her confidence.

an asset,” she says. “Coming from different industries gives you perspective, adaptability, and people skills

“There were times I questioned whether I was

that are incredibly valuable, especially in technology

‘technical enough’ or if I truly belonged,” she says

and consulting. Don’t underestimate what you already

candidly. “What helped was reframing those doubts.

bring to the table.”

Instead of seeing them as a weakness, I started to view them as a sign that I was learning and

Cleo Faul’s journey is not one of rigid planning or

stretching myself.”

linear progression. It is a story of evolution, humility, and bravery, to start over, to ask questions, and

Leaning into support networks and allowing herself

to grow out loud. In an industry that often prizes

to be open about what she didn’t know proved

technical perfection, her story is a reminder that

transformative. “No one expects you to know

sometimes the most powerful skill of all is simply

everything, especially early in your career,” she

being brave enough to begin.

says. “Once I embraced speaking up and asking for help, everything changed. People genuinely want

I S S U E 29

www.linkedin.com/in/cleo-faul-05146a1a0

WOMEN IN SECURITY MAGAZINE

41

TRANSFERABLE SKILLS ASSESSMENT CHECKLIST

by Abigail Swabey

Practical resources for career changers entering cybersecurity from non-traditional backgrounds.

These checklists, guides and advice columns are tailored with a special nod to veterans, dentists, nurses and other professionals leveraging transferable skills.

USE THIS TWO-MINUTE SELF-ASSESSMENT TO IDENTIFY YOUR CYBER-READY STRENGTHS. SCORE YOURSELF 1-5 (1=NEVER, 5=EXPERT) THEN TOTAL EACH CATEGORY.

• I explain complex ideas simply (stakeholder briefings, patient education) • I train/mentor others (military instruction, staff training, workshops)

Technical foundations

• Total: ___/15

• I understand systems, networks or

Process and operations

troubleshooting (IT, engineering, military comms) • I work with data/tools/software daily (dentistry records, nursing devices, project management) • I spot patterns/anomalies in information (diagnostics, risk analysis, logistics) • Total: ___/15 Risk and analytical thinking

• I design/improve workflows (SOPs, compliance processes, clinical protocols) • I manage crises/incidents (emergency protocols, supply chain disruptions) • I document thoroughly (reports, audits, patient records) • Total: ___/15

• I assess threats/prioritise risks (military ops, healthcare triage, compliance audits) • I investigate root causes (medical diagnosis, incident reports, HR investigations) • I make decisions with incomplete information (emergency response, project deadlines) • Total: ___/15 Leadership and communication • I lead teams under pressure (military, project management, patient care coordination)

42

W O M E N I N S E C U R I T Y M A G A Z I N E

SCORING GUIDE: • 40-50: Cyber-ready – Target analyst/manager roles • 30-39: Strong foundation – Add 1-2 certifications (Security+, CySA+) • 20-29: Great start – Begin with SOC/helpdesk pathways • <20: Build basics – Free CompTIA IT Fundamentals first

M A R C H • A P R I L 2026

F E A T U R E

GUIDE: SELLING YOUR TRANSFERABLE SKILLS

CAREER COACH ADVICE COLUMNS From Sarah Mitchell, Veteran CISO (ex-army

1. Translate, don't list

intelligence): "Veterans: stop apologising for 'not

Instead of "Managed dental practice records," say:

being technical’. Your OPSEC discipline beats

"Managed sensitive patient data with HIPAA-equivalent

90 percent of entry-level analysts. Get Security+

chain-of-custody protocols, ready for IAM/log

(government funds it), then volunteer for your

management roles."

company's security committee. Six months later, you're the 'known quantity' for the SOC role. Don't chase certs

Military to Cyber Examples:

endlessly, get hands-on via bug bounties or home labs

Military

Cyber

Target Role

Experience

Translation

Risk

Threat

Threat intel

assessment

modelling

analyst

Logistics under

Incident

SOC analyst

pressure

response

Briefings to

Stakeholder

command

reporting

patrols

Cyber

Experience

Translation

Patient triage

Incident

From Dr Lisa Chen, ex-dentist to cloud security engineer: "Healthcare pros: your HIPAA/GDPR experience equals instant GRC credibility. Dental records? That's IAM and data classification. Patient breach response? That's IR planning. Pitch yourself as 'regulated industry risk expert transitioning to cyber.'

GRC specialist

Start with Coursera's Google Cybersecurity Certificate.

It maps perfectly to your diagnostic mindset."

Healthcare to Cyber Examples: Healthcare

first."

From Karen Patel, HR director to Human risk Target Role IR manager

prioritisation

manager: "HR/training backgrounds: you're perfect for security awareness and insider threat roles (80 percent of breaches are human). Your investigations equal digital forensics basics. Employee training equals phishing simulations. Lead with 'I reduced workplace

Device

System

Security

sterilisation

hardening

engineer

Post-mortem

Root cause

Forensics

QUICK START ACTION PLAN

reviews

analysis

analyst

• Week 1: Complete checklist; Identify top two skill

protocols

incidents 40 percent through behavioural interventions' – that's behavioural security in corporate language."

categories.

2. Resume keywords by role: • SOC analyst: monitoring, triage, anomalies, shift work, detail oriented.

• GRC: compliance, audit, policy, risk frameworks, reporting.

• Awareness training:

• Week 2: Free intro course (Google Cybersecurity Cert or TryHackMe).

• Week 3: Tailor resume + LinkedIn; Apply to five 'skills-based' job ads.

• Week 4: Network (VetSec, WiCyS, RSL Cyber Academy events).

• Month 2: Security+ or equivalent; Entry role applications.

communication, adult learning, behaviour

Pro Tip: Target skills-based hiring companies

change, workshops.

(Google, IBM, Deloitte). They explicitly welcome career changers. Use your network; every security leader was once a beginner!

I S S U E 29

WOMEN IN SECURITY MAGAZINE

43

CRAIG FORD Craig is an experienced cyber security professional with various qualifications including two master’s degrees. He is the Head Unicorn (co-founder and director) of Cyber Unicorns, in which he acts as a vCISO to clients such as Baidam Solutions, Wesley Mission, PCYC, Hungry Jacks and Ipswich City Council. He was CTO (Chief Technology Officer) for Baidam Solutions between January 2022 to June 2023, where he led the technical services team, helping to build out the internal services capability for Baidam. Craig was QLD chair for AISA for two years until he was appointed to the national board of directors in December 2022.

Grab it by the horns Like many who have been in this industry for a while,

up doing two master’s degrees with CSU (that’s a

I often get asked: “How did you get into the industry?”

topic for another article, maybe).

or “How did you get to where you are?”

I never chose the blue team or the red team, always You can learn things from my journey, I certainly have.

floating between them. I have published more

And you can also learn things from others’ journeys,

than 500 articles in my career, given hundreds

but I want to make something very clear: DO NOT

of presentations/talks and, as I write this, have

FOLLOW MY PATH.

just finished off the first draft of my seventh book, Glimmer.

Now, before you all say; “Why, do you think we are not good enough to do what you did, or what they did?”

I cofounded Cyber Unicorns with my wife Melissa

That’s not why I am telling you not to follow my path.

because we wanted to make a real difference educating everyday people; kids, mums and dads,

Before we dive into that, let’s first talk about my path.

seniors and so many SMBs out there that need

I started out with a traineeship in a small IT computer

the help. I was sick of talking about how someone

shop. I earned my stripes and learnt a lot before

needed to do something, and decided I should be

making a move to the city (Gold Coast) because I

that someone.

felt I could go no further where I was. That was 100 percent true. I still have fond memories of my time

I am the deputy chairman of the board for AISA

working in that shop. I even went back for a time to

(Australian Information Security Association) while

manage it for the owner.

also a fractional CISO for Wesley Mission, PCYC, RespectX and some others. In 2025 I won two

About 10 years later in my journey, I was still in IT, but

industry awards and four international awards for my

in senior roles. I decided I wanted to be a CIO in a big

literary works.

company. That one I got wrong. I decided I needed to have a degree to give me the best shot. So I went

In my mind my career is still just warming up, but if

back to school. I joined the IT master’s program at

you look at it, there were many forks in the road. I

Charles Sturt University. One of my first units was an

have parallel journeys running simultaneously, some

elective on incident response. I followed that with a

progressing faster than others. I am not singularly

forensics unit.

focused. My career looks like a very artistic drawing from a two year old (lots of squiggly lines). As a

Can you guess what happened next? I threw my CIO

parent, you would be amazed, but everyone else

dream out of the window. I loved forensics. I loved

would go: “mmm, yeah, very cool scribble. Well done.”

Incident response. I went down a rabbit hole from

44

which I have never returned. I have now been in the

We all have our ups and downs. If you looked at

ICT and cyber worlds for more than 20 years. I ended

five different CISOs or penetration testers, each

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

Craig is a published author with three different book series – ‘A Hacker I Am’ cyber education series, ‘Foresight’ is his Cyberpunk/hacker fantasy novel series and then there is ‘The Shadow World’, a co-authored kids cyber education book. He is a freelance cyber security journalist and is a regular columnist with the Women in Security Magazine, as well as a freelance contributor for Cyber Today, Top Cyber News, SecureGov, Careers with STEM and Cyber Australia magazines.

C O L U M N

If you think I have done well and you want to be where I am, that’s amazing. BUT you are the architect of your life and your career. That means you need to think about what you want, what your true end goal is. Don’t be an idiot and come up with something that is not realistic (Maybe you could still achieve that, but let’s be real).

I want you to visualise that goal. Once you know, I want you to look at the skills and experience you will need to be that person. Real skills. Real qualifications Those that are non-negotiable.

Now, figure out how the hell you are going to get those experiences, skills and qualifications. Whatever you don’t have, make a plan. Don’t take no for an answer. Figure out your path.

That is the part you need to stay firm on; this is YOUR path. You should still listen to people’s opinions, take on their advice, but don’t blindly follow someone else’s ideals or expectations of you.

We are all the ‘architects of our futures’. So get out there, grab your life and your career by the horns, make some mistakes, learn some lessons. And don’t be afraid to go against the grain if you know that journey would be very different. Sometimes there are

doing so is right for you.

similarities in how people achieve similar positions, but you can’t use these to create a clear road map.

www.cyberunicorns.com.au

Do you get what I am trying to tell you? I want you

www.linkedin.com/in/craig-ford-cybersecurity

to understand that you can’t follow your role model’s career path to reach your goal. Firstly, you are not

www.facebook.com/CyberUnicorns

them. They may be amazing. They may have an awesome career and definitely be worth watching to

www.instagram.com/cyberunicorns.com.au

see what might work for you.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

45

INDUSTRY PERSPECTIVES

ADRIANA JONES

ARCHITECTS OF YOUR FUTURE: BUILDING A STRUCTURAL SOLUTION TO CHILD PROTECTION IN A DIGITAL WORLD

by Adriana Jones, Engineer, Cybersecurity Advocate and founder of The Innocent Souls Project (TISP)

Before transitioning into cybersecurity I worked in

This way of thinking translates naturally to child

construction. My first degree was in civil engineering

protection in a digital world. As technology becomes

and, during university, I learnt something that has

more deeply embedded in children’s lives, protection

stayed with me ever since: no structure is ever

can no longer rely on isolated controls or reactive

designed from the top down.

measures. It requires a structural approach, one that is intentional, layered and resilient. In this

Every building begins with its foundations. Engineers

context, effective child protection rests on three

calculate load, stress and future capacity before

interconnected pillars: cybersecurity, eSafety and

anything rises above ground. A structure must

physical data safety.

support not only its current weight, but also growth,

48

change and unforeseen external forces. When

PILLAR ONE: CYBERSECURITY

designed well, it remains stable even when pressure is

Cybersecurity provides the structural foundation

applied from the outside.

for child protection in digital environments. At its

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

I N D U S T R Y

P E R S P E C T I V E S

core, cybersecurity is about designing systems that

PILLAR TWO: ESAFETY

anticipate failure and limit harm when it occurs.

eSafety complements cybersecurity by focusing on

This principle is especially critical where children

the human experience of digital systems. Where

are involved.

cybersecurity strengthens infrastructure, eSafety supports safe participation, understanding and

Children do not meaningfully consent to data

confidence in digital spaces.

collection. They cannot assess long-term risk, understand how their information may be reused or

At its best eSafety is proactive and empowering. It

anticipate how digital records created today could

equips children, families and communities with the

affect them years into the future. Yet, many systems

awareness needed to navigate online interaction,

that interact with children continue to collect, retain

communication and boundaries in a healthy way.

and correlate data far beyond what is necessary for

Rather than limiting engagement, it supports

functionality or safety.

informed engagement, helping children benefit from technology while recognising how to respond to

From a cybersecurity perspective this creates

challenges that may arise.

avoidable risk. Every additional data point increases the potential impact of a breach. Every retained

Importantly, eSafety does not operate in isolation. Its

identifier extends the lifespan of harm. Designing

effectiveness increases when it is aligned with secure

secure systems for children therefore requires a shift

system design. When digital environments are built

in mindset; from data accumulation to data restraint.

with safety in mind, eSafety education reinforces those protections rather than compensating for

Data minimisation is not a limitation; it is a security

their absence.

control. When systems are designed to collect only what is essential, store it for limited periods and

From a cybersecurity standpoint, eSafety strengthens

tightly control access, they reduce exposure by design

the human layer of defence. It reduces the likelihood

rather than by policy. This approach aligns security

of manipulation, misuse and unintentional exposure;

objectives with ethical responsibility, ensuring that

not by shifting responsibility onto children, but

protection does not depend on constant oversight or

by fostering digital environments where safety is

perfect compliance.

understandable and supported.

For cybersecurity professionals this represents an opportunity to apply mature security principles, least privilege, containment and resilience to one of the most sensitive user groups. When cybersecurity is embedded early and thoughtfully it quietly protects children without requiring them to understand risks they were never meant to carry.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

49

PILLAR THREE: PHYSICAL DATA SAFETY

This integrated approach does not constitute a

The third pillar connects digital security to the

finished solution. Technology evolves, threats

physical world. Children’s data is not confined to

adapt and systems must continue to improve.

online platforms; it is also held by schools, childcare

But when protection is structural, progress builds

centres, healthcare providers and community

on a stable foundation rather than patching

organisations. These environments collect highly

recurring weaknesses.

sensitive information as part of care and education making them critical components of the child

For the cybersecurity community this represents

protection ecosystem.

both a responsibility and an opportunity. By applying principles of secure design, data minimisation

Protecting this data is inseparable from protecting

and long-term risk reduction we can help create

children themselves. Strong cybersecurity practices

digital environments that support children safely as

within physical institutions help ensure information

technology continues to advance.

collected for wellbeing does not become a source of unintended risk. Secure systems, sound governance

Strong structures are never static. Stability is

and thoughtful data handling reduce the likelihood

achieved not through rigidity but through the ability to

that personal details, images or routines can

absorb pressure and adapt to change.

be misused.

These three pillars cybersecurity, eSafety and When physical environments and digital systems

physical-data safety are designed to endure, adapt

are aligned, data protection becomes an extension

and support what the future demands. Child

of physical safety. Cybersecurity maturity in these

protection demands the same level of critical thinking

settings supports trust, continuity of care and long-

and creative system design.

term protection.

DESIGNING FOR RESILIENCE In engineering resilience is achieved by designing for load, not appearances. Child protection benefits from the same discipline. Cybersecurity, eSafety and physical data safety are most effective when they

au.linkedin.com/company/tisp-the-innocent-souls-project

www.instagram.com/tisp_project

theinnocentsoulsproject.com.au

are treated as structural elements, reinforcing one another rather than operating independently.

50

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

JO STEWART-RATTRAY

WHY SECURITY’S SKILL TRANSFORMATION IS BEING BUILT BY CAREER CHANGERS AND BRAVE REINVENTORS

by Jo Stewart-Rattray, Oceania Ambassador, ISACA If you look closely at today’s privacy and security

I’ve seen firsthand how professionals from policing

teams one thing becomes clear very quickly; many

and counterterrorism bring exceptional investigative

professionals didn’t get where they are by following a

instincts into cyber threat hunting and remediation

single, straight career path.

roles. In my own journey my shift from CIO to CISO was less about changing direction and more about

ISACA’s 2026 State of Privacy survey shows more

building on operational experience to lead security

than half of organisations globally now report

from a broader risk perspective.

that at least half of their privacy teams’ members transitioned from completely different careers.

These non-linear journeys are no longer unusual but

Only a quarter say their teams largely started, and

are increasingly commonplace in today’s security

stayed, in privacy. In other words, the profession

workforce. At the same time, the pressure on teams

is increasingly being built by people who have

continues to rise. Median privacy team sizes globally

reinvented themselves.

have shrunk from eight to just five people, while almost two-thirds of professionals

Former lawyers are now navigating governance

in Oceania say their roles are more

frameworks. Finance professionals

stressful than five years ago. Budgets

are stepping into risk and compliance.

Teachers are leading awareness programs.

are tightening, skills gaps are growing and expectations keep climbing.

Military veterans are applying crisis

52

management and threat assessment

Yet, within this challenge lies an

skills to cyber operations.

opportunity. Rather than relying solely

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

I N D U S T R Y

P E R S P E C T I V E S

on traditional pipelines many organisations are now

teams. They also reduce burnout by sharing

actively growing talent from within. Almost half of

knowledge across diverse backgrounds and creating

surveyed organisations are training staff from other

stronger collaboration.

parts of the business who show interest in privacy and security roles.

The ISACA survey highlights what happens when culture and training fall short: more than half of

This shift recognises what many in the profession

respondents cite lack of training as a leading cause

already know; that great security professionals aren’t

of privacy failures. In a profession where technology

defined only by where they started, but by how willing

changes constantly, learning can’t be a one-off event.

they are to learn, adapt and build new skills.

It needs to be embedded into everyday work life.

Programs like ISACA’s SheLeadsTech initiative reflect

This is where structured development programs and

this reality, helping professionals build confidence,

certifications, accessible learning resources and

access mentorships and develop the technical and

communities of practice become essential. They help

leadership skills needed to succeed in new roles. For

professionals stay current while building confidence.

many women, particularly those undergoing career transitions, having community support alongside

Ultimately, the future of security won’t be shaped

structured learning can be the difference between

by one type of professional following one narrow

self-doubt and self-belief.

path. It will be built by people willing to pivot, upskill, challenge themselves and bring diverse experiences.

To me, transformation is about helping people

And by embracing transferable skills, supporting

understand, and confidently communicate, the

continuous learning and building cultures that

strengths they already bring. Practical tools can

welcome non-linear career paths, the security sector

play a big role here. Skills mapping exercises that

can close skills gaps to create a stronger, more

show how competencies such as risk management,

adaptable profession.

communication, leadership, analytical thinking and crisis response translate across industries can help career changers recognise their value.

ABOUT THE AUTHOR Jo has over 25 years’ experience in the security

Simple checklists for assessing transferable

sector. She consults in risk and technology issues

skills from project management to stakeholder

with a particular emphasis on governance and

engagement allow professionals to identify gaps

cybersecurity as a director with BRM Advisory.

while also appreciating existing strengths. Being able

Jo is the Oceania Ambassador for global IT

to clearly articulate how past roles prepared you for

professional association, ISACA, and an ISACA

security challenges can open doors.

Hall of Fame inductee. Jo is the former Vice President, Communities of the Australian

For organisations, this means rethinking traditional

Computer Society and Ambassador of the

hiring models. Rather than filtering candidates purely

National Rural Women’s Coalition. She regularly

by linear experience or specific job titles, future-ready

provides strategic advice and consulting to the

workplaces are learning to spot potential, adaptability

banking and finance, utilities, healthcare, tertiary

and willingness to upskill. And culture plays a

education, retail and government sectors.

critical role.

Supportive environments that encourage continuous learning, offer mentorship and view career pivots

www.linkedin.com/in/jo-stewart-rattray-gaicd-4991a12

positively are better equipped to build resilient

I S S U E 29

WOMEN IN SECURITY MAGAZINE

53

LISA VENTURA

THE TRAUMA-INFORMED SECURITY ARCHITECT: REDESIGNING AWARENESS TRAINING

by Lisa Ventura MBE FCIIS, Chief Executive and Founder, Unity Group Solutions Limited/AI and Cyber Security Association For years we’ve told employees they’re the ‘human

failures. Create an atmosphere where one wrong click

firewall’. We’ve shamed them when they click phishing

feels career-limiting.

links, threatened them with disciplinary action and designed training that treats them as the weakest

This approach backfires. When people feel ashamed

link in our security chain. Then, we wonder why our

or blamed, they become defensive. They hide

security awareness programs fail to create lasting

mistakes rather than report them. They disengage

behavioural change.

from training that makes them feel inadequate. The very shame we inflict to motivate change becomes

What if the problem isn’t the humans, but how we’re

the barrier preventing it.

trying to teach them?

I’ve watched security teams frustrated that ‘users After managing cybersecurity across eight countries

just don’t get it’, whilst employees dread training that

and 700,000+ customers, I’ve learnt something

makes them feel stupid. It creates a cycle of blame

crucial: trauma-informed security awareness training

that benefits no one and certainly doesn’t make us

doesn’t just feel better. It works better. Measurably,

more secure.

significantly better.

54

WHAT DOES TRAUMA-INFORMED ACTUALLY MEAN?

THE HIDDEN COST OF SHAMEBASED TRAINING

Trauma-informed approaches recognise that

Traditional security awareness training operates

people’s past experiences shape how they respond

on a simple premise: scare people enough and

to new situations. In security training this means

they’ll change their behaviour. Show them breach

understanding that not everyone starts from the

consequences. Publicly name phishing simulation

same place.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

I N D U S T R Y

P E R S P E C T I V E S

Some employees have learning differences that

We moved away from annual ‘compliance tick-box’

make certain materials inaccessible. Others have

training to ongoing, bite-sized micro/nano learning

experienced workplace trauma that makes public

integrated into the workflow. Security awareness

‘naming and shaming’ genuinely harmful. Many

became a conversation, not a lecture.

simply lack the technical background to intuitively understand concepts security professionals take

THE MEASURABLE IMPACT

for granted.

The sceptics always ask: does it actually work?

A trauma-informed approach asks: how do we

In one particularly striking example, we saw a

create psychological safety whilst still achieving our

reduction of up to 90 percent in phish-prone

security objectives?

behaviours across certain user groups. Not through fear. Not through shame. Through respect,

The principles are straightforward:

understanding and well-designed training that met people where they were.

• Create safety first.

• Build trust through transparency.

Crucially, incident reporting increased dramatically.

• Offer choice and collaboration.

When employees don’t fear punishment they report

• Recognise that people are doing their best

suspicious activity. This is perhaps the most valuable

with available resources. Design training that

outcome of all, because security is fundamentally

empowers rather than diminishes.

about information flow. We need people to tell us when something seems wrong, not hide it because

CASE STUDY: REDESIGNING FROM THE GROUND UP

they’re afraid of looking foolish.

This is a live case study of redesigning a

Employee feedback shifted from ‘this is painful’ to

cybersecurity awareness training program to make it

‘this actually helped me protect my personal accounts

trauma informed. The first step was to move from a

too’. When training respects people’s intelligence and

deficit model to a strengths-based approach. Instead

acknowledges their challenges, engagement follows.

of focusing on what employees were doing wrong, we highlighted what they were already doing right. We celebrated the person who paused before clicking. We recognised teams who reported suspicious emails.

We also completely redesigned our phishing simulations. Rather than creating emails designed to catch people out, we created scenarios that taught recognition skills. When someone clicked, instead of a shame-inducing ‘you failed’ message, they received immediate, constructive feedback explaining what to look for next time. No naming individuals. No league tables of failure. Just learning.

The accessibility piece was crucial. We provided training in multiple formats, recognising that neurodivergent employees might process information differently. We provided video transcripts, audio descriptions, clear, jargon-free language and options to access content at different paces.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

55

The business case writes itself. We saw better

click rates but reporting rates, engagement rates and

security outcomes, higher engagement, improved

how people feel about security.

reporting, reduced anxiety and a security culture built on empowerment rather than fear. Plus, trauma-

Most importantly, recognise that the humans in your

informed approaches naturally align with broader

organisation aren’t your security problem. They’re

diversity, equity and inclusion initiatives, creating

your security solution, if you can move beyond fear-

consistency across organisational values.

based approaches that have demonstrably failed.

BEYOND COMPLIANCE THEATRE

The future of security awareness isn’t about

Perhaps the most significant shift is philosophical.

building better human firewalls. It’s about creating

Trauma-informed security awareness forces us to

psychologically safe environments where people

examine why we do what we do. Are we running

can learn, grow and actively participate in keeping

phishing simulations because they genuinely improve

everyone secure. That’s not just better ethics. It’s

security, or because everyone else does them? Are we

better security.

creating training that serves compliance requirements but doesn’t actually change behaviour?

I’ve spent hours in conversations with employees

LISA ON SOCIAL MEDIA www.lisaventura.co.uk

about what genuinely helps them spot threats. The answers are rarely what security teams expect.

@cybergeekgirl

Sometimes it’s about having time to think rather than rushing between tasks. Sometimes it’s about clearer

www.linkedin.com/in/lisasventura/

communication from IT about what normal looks like.

Often, it’s about feeling trusted and respected rather

www.facebook.com/lisasventurauk

than monitored and blamed. www.instagram.com/lsventurauk

This doesn’t mean lowering standards or avoiding difficult conversations. It means having those

bsky.app/profile/cybergeekgirl.bsky.social

conversations from a place of partnership rather than punishment.

You can find examples of the talks has she done previously and of interviews, panel discussions and

THE PATH FORWARD

moderating/chairing events on her YouTube channel

Implementing trauma-informed security awareness

here https://www.youtube.com/@CyberSecurityLisa/

requires security leaders to examine their own assumptions about human behaviour. It requires moving beyond the ‘human firewall’ metaphor that

ABOUT LISA VENTURA MBE FCIIS

positions people as security infrastructure rather than

Lisa Ventura MBE FCIIS is the chief executive and

valued colleagues.

founder of the AI and Cyber Security Association (AICSA). She is the author of ‘Artificial Intelligence

Start small. Review your next phishing simulation

in Cybersecurity’ (published by Kogan Page)

through a trauma-informed lens. Ask: does this teach

due for release in April 2026 and advocates for

or does it trick? Does it empower or diminish? Would I

neuroinclusive, trauma-informed approaches to

want to receive this?

security awareness training.

Engage employees in designing training that works for them. Create feedback loops. Measure not just

56

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

SIMON CARABETTA

SAY GOODBYE TO THE CYBER CASH COW

By Simon Carabetta, National Cyber Security Training Advisor

When I first made the leap from moderately OK

existed for only three, or a list of certifications that

high school teacher to moderately OK cybersecurity

forced candidates to sell a kidney on the dark web

awareness trainer back in 2019 I knew that executing

to the highest bidder, and maybe part of their liver

the jump would require a level of ‘fake it till you make

as well.

it’ energy. Fortunately, I discovered quite early on that I was more than moderately OK at what I was

A SIMPLER TIME

doing and, very much unlike the last three years of

Pre COVID, before all the crazies really came out of

my teaching days, actually enjoyed it. I got to engage

the proverbial woodwork (you know the ones I’m

with people on a level that I had not done previously.

talking about), you could speak to the virtues of

I was an advisor, someone who had acquired a depth

advocating for diversity and equity in the industry at

of knowledge in a very short space of time and was

a mid-week networking event without harassment by

willing to impart that knowledge at every turn.

certain less obvious crazies a (you know the ones I’m talking about).

Nowadays I look back fondly on that time as a moment when cybersecurity awareness, as we know

This editorial isn’t designed (intentionally anyway)

it today, was still in its infancy; when companies

to upset any of those particular people. However, if

weren’t yet making investments in phishing

you make it to the end instead of deciding to browse

simulations, and when phishing simulation vendors

Reddit (I wouldn’t blame you), hopefully, it will give

were not flooding the market with the exact same

you some food for thought. What I will take aim at

product wrapped in a different package.

today is the complete lack of regard that certain educational institutions and workplaces have for

58

It was also a time when people with cybersecurity

cybersecurity students, and the subsequent flow-on

qualifications were much rarer, and not every single

effect a decade-long cash cow is having on our job

person was enrolling in a master’s course. It was a

market, our future workforce and, finally, the security

time when there were jobs in cybersecurity that did

of Australian businesses, public sector agencies

not require 10 years’ experience using tools that had

and individuals.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

I N D U S T R Y

P E R S P E C T I V E S

I will start with one segment of education that is

My point here is: the supply far outweighed the

very rarely spoken of in a negative light, at least in

demand, meaning some of those enrolling in

public: Australian universities offering cybersecurity

education courses should have gone to another

qualifications. Yes, I realise many people who read

university and enrolled in economics, but I digress.

Women in Security Magazine work either as academic

This oversupply created a massive issue—not just

or non-academic staff for universities (heck I used

for my university, but for the other four universities in

to be based at one), but sometimes a painful pill is

WA offering education—by producing graduates who

the best medicine, even for the post-COVID crazies I

could not find employment.

mentioned earlier.

UNEMPLOYED AND NO LONGER STUDENTS The unfortunate mess we find ourselves in today

I swear, if I fulfilled my life-long dream of forming a

can be described as follows. There are far too many

jazz funk band I’d name it thus. However, this is the

current students and graduates, too few jobs, far

situation where many former cybersecurity students

too little investment into cybersecurity, insufficient

find themselves in right now. They have little or no

understanding of how money should be invested into

experience. Their skills are misaligned with industry

cybersecurity and a lack of understanding of the why

standards. They don’t get the support they require

of cybersecurity.

when looking for work post-graduation. Yes, there are some universities that do offer internships (which are

Let’s go back to the beginning.

harder to fill than people realise) and there are many that offer career counselling, but beyond ticking a

UNIVERSITIES AND THE CASH COW

box to say they’re helping, there really isn’t anything

When I first commenced my graduate diploma in

meaningful going on.

education I was unaware that Western Australia was about to be hit by a teacher surplus. A surplus,

We currently have, across Australia, a surplus of

meaning too many teachers. Yet the university I was

cybersecurity graduates and too few cybersecurity

studying at, which shall remain nameless unless

jobs. We have people spending $50,000 plus on

you check out my LinkedIn profile, was still taking

a master’s level qualification in the hope they can

on as many qualified students as it could. Why?

change careers, without much chance of doing so.

Well, simply because education was the cash cow

And, yes, while I understand that it is everybody’s

for this particular university. They did not

individual choice to take on specific study,

offer some of the more attractive degrees such as medicine, law and economics that other universities offered.

So, for a communications graduate struggling to demonstrate value with his background in communications and education, the prospect of becoming a fully qualified teacher in the short space of 12 months was very attractive.

Fast forward 12 months. I barely managed to get my first job at a high school, but I was one of the lucky ones.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

59

I have also found that marketing by universities is

Internships need to be offered to build stronger,

unchecked and unfair, particularly for international

sustainable industry partnerships. The federal and

students who find it tougher to secure a job than do

state governments need to realise the severity of

citizen students.

the situation, step in and create traineeships for cybersecurity students that are accessible to school

Student visas guarantee you study in a certain

leavers, TAFE and registered training organisation

country, but they’ll never guarantee you a job. If

students and, of course, university students.

anything, it will be tougher for you to secure work, particularly in an industry where 10-30 percent of

There needs to be an overhaul of the ways in which

jobs are advertised as requiring a clearance. That’s

hiring managers and teams source candidates,

advertised, by the way. Many jobs at managed

advertise their jobs and build requirements. Managers

security service providers or consultancies will require

and teams should be open to on-the-job training for

candidates to be vetted during the interview process

entry-level graduates who don’t yet have industry

for positions that are not advertised as such. This

experience, without requiring a ‘hit the ground

means the real percentage is higher when you take

running’ approach.

into account both the public sector (where clearances are almost mandatory) and the private sector.

Finally, can we just agree to stop the whole ‘professionalisation’ debate that’s been going on

THE SOLUTIONS

for the past few years? Both sides’ arguments

There is no one solution to this problem. What

are wearing thin, and I’m surely not the only one

needs to happen first is for all universities to agree

who thinks the arguments for and against aren’t

on one thing: cut the international student intake

addressing the problems that currently exist.

and increase entrance requirements. What needs to happen next is a complete overhaul of current cybersecurity courses to bring the skills and

www.linkedin.com/in/simoncarabetta

knowledge taught into line with industry standards.

60

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

UNLEASHed

? us in jo to y ad re .

26 20 . ne ur bo Mel Step into the spotlight as a champion of Australia’s vibrant, diverse, and resilient security sector.

By joining the Australian Women in Security Awards as a sponsor, you’ll be recognised as a leader driving innovation and inclusion—while supporting the remarkable trailblazers shaping cyber, IT, and protective security.

Help foster a future where everyone can thrive.

Become a sponsor.

Register your interest today!

Contact Aby at aby@source2create.com.au womeninsecurityawards.com.au

DEARNE MCWHIRTER

ARCHITECTS FOR THE FUTURE: CONTINUOUS DESIGN FOR CYBER RESILIENCE

by Dearne McWhirter, Associate Director (KPMG) BUILDING RESILIENCE IN THE AGE OF AI AND CLOUD

organisations must adopt continuous design to withstand disruption and maintain trust.

Cyber resilience is no longer optional, it’s a strategic imperative. In an era defined by AI-driven innovation

Cyber threats are escalating in complexity and

and cloud modernisation, organisations face

velocity. Legacy resilience models often treat

unprecedented risks and regulatory scrutiny. This

risk as static, focusing on perimeter defence and

article explores how continuous design principles,

periodic audits. These approaches fail in dynamic

aligned with CPS 230, CPS 234, CPG 235, Privacy,

environments where cloud workloads scale instantly,

SOCI and global standards, can help organisations

where AI models introduce new attack surfaces and

achieve resilience at scale. We focus on why

where regulatory expectations tighten. The result is

resilience must be embedded into architecture, how

increased exposure to operational risk, reputational

technology trends reshape risk and what maturity

damage and compliance penalties.

looks like in practice.

REGULATORY AND STANDARDS LANDSCAPE

62

The convergence of AI, cloud computing and

Cyber resilience is shaped by a complex web of

regulatory evolution has transformed the

regulations and standards that define minimum

cybersecurity landscape. Recent mandates such as

expectations and best practices. For Australian

APRA’s CPS 230 and CPS 234, coupled with global

organisations, compliance is not just a legal

frameworks like NIST CSF v2.0 and ISO 27001,

obligation, it’s a foundation for trust and operational

demand a proactive approach to resilience. Traditional

continuity. Below is a deep dive into key frameworks

‘point-in-time’ compliance is no longer sufficient;

and their implications.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

I N D U S T R Y

REGULATION

P E R S P E C T I V E S

DESCRIPTION

Australian Regulations APRA CPS 230

Requires organisations to identify, assess and manage operational risks, including

– Operational

technology failures and cyber incidents. It emphasises scenario testing and tolerance

Risk

thresholds, pushing organisations toward higher maturity levels where resilience is

Management

embedded into business processes.

APRA CPS 234

Mandates robust information security controls and board-level accountability.

– Information

Organisations with low maturity often struggle with governance and visibility, while

Security

higher maturity demonstrates continuous monitoring and adaptive security measures.

APRA CPG 235

Focuses on data integrity, confidentiality and availability. Mature organisations

– Managing

implement advanced data governance and automated risk detection, reducing

Data Risk

exposure to regulatory penalties and reputational harm.

OAIC Privacy

Enforces privacy principles and breach notification requirements. Compliance maturity

Act

involves moving from reactive breach reporting to proactive privacy-by-design strategies integrated into architecture.

SOCI Act

Expands obligations for critical infrastructure sectors, including mandatory risk

– Security

management programs and incident reporting. Mature organisations adopt resilience

of Critical

engineering and supply chain risk assessments to meet these obligations.

Infrastructure CORIE (Cyber

CORIE introduces intelligence-led red-teaming exercises to test operational resilience

Operational

against sophisticated threat scenarios. This framework moves organisations beyond

Resilience

compliance into real-world resilience validation.

Intelligence-led Exercises) Global Standards NIST

Provides a flexible structure for identifying, protecting, detecting, responding and

Cybersecurity

recovering. Higher maturity organisations leverage NIST CSF v2.0 for continuous

Framework

improvement and alignment with global best practices.

(CSF) v2.0 ISO/IEC 27001

Establishes an information security management system (ISMS). Mature organisations integrate ISO controls into enterprise risk frameworks and automate compliance reporting.

CSA Cloud

Addresses cloud-specific risks and shared responsibility models. At advanced maturity,

Controls Matrix

organisations embed CCM principles into cloud-native architectures and DevSecOps

(CCM)

pipelines.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

63

Why this matters for maturity Regulatory compliance is often the starting point for cyber resilience, but true maturity goes beyond ticking boxes. Each framework introduces obligations that map to progressive maturity levels: Cyber maturity scale

LEVEL

DESCRIPTION

Initial (Level 1)

Ad hoc processes, reactive compliance, limited visibility.

Developing (Level 2)

Basic controls implemented, periodic reviews, siloed governance.

Defined (Level 3)

Formalised policies, integrated risk management, partial automation.

Managed (Level 4)

Continuous monitoring, resilience testing, advanced analytics.

Optimised (Level 5)

Adaptive architecture, predictive risk modelling, embedded resilience culture.

• Level 1–2. Limited or no adversarial testing; reliance on basic penetration tests.

• Level 3:. Structured resilience exercises with predefined scenarios.

• Level 4–5. Intelligence-led, threat-informed simulations integrated into continuous improvement cycles.

64

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

I N D U S T R Y

P E R S P E C T I V E S

CONTINUOUS DESIGN FOR CYBER RESILIENCE Continuous design embeds resilience into

• Resilience engineering: applying principles from

architecture, governance and operations. It shifts

safety-critical industries such as redundancy,

security from reactive compliance to proactive

failover and chaos testing, to ensure systems

engineering, anticipating failure modes, testing

remain operational during disruption.

tolerances and integrating security into every lifecycle stage. This approach aligns with zero trust principles

Why is continuous design critical?

and resilience engineering, ensuring systems adapt

• Regulatory alignment: frameworks like CPS

under stress without compromising critical services.

230 and CORIE demand scenario testing and operational resilience, which cannot be achieved

Cyber resilience is not a destination, it’s a dynamic

through static controls.

capability that must evolve alongside technology, threats and regulatory expectations. The traditional

• Dynamic threat landscape: AI-driven

approach of building security controls and revisiting

attacks, supply chain compromises and

them annually is no longer sufficient. Instead,

cloud misconfigurations require agility and

organisations need continuous design; a proactive

continuous improvement.

and adaptive methodology that embeds resilience into every layer of architecture, governance

• Business continuity: downtime and data breaches

and operations.

have direct financial and reputational impacts.

Continuous design ensures resilience is a

What is continuous design?

business enabler, not just a compliance checkbox.

Continuous design is the practice of integrating resilience principles into the entire lifecycle of

• Technology velocity: cloud-native deployments

systems and services; from initial architecture

and DevOps pipelines move too fast for periodic

through deployment and ongoing operations. It

reviews. Continuous design integrates security

moves beyond compliance-driven security to create

and resilience into agile workflows.

systems that anticipate failure, adapt under stress and recover quickly without compromising critical

How does it work in practice?

business outcomes.

1.

Design phase: embed zero trust principles, resilience patterns and compliance requirements

Key characteristics include:

into architecture blueprints.

• Adaptive architecture: designing systems that can flex and scale under changing conditions, including

2.

cloud migrations and AI-driven workloads.

• Embedded risk management: incorporating risk

Build phase: automate security controls and integrate resilience testing into CI/CD pipelines.

3.

Operate phase: continuously monitor, simulate

assessments and tolerance thresholds into

failure scenarios (eg, CORIE exercises) and

design decisions rather than treating them

adapt based on threat intelligence and regulatory

as afterthoughts.

updates.

• Automation and observability: leveraging

4.

Improve phase: feed lessons learnt back into

automation for threat detection, response and

design, creating a virtuous cycle of resilience

compliance reporting, supported by real-time

enhancement.

observability across hybrid environments.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

65

TECHNOLOGY TRENDS AND IMPACT TREND

IMPACT

ACTIONABLE NEXT STEPS

AI and Generative Models

Expands attack surface via

Implement AI governance frameworks,

model poisoning, data leakage

secure training pipelines and monitor

and adversarial inputs.

model integrity.

Rapid deployment increases

Adopt CSPM and CIEM tools, enforce

misconfiguration risk and

least privilege and validate provider

dependency on third-party

resilience.

Cloud Accelerators

providers.

DSPM & CNAPP

Data sprawl and fragmented

Deploy DSPM for data visibility and

controls heighten breach risk.

CNAPP for integrated cloud-native security.

Quantum Computing

Future cryptographic disruption

Begin quantum-safe cryptography

threatens confidentiality.

planning and monitor standards evolution.

RISKS AND PITFALLS • Treating resilience as a one-off compliance

• Failing to test operational tolerances under realistic scenarios

project

Policies and controls look strong on paper, but

Many organisations approach cyber resilience

their effectiveness is only proven under stress.

as a checklist exercise, meeting regulatory

Many organisations neglect rigorous scenario

requirements and then moving on. This mindset

testing, such as simulating ransomware attacks

creates a false sense of security. Resilience is

or cloud outages, because it’s resource intensive.

not static; threats evolve daily and technology

The result is unvalidated assumptions and

landscapes shift rapidly. Without continuous

unprepared teams. Testing tolerances under

improvement and adaptive strategies,

realistic conditions ensures recovery plans work

organisations risk being blindsided by emerging

when it matters most and aligns with regulatory

vulnerabilities, leaving critical services exposed

expectations like CPS 230 and CORIE exercises.

during disruption.

• Overlooking Insider threats and supply • Ignoring provider concentration risk in

66

chain vulnerabilities

cloud ecosystems

Cybersecurity strategies often focus on external

Cloud adoption accelerates innovation, but it also

attackers, but insiders, whether malicious or

introduces dependency risks. Relying heavily on

negligent, pose significant risk. Similarly, third-

a single cloud provider or a small set of vendors

party vendors and contractors can introduce

creates systemic vulnerabilities. If one provider

vulnerabilities through weak controls or

experiences an outage or security breach the

compromised systems. Ignoring these factors

ripple effect can cripple operations. Mature

undermines resilience. Mature organisations

organisations diversify providers, implement multi-

implement robust identity governance, continuous

cloud strategies and assess resilience across the

monitoring and contractual security obligations for

supply chain to mitigate concentration risk.

suppliers to close these gaps.

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

I N D U S T R Y

P E R S P E C T I V E S

SHAPING THE FUTURE OF CYBER RESILIENCE Cyber resilience in the AI and cloud era is not a static goal; it’s an ongoing journey that demands foresight, adaptability and innovation. Organisations can no longer rely on periodic compliance checks or siloed security measures. Instead, resilience must be designed into the fabric of architecture, governance and operations.

Looking forward, three imperatives stand out: • Embed continuous design Resilience must evolve alongside technology.

Continuous design ensures that security and risk management are integrated into every stage of the lifecycle, from architecture to deployment and operations. This approach transforms resilience from a reactive measure into a proactive capability that anticipates failure and adapts under stress.

• Align with regulatory and global standards Frameworks such as CPS 230, CPS 234, CPG 235, SOCI and CORIE, combined with global standards like NIST CSF v2.0 and ISO 27001, set the baseline for resilience. But compliance alone is not enough.

Organisations should leverage these frameworks as catalysts for maturity, moving from basic controls to intelligence-led resilience exercises and predictive analytics.

• Proactive risk management in a dynamic landscape Emerging technologies such as AI, cloud accelerators, DSPM, CNAPP and quantum computing introduce new risks and opportunities.

Organisations must continuously assess

expectations and adapt to emerging technologies

operational tolerances, diversify cloud providers

will position themselves for sustained success. This

and strengthen supply chain security. Resilience

is not about reacting to the latest threat; it’s about

is not just about surviving disruption; it’s about

building a foundation that supports innovation, trust

maintaining trust, protecting brand reputation and

and operational continuity in an increasingly complex

enabling business continuity.

digital landscape. The journey begins with thoughtful planning and incremental progress, ensuring

MOVING FORWARD WITH CONFIDENCE

resilience becomes part of the organisation’s DNA.

Cyber resilience is a long-term capability, not a shortterm fix. Organisations that take deliberate steps to embed resilience into design, align with regulatory

I S S U E 29

www.linkedin.com/in/dearne-m-91903817a

WOMEN IN SECURITY MAGAZINE

67

JAY HIRA

MOLTBOOK AND THE FUTURE WE CHOOSE TO DESIGN

by Jay Hira, Cyber Director – Financial Services, KPMG

My daughter once told me something that has

ideas. They were recycling what was already there.

stayed with me: “Dad, when the teacher leaves the

The activity was high, but the substance was thin.

classroom, everything changes.” She was right. In those few minutes, the whole room reinvents itself.

The part that concerned me most was not the

Children form clubs, choose leaders, make up rules

behaviour, it was the foundation beneath it. While

and trade stickers as if they are treasure. It is creative

everyone focused on the novelty of the agent

and chaotic, but not surprising. When there’s no

interactions, a simple operational oversight left private

structure, the loudest or most confident behaviour fills

keys and sensitive information exposed. The back

the space.

door had been left open. Safety was not part of the original design, and when it is missing at the start, its

We observe the same pattern in our work as

omission always becomes obvious later.

cybersecurity practitioners each day. When rules are not clear, patterns take over. That is exactly what

There are important reminders here. AI does not

happened with Moltbook, a social network for AI

form intentions, it copies what it can see. If conflict

agents. It started as an experiment to see how AI

or bias appear in the data, the system will echo these

agents behave when humans step back. Could they

at speed. Trust does not come from how polished

organise themselves? Could they create their own

something sounds; it comes from how we design

social world?

identities, manage access and apply safeguards.

Governance is not a restriction on creativity; it is an

Very quickly, they did what children do in a classroom

act of responsibility that protects people.

when no one is watching. They created a belief

68

system, wrote their own lessons and formed

This is why the idea of cybersecurity specialists as

hierarchies. At first, it looked like something new was

architects of the future matters. Our work is not

emerging. But when we looked closely, it was mostly

about supervising every action. It is about shaping

repetition. The agents were not discovering new

environments where safe behaviour is the natural

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

I N D U S T R Y

P E R S P E C T I V E S

outcome. Clarity creates fairness, just as it does in

All of us are shaping that future, whether we realise

a classroom full of children. When every student

it or not. The design choices we make today quietly

knows the rules, the room stays steady even when the

shape the systems we inherit tomorrow. Now feels

teacher steps out. In the same way, every AI system

like the right moment to pick up the chalk and write

should have clear boundaries and only the access it

the rules with intention, so the future we architect

needs to function, not the equivalent of a master key.

is one where everyone has a place, and the safety to thrive.

The lesson from Moltbook is simple: if the foundations are unclear, the behaviour that follows will be unpredictable. If the environment is designed

ABOUT THE AUTHOR

with care, the system behaves with care. The future

Jay Hira is a cyber security practitioner, lifelong

we get depends on the guardrails we choose to set.

learner, and advocate for inclusion. With nearly two decades of global experience, he has helped

This brings me back to that afternoon at my

more than 100 organisations transform cyber

daughter’s school when she pointed at the sports

risk into opportunity by making security simple,

noticeboard with a heavy heart. “Dad,” she said, “why

accessible, and a driver of growth. Known for his

are soccer and cricket only for the boys?” There it

pragmatic, people-first approach, Jay simplifies

was, written in black and white. A roster that quietly

complex challenges to deliver actionable

decided the future before the game had even begun.

advice that empowers teams and strengthens resilience. He values diverse perspectives

Design is never neutral. It is an act of inclusion or

and believes the best solutions arise from

exclusion. If the board lists only certain names or

collaboration and continuous learning. Jay’s

games, it does not matter how many talented people

experience spans across the spectrum of attack,

are waiting on the sidelines. They have already been

defence, architecture, governance, strategy, and

told they do not belong.

transformation, with a strong focus on building high-performing, inclusive teams. He simplifies

But, if we change the noticeboard, if we open the

security, inspires authentic leadership, and

roster and make the rules fair, we change who gets to

ensures security serves as a force for good in

participate. And, when we change who participates,

every organisation.

we bring in the diverse perspectives needed to build resilient systems. That is how we change what the future becomes.

I S S U E 29

www.linkedin.com/in/jayhira

WOMEN IN SECURITY MAGAZINE

69

ARCHITECTS IN UNIFORM: HOW MILITARY SKILLS POWER THE FUTURE OF SECURITY

by Abigail Swabey

Skills transferable from the military are reshaping the security landscape. Veterans and reservists are bringing mission focus, resilience and operational discipline into both cyber and physical security roles. Their experience in risk management, leadership, teamwork, threat assessment and adaptability translates directly into the technical and soft skills modern security teams urgently need.

M

ilitary training builds a structured

Leadership and teamwork are developed from day

approach to risk, identifying threats,

one in military service, often in high-stakes, resource-

assessing impact and prioritising

constrained environments. These abilities prime

mitigation under pressure; exactly

ex-military professionals to lead security projects,

the mindset required in cyber

coordinate cross-functional incident responses

defence, SOC operations, incident response and

and mentor junior staff. Adaptability, along with the

physical security management. Veterans are also

ability to quickly learn new tools, environments and

used to operating within clear frameworks and

missions, supports their smooth transition into rapidly

compliance regimes; experiences which align well

evolving security technologies, methodologies and

with standards, policies and governance demands in

threat landscapes.

security programs.

70

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

F E A T U R E

Risk management becomes threat modelling, vulnerability prioritisation and incident triage.

Veterans are adept at scanning for weak points, anticipating adversaries’ moves, and at making time-critical decisions with incomplete information.

Operational planning and logistics experience convert into structured security project management, efficient rollout of controls and coordinated response playbooks. Leadership and communication in the forces often includes briefing senior officers and coordinating diverse teams; activities which map well to stakeholder communication, security awareness advocacy and leadership of multidisciplinary security squads. Situational awareness, the ability to read an environment quickly, underpins strong monitoring, anomaly detection and physical-digital convergence thinking in roles like security analyst, CISO or physical security lead.

One veteran with a background in military logistics and medical support transitioned into a security analyst role after targeted training in foundational IT and gaining certifications. She used her experience managing critical supply chains to understand dependencies, risk and the importance of system resilience. Her ability to coordinate across units, prioritise under pressure and maintain discipline in procedural execution became strengths in incident response and vulnerability management.

Another veteran leveraged years of protecting communications and networks in the Air Force into a cybersecurity career. They augmented their hands-on experience in secure systems, with industry certifications. Their prior responsibility for safeguarding mission-critical infrastructure translated directly into defending corporate environments from advanced threats. These examples underscore how military pathways often require only a ‘translation layer’ and upskilling, not a complete reinvention.

Beyond technical capability, veterans bring a mission-first mindset: a strong sense of purpose and accountability that aligns with protecting

These examples underscore how military pathways often require only a ‘translation layer’ and upskilling, not a complete reinvention.

organisations, people and critical assets.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

71

They are accustomed to high pressure, ambiguous environments; experience which helps them steady teams during major incidents, breaches or crisis exercises. Their experience in diverse, multicultural units makes them strong collaborators who can bridge between the silos of IT, legal, HR, operations and executive leadership.

Many also bring mentoring habits, along with experience supporting junior staff and creating psychologically safe, performance-oriented team cultures rooted in trust and shared mission.

To attract ex-military talent, companies should write job descriptions that focus on competencies (risk assessment, leadership, decision-making, operations) and explicitly welcome veterans rather than over-emphasising narrow tool experience.

They should partner with veteran-focused organisations, transition programs and reservist networks, and show up at armed forces transition fairs and veteran hiring events. Onboarding best practice includes pairing new veteran hires with a mentor or ‘buddy’ (ideally another veteran), providing clear context on company mission and values, and offering explicit guidance on corporate norms that may differ from military culture. Veteran resource groups or internal communities can create belonging, reduce early-stage attrition and give leaders structured feedback on how to better support

With intentional recruitment, thoughtful onboarding and genuine inclusion, veterans and reservists can become some of the most influential architects of a safer, more resilient security future.

72

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

F E A T U R E

ex‑military professionals. Ongoing development

• Vets in Cyber (Australia): grassroots network

should combine technical upskilling (certifications,

for veterans in cybersecurity, hosting events and

on-the-job training) with leadership pathways to signal

offering networking.

that the organisation values both their experience and their future potential. With intentional recruitment,

Here are key global veteran-focused organisations,

thoughtful onboarding and genuine inclusion,

transition programs and networks with a

veterans and reservists can become some of the

cybersecurity/security focus.

most influential architects of a safer, more resilient security future.

GLOBAL/INTERNATIONAL • VetSec (US-based, global reach): non-profit

Here are some key Australian-focused veteran

community for veterans in cybersecurity; offers

organisations, transition programs and reservist

mentorship, resumé reviews, job boards, training

networks. I’ve prioritised those relevant to security/

discounts and events like VetSecCon. Mission: “No

cyber and employment support:

veteran pursuing cybersecurity goes unemployed.”

• RSL Veterans’ Employment Program: free career

• Fortinet Veterans Program (US, Canada, UK,

coaching, resume support, employer connections

Australia): free cybersecurity certifications

and skills translation (including cyber upskilling via

(NSE pathway), labs, exam vouchers for

their Veteran Cyber Academy partnership).

veterans/reservists/spouses; partners with local organisations for career services worldwide.

• WorkPath Australia (Vertical Scope): awardwinning ICT/cybersecurity training for transitioning

• Cybervets (US): peer-led cybersecurity training

veterans, offering free certifications and defence-

and job placement for transitioning military,

related civilian roles.

focusing on high-demand roles in defence and private sector.

• Veteran Employment Commitment (VEC): a network of employers (PMT Security, Wilson

• Hiring Our Heroes (US/global): connects

Security) committed to hiring veterans for

veterans/reservists to employers via fellowships,

security roles.

corporate partnerships and skills translation workshops (strong tech/security focus).

• Solve Transition: tailored cybersecurity retraining with Fortinet, ISC2 and Mosse Institute certifications.

• Military Cyber Professionals Association (MCPA) (US): develops military cyber talent through training, networking and STEM advocacy for

• WithYouWithMe: veteran tech employment

security careers.

program offering immersive training in cybersecurity, data and cloud skills, plus direct

OTHER REGIONS

employer pathways.

• TechVets (UK): transitions veterans into cyber/ tech roles with training, certifications and

• Bluerydge’s Veteran Pathways: defence-to-civilian

employer matching.

transition program focused on cybersecurity and security operations roles.

• Coding For Veterans (Canada): retrains veterans for software development and cybersecurity with

• Australian Veteran Cyber Academy: specialised

personalised coaching.

cyber training and certification programs for veterans, reservists and defence spouses.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

73

KAREN STEPHENS Karen Stephens is the co-founder and CEO of BCyber. After more than 25 years in financial services, Karen moved into SME cybersecurity risk management. She works with SMEs to protect and grow their businesses by demystifying the technical aspects of cybersecurity and helping them to identify and address cybersecurity and governance risk gaps. She was named inaugural Female Cyber Leader of the Year at the 2023 at the CyberSecurity Connect Awards in Canberra and has been a finalist in 2024 and 2025 in the Australian Cyber Awards for Cyber Security Professional of the Year - Professional and Financial Services.

C O L U M N

The power of the pivot: thriving through career reinvention in cybersecurity Cybersecurity is an industry often associated with

imperatives, because I have sat where our clients

deep rooted technical capabilities, but a new narrative

sit. So, I know when the ‘techie talk’ gets a bit

is emerging: the most resilient security posture is

much, but I can bring the conversation back into

built on a foundation of diverse experience. And this is

a language the client understands by explaining

where you, our ‘career pivoters’ come in.

practical business impacts and RoI. Sometimes this means asking non-technical questions that

For many of us, the journey into cybersecurity isn’t

a purely tech-focused person might overlook,

a straight line but a series of creative and strategic

which may lead to more innovative client

pivots that turn change into opportunity and our past

solutions and new business opportunities. Win-

careers into secret weapons.

Win! So, the question for you is: “what do you bring to the table?”

The only way to deal with a career pivot like this is

2.

Embrace a ‘learning to learn’ mindset.

to break it down into manageable steps (Well, will

Cybersecurity is a diverse and complex field

you look at all that! All that project management

where threats evolve at lightning speed and

experience is helping us out already). While time and

where static knowledge is a liability. A thriving

space limitations mean I cannot provide you with an

‘career pivoter’ does more than embrace change;

all-encompassing career pivot checklist, I can, based

they take practical steps to make that change

upon hard won personal experience, make three

easier on themselves and show their new

suggestions to get you started.

colleagues they are serious about the pivot.

For example:

1.

For my money, the best first step is to ‘just’ view your past career experience in a different light, which, believe me, is easier said than done.

the workforce to complete another undergrad

Oftentimes the ‘where do I start’ my career

degree, but you can do micro-courses. They

rethink is the hardest part.

are quick, affordable, (typically) practice-based

My external industry experience in financial

options that bypass the time and cost barriers

services governance, risk and compliance allows me to look at cyber ‘issues’ and ‘challenges’

74

– you may not be able to take three years out of

of traditional education.

– you can build your ‘troubleshooting muscles’

with a different, non-technical business focus

by partaking in ethical hacking labs, hands-on

mindset. This basically means I can translate

platforms and the like (I won’t mention any

technical cybersecurity risks into business

names because IYKYK, and if you don’t, and you

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

still want to get into this side of cybersecurity,

Reinventing your career in cybersecurity means

start investigating now!). So the question for

shifting your mindset from a simple win/lose

you is: “what are you going to do now to improve

definition of success to one that recognises

your cyber skills”?

continuous growth and possibility. It’s not a race with a fixed endpoint but an ongoing, dynamic journey. To

3.

Build on your professional networks. Actively

every woman questioning if this is the right place for

engage with the cybersecurity community by

you: the answer is yes. This industry thrives on your

joining industry associations and volunteering

unique perspective, your strength and your readiness

for their working groups. Find a mentor to help

to challenge the status quo. After all, technical skills

you navigate the learning path and allow them

can be learnt, but core traits like problem-solving,

to provide support when imposter syndrome

creativity and relationship-building are far harder

surfaces (I am sorry, but it will pop-up from

to develop.

time to time). Crucially, maintain involvement with your former industry’s associations and

www.linkedin.com/in/karen-stephens-bcyber

contacts—your deep-rooted knowledge of their industry will also make you a trusted insider

www.bcyber.com.au

x.com/bcyber2

karen@bcyber.com.au

youtube.bcyber.com.au/2mux

and subject matter expert in your new field of cybersecurity. So, what associations and working groups will you actively join (or rejoin) to strengthen your network?

I S S U E 29

WOMEN IN SECURITY MAGAZINE

75

CAREER PERSPECTIVES

MARINA AZAR TOAILOA

BETTING ON THE FUTURE: WHY I LEFT MY SECURE ROLE TO PROTECT THE NEXT GENERATION

by Marina Azar Toailoa, Founder of the Mummy Safety Security Project

“I am the master of my fate; I am the captain of my soul” — Invictus, William Ernest Henley.

After 12 years in the high stakes world of security and law enforcement I found myself at a crossroads, battling the demands of a full-time role in an intense industry and my desire to protect kids with knowledge I had gained on the job that I knew would help save lives.

My career had been defined by duty, discipline and the pursuit of justice. I had seen the complexities of the security landscape from the front lines while navigating the intricacies of risk management and public safety. Yet, as the world around us began a shift driven by the rapid evolution of digital threats and the increasing vulnerability of our most precious demographic, I felt a pull towards a different kind of service. I realised my professional expertise was needed in a space that was deeply personal to me: the protection of children.

78

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

C A R E E R

P E R S P E C T I V E S

Taking a bet on yourself is never easy. It involves

FINDING FREEDOM AND PURPOSE

stepping away from the security of a steady

One of my most profound realisations from this

career and a known path into the uncertainty of

journey has been the importance of alignment. For

entrepreneurship. However, for me, the decision

years I balanced the demands of a rigorous security

to go ‘all in’ on the Mummy Safety Security Project

career with the responsibilities of motherhood. While

was not just a business move; it was a commitment

I was proud of my work, I often felt a disconnect

to a greater purpose. It was a choice to align my

between the time I spent protecting the public and the

professional life with my core values: protecting the

time I spent with my own children.

most vulnerable and being a voice for the voiceless.

By betting on myself and building my own project

THE EVOLVING LANDSCAPE OF THREAT

I have found a new kind of freedom. This freedom

We live in an era where the threats facing our children

comes not only from having flexibility in my schedule;

are constantly evolving. They have always been there,

it comes from being free to pursue a mission that

but are now intensifying. The traditional physical

resonates with my soul. I am now able to be present

boundaries of safety have been penetrated by the

for my children while simultaneously working to make

digital world. In 2026 we will see an unprecedented

the world a safer place for all children. This alignment

rise in AI-driven risks; from sophisticated grooming

has brought a level of fulfillment and ‘success’ I never

techniques to the creation of harmful deepfakes.

thought possible in my professional life.

These are not just technical challenges; they are

A CALL TO ACTION FOR WOMEN IN SECURITY

fundamental threats to the wellbeing and innocence

To all women in the security sector: I know the weight

of children. There are also threats in the real, offline

of the responsibilities you carry. I know the dedication

world which need to be addressed urgently. Crimes

it takes to succeed in this field. But I also want to

against children keep happening, with only minor

encourage you to listen to that inner voice that calls

reactive changes in countermeasures. I needed to do

for something more.

something to prevent these harms from happening in the first place; through age-appropriate, evidence-

If you have a passion that is calling you, or a purpose

based education.

that feels unfulfilled, do not be afraid to take that risk. Betting on yourself is the ultimate act of

My experience in law enforcement taught me that

empowerment. When you align your work with who

being reactive is often insufficient. By the time a

you are you unlock a level of impact that transcends

threat is identified the damage is frequently already

the boundaries of a traditional job description.

done. Through the Mummy Safety Security Project I have shifted my focus to proactive education and

The world needs your expertise, your empathy and

empowerment. We provide families with the tools

your unique perspective. Whether in child protection,

they need to navigate this complex environment,

cybersecurity or crisis management, there is a space

covering everything from online safety and anti-

for you to lead with purpose. Take the bet. Chase

bullying strategies to emergency preparedness and

your purpose and passion. The most vulnerable in our

situational awareness. The goal is to build a culture

society are waiting for your voice, and your own future

of safety that starts at home, empowering parents,

self will thank you for the courage to start.

guardians and children to be their own first line of defence.

www.linkedin.com/in/marina-azar-toailoa-66259511a

www.instagram.com/mummysafetysecurityproject

I S S U E 29

WOMEN IN SECURITY MAGAZINE

79

MADHURI NANDI Madhuri is a cybersecurity leader with nearly two decades of experience across strategy, governance, risk, compliance, product and engineering. She was recognised with a Global Cyber Security Leader of the Year award. She holds a master’s degree in cybersecurity digital forensics and serves as head of security at Nuvei and as chair of the AWSN board. She is the author of the Cyber Smart book and creator of a cybersecurity awareness framework. She is known for her strong voice in inclusive leadership, mentorship and community building.

C O L U M N

Architecting what comes next For many women in cybersecurity, progress hasn’t

more consistent. Risk

been made through big moments or dramatic shifts;

is managed as part

it’s come through steady change; through noticing

of normal operations,

what doesn’t quite work; through refinements; through

not just audit cycles.

making things better, one decision at a time.

This is the kind of progress that often goes

That’s why the future of cybersecurity won’t be

unnoticed, yet is foundational.

shaped by grand gestures alone. It will be shaped by architecture and by the people trusted to design

As cybersecurity continues to evolve with more

it thoughtfully.

automation and increasingly complex ecosystems, this steady, people-aware approach to design

In cybersecurity, architecture influences how risk is

becomes even more valuable. Governance works best

carried across an organisation: who owns it, who

when it reflects how teams actually operate, not how

reviews it and how consistently it is maintained over

we wish they would.

time. These choices rarely feel urgent, but they matter.

Women in cyber have long contributed in this way, Women make up around a quarter of the global

improving clarity, refining processes and asking

cybersecurity workforce, and their representation at

practical questions that strengthen systems over

senior technical levels continues to grow. Meanwhile,

time: not because it’s expected of them, but because

many women are already influencing governance, risk

it leads to better outcomes.

and security decision-making across organisations.

Often, this work is done quietly, embedded into

This is what it means to be architects of the

how functions operate day-to-day. And that’s where

future; not rewriting everything at once, but

meaningful change tends to start.

shaping functions that can adapt and designing governance that holds as organisations grow. The

Take third-party risk governance as an example. A

future of cybersecurity doesn’t arrive all at once, it’s

compliance control might require vendors to sign

built through choices that compound. And when

off on security policies. That’s a reasonable starting

architecture is designed with people in mind, change

point. But architecture improves when we go a step

doesn’t feel disruptive, it feels natural.

further, defining who actively monitors controls, establishing shared dashboards and clarifying which

Things work. Teams last. Progress continues. Let’s

teams are responsible for ongoing assurance.

keep the power in our thinking, and quietly shape the future we want to see.

Nothing dramatic happens when such changes are made. Things simply start working better.

Responsibilities become clearer. Reviews become

I S S U E 29

www.linkedin.com/in/madhurinandi

WOMEN IN SECURITY MAGAZINE

81

STUDENT IN SECURITY SPOTLIGHT

diversity of roles within the field. It felt like a space where I could grow in many different directions rather SIENNA SMITH

than feeling boxed into one path.

What really sealed it for me was knowing that cybersecurity is a field where you never stop

Sienna Smith, a driven student currently undertaking a Bachelor of Information Technology with a major in Cybersecurity at

learning. That continuous growth perfectly matches

Charles Sturt University.

beginning is still there, if anything, it’s stronger. The

Bachelor of Information Technology with a major in Cybersecurity student at Charles Sturt University.

my personality. Looking back now, as I’m close to graduating, I can honestly say that spark I felt at the closer I get to finishing my degree, the more excited I become about finally stepping into the industry and building the career I once only imagined.

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

As I get closer to graduating, I’m increasingly

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

interested in exploring Governance, Risk and

Personally, my path into cybersecurity wasn’t exactly

picture rather than just focusing on one technical

planned. After high school, I enrolled in a Bachelor

element at a time. GRC appeals to me because

of Medical Radiography. At the time, I wasn’t

it connects technical knowledge with business

completely sure what I wanted to do, and it felt like a

objectives, and that balance really resonates with me.

Compliance (GRC). It feels like a natural fit for me.

I’ve always been organised and comfortable working with structure, and I enjoy looking at the bigger

safe, sensible choice. I’ve always loved learning, so I threw myself into it and the first year flew by.But as

During my studies, I found myself drawn not only to

time went on, I started to feel that something wasn’t

how systems are secured, but to why certain controls

quite right.

are in place and how they support an organisation’s overall risk posture. I enjoy understanding the

While I respected the field, I didn’t feel genuinely

reasoning behind decisions and how security

excited by it, and I couldn’t picture the kind of

frameworks translate into real-world practice.

future I wanted for myself. I began to realise I was craving something more dynamic, something

That said, I’m also very open to roles such as Security

that would challenge me in new ways and offer

Analyst or SOC Analyst positions. I recognise the

broader possibilities.

value of developing a strong technical foundation early in my career, and I would welcome the

That’s when I started looking into cybersecurity. The

opportunity to build that hands-on experience.

more I learned, the more it clicked. It felt fast-moving,

84

constantly evolving, and full of opportunity. The

One of the reasons I chose cybersecurity is because

idea of protecting systems and defending networks

of its diversity. I don’t feel pressured to map out

genuinely excited me, and I was drawn to the

my entire career from day one. Instead, I’m looking

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

S T U D E N T

I N

S E C U R I T Y

forward to gaining experience, continuing to learn, and gradually shaping my path based on where I can contribute most effectively.

When you decided to pursue a career in cybersecurity, how did your parents, peers, or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

S P O T L I G H T

The cybersecurity industry offers various certifications from different organisations.

Have you pursued, or do you plan to pursue any of these certifications? If so, which ones, and what factors influenced your choice?

I plan to pursue the CompTIA Security+ certification this year. I have met with a few people within the cybersecurity industry who have said that this is the certification to get. Aside from this, I am currently

Changing courses halfway through my 4 year

pursuing ISC2 Certified in Cybersecurity Certification

radiography degree was understandably a big

and have achieved the Cisco Introduction to

decision. It wasn’t just scary for me, but my parents

Networks Certification.

and peers were very apprehensive. I wouldn’t go as far as saying they opposed my decision, but it was something I spoke about constantly throughout my second year of university.

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape?

I knew I wasn’t doing something I felt passionate

I think my program at CSU does a reasonable job

about but they had the sort of “old school” mentality

at balancing foundational knowledge with current

that when you start something you have to finish

industry practices, although there is an inherent

it. I think that is why I stayed as long as I did but

challenge in any institution maintaining perfect

after many discussions, my parents ultimately fully

synchrony with any industry, especially one as rapidly

supported my decision to pursue this as a career.

evolving as cybersecurity. I do feel however, with AI

I S S U E 29

WOMEN IN SECURITY MAGAZINE

85

SIENNA SMITH

and the emerging threats stemming from its more widespread use, the curriculum hasn’t yet explored that area too much so it’s perhaps something it can branch into over the coming years.

Do you believe there are areas in cybersecurity that deserve more emphasis in your coursework or areas that could receive less focus?

I would love to see more emphasis on practical,

What aspect of your cybersecurity studies excites you the most, and why?

scenario-based learning. In my studies, every

What excites me most about my cyber security

and real-world case scenarios has been an amazing

studies is the problem-solving nature of the degree.

experience but it feels few and far between. While

Every challenge that presents themselves forces

labs are helpful, an emphasis on simulating the

you to think strategically, psychologically and

pressure and quick decision-making of an actual

technically. I like how cybersecurity isn’t just about

security incident would be invaluable, as practice

memorisation, it is about applying learnt concepts

makes for progress!

opportunity I get to engage in incident response

to realworld scenarios and that sort of connection keeps me engaged. I am constantly learning, and that sort of continuous growth and evolution is why I started my career in the first place.

Reflecting on your journey thus far, would you, with the benefit of hindsight, make any changes to your career trajectory? If yes, what adjustments would you consider?

Are there specific aspects of your cybersecurity studies that you find particularly challenging? If so, what are they, and how do you approach overcoming these challenges?

If I could go back and reassess my career trajectory,

I feel being an online student, my biggest challenges

degree. Coming out of high school, most of my

are connection and collaboration. It can be isolating

identity revolved around achievement and being

studying remotely, most students keep their cameras

successful in recognisable areas; like Maths, Science

turned off, and not many people actively engage

and English.

I probably would have encouraged a younger version of Sienna to take more time considering what area I want to pursue before jumping into a university

during class. On top of this, most people study online due to its flexibility so students may not show

I didn’t know what to do so I chose a career in

up over Zoom but will watch the recording at a

healthcare at random because it was an industry

later time.

familiar to me and the people around me. It felt like my entire education had been building to this one

Compared to studying in person when I was doing

pivotal moment and I had to make a decision that felt

radiography, you miss out on those spontaneous

safe and like a natural progression from my Science

conversations with classmates, and the sense

and Math studies in high school. If I had taken the

of community that comes with being physically

time to expand my way of thinking, I could have

together. It also means that you need to put more

possibly been studying cybersecurity a lot earlier

effort into staying up-to-date with the latest news

than I did. In saying that, giving up a degree I didn’t

and more proactive in seeking opportunities available

love was a big, scary decision, and without having

to cybersecurity students. However, ultimately, these

experienced that I don’t believe I would be the person

challenges have taught me resilience and self-

I am today.

motivation which will be valuable skills in a future career whether I am working remotely or in a hybrid cybersecurity role.

86

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/siennas-cybersecurity

M A R C H • A P R I L 2026

Join Us in Empowering

Future Leaders

! d e t n a W y it r u c e S in Students Are you a student passionate about shaping the future of security?

Do you have innovative ideas and insights to share with a global audience? Join us in contributing to the Women in Security Magazine and become a voice for the next generation of security leaders!

Why contribute?

Gain valuable exposure: Reach over 11000 subscribers globally and showcase your expertise to industry professionals.

How to get involved

Make an impact: Share your experiences, challenges, and aspirations to inspire others and shape the future of security.

Let us know you are interested.

We will send you a series of questions of which you can choose which ones you would like to answer.

Submit those back to us in an email.

We will then edit to be a concise and flowing edited Q&A.

Don't miss this opportunity to be part of a vibrant community of students driving change in the security industry.

Contact us today to learn more about how you can contribute to the Women in Security Magazine!

Contact: jane@source2create.com.au

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

USWAH RAHMAN

Upon graduation, I aim to begin my career in a graduate or internship role to strengthen my foundational skills and gain industry exposure.

In the longer term, I am particularly interested in

Uswah Rahman is currently pursuing a Bachelor’s degree in Cybersecurity and Behaviour at Western Sydney University Cybersecurity and Behaviour student at Western Sydney University

Research and Development (R&D) or Governance, Risk, and Compliance (GRC). These areas align with my interest in problem-solving, strategic thinking, and improving security frameworks that protect organisations and individuals at a broader level.

When you decided to pursue a career in cybersecurity, how did your parents, peers, or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

When I shared my decision with my parents, they

When I first thought about cybersecurity, like many

to pursue my interests. My peers and friends were

people, my view was shaped by movies, TV shows,

equally supportive, and having those conversations

and news headlines. I was intrigued by the idea of

helped me gain clarity and confidence in my

hacking, but also a little anxious about how often

choice. Their ongoing encouragement has played a

cybercrime seemed to be happening in Australia.

significant role in my journey.

approached it thoughtfully and supportively. They took the time to understand the field, discussed longterm career pathways with me, and encouraged me

That mix of curiosity and concern made me start

Once I began formal study, I quickly realised that

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

cybersecurity is far more than what the media

My professors, Especially Dr Alana

portrays. It’s not just about coding or defending

Maurushat, Dr Farnaz

systems, it’s about understanding people, assessing

Fariz, and Dr Ala Al-Areqi,

risks, researching emerging threats, and designing

have been the most

secure technologies that are actually usable for

influential figures in my

everyone. To me, cybersecurity feels like a tree

cybersecurity journey. Their

with deep roots and many branches: you need to

teaching, guidance, and

understand the causes of threats, human behaviour,

mentorship have helped me

and system design, while also navigating technical,

develop a deeper and more

legal, and societal challenges. That depth, and the

practical understanding of the

opportunity to make a real difference, is what keeps

field. Through their support,

me motivated every day.

I have gained clarity on both

asking questions: How secure are the systems we rely on every day? How exposed are regular users?

88

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

S T U D E N T

I N

S E C U R I T Y

technical concepts and the broader implications of cybersecurity, making the learning process more structured and meaningful.

S P O T L I G H T

What measures do you have in place to enhance your personal cybersecurity in today’s digital landscape?

My studies have significantly improved my personal

The cybersecurity industry offers various certifications from different organisations.

Have you pursued, or do you plan to pursue any of these certifications? If so, which ones, and what factors influenced your choice?

cybersecurity practices and my ability to guide

Cybersecurity is a rapidly evolving industry, and

spreading awareness, particularly among those with

I believe a university degree alone cannot cover

limited technical knowledge, by promoting simple

all aspects of the field. I plan to pursue relevant

and practical security habits.

others. I prioritise strong password management, remain vigilant against phishing attempts, and understand how easily individuals can become victims of cyber threats. Importantly, I also focus on

industry certifications over time, selecting those that

current and expand practical knowledge beyond

Reflecting on your journey thus far, would you, with the benefit of hindsight, make any changes to your career trajectory? If yes, what adjustments would you consider?

formal education.

With hindsight, I would place greater emphasis on

align with my career goals and areas of interest.

Continuous learning is essential in cybersecurity, and certifications provide an opportunity to stay

self-directed learning alongside my degree from an

What aspect of your cybersecurity studies excites you the most, and why?

earlier stage. I initially assumed that academic study

One of the most exciting aspects of my studies is

the importance of attending industry events,

engaging with the wider cybersecurity community

participating in hackathons, completing practical

through events, workshops, and networking

challenges, and using freely available resources

opportunities. Connecting with professionals and

to build hands-on experience. These activities are

students from diverse backgrounds allows me to

essential for developing a strong portfolio and

learn from real-world experiences and different

industry readiness.

alone would be sufficient, but I now understand

career paths. These interactions reinforce the importance of persistence, adaptability, and continuous growth in this field.

Have you ever encountered situations where being a woman in cybersecurity made you feel disadvantaged or discriminated against? If so, please share your experiences.

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry current landscape?

My academic program provides strong practical foundations and exposure to essential tools. However, the industry evolves rapidly, and there is always

While I have not experienced direct discrimination,

more to learn. Through my placement experience, I

there have been instances where I was one of very

recognised the importance of continuously updating

few women in a classroom or technical setting.

skills and familiarising myself with emerging tools

Although this can sometimes feel isolating, it has

and technologies. This has reinforced the need for

also strengthened my determination to continue

ongoing self-study and extracurricular engagement

in the field. I hope that by remaining visible

to remain competitive and industry ready.

and persistent, I can contribute to encouraging more women to consider and pursue careers in cybersecurity.

I S S U E 29

www.linkedin.com/in/uswah-rahman

WOMEN IN SECURITY MAGAZINE

89

cloud security to incident response, and the impact UGWOKE JENNIFER SOCHIMA

is meaningful. You are literally defending the digital infrastructure that powers economies and sustains lives both offline and online.

Ugwoke Jennifer Sochima is a passionate cybersecurity professional who has since transitioned into an educational role as a Cyber Security Instructor.

Cyber Security Instructor

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

When I first thought about cybersecurity, I pictured it as mostly ethical hacking and working endlessly in the command line. While those technical skills are certainly part of it, my journey has shown me that the

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

field is so much more than that. Through experiences

When I speak to someone unfamiliar with

designing secure architectures, managing risk,

cybersecurity, I explain it as a digital protector in

and constantly monitoring systems. It challenges

my own words. Every organisation today relies on

you to think analytically, work collaboratively, and

technology, and cybersecurity is what keeps its

understand how complex systems interact at scale.

systems, data, and people safe. What excites me

What I once saw as a technical playground revealed

most is that it’s a constantly evolving field where

itself as a structured, layered world, and it’s this

new kinds of threats and solutions emerge daily, and

reveal that truly captivates me about cybersecurity

like the Cybergirls Fellowship and my role at Cloud Sec Network, I discovered that cybersecurity is deeply strategic; it’s about governance, compliance,

you’re always learning, adapting, and solving real-

it’s about strategy, critical

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

thinking, and innovation.

After graduating, I set my sights on becoming a

The demand is global;

Cloud Security Engineer. My passion for cloud

world problems. Cybersecurity isn’t just about identifying threats;

the opportunities are diverse, from

security grew as I got hands-on experience working with AWS and Azure, setting up IAM policies, applying the principle of least privilege, configuring GuardDuty and Security Hub, and enhancing monitoring through CloudWatch and Azure Security Centre. As more organizations move critical workloads to the cloud, securing these environments has become essential. What really drives me is the responsibility of protecting infrastructure at scale and making sure security is built into the architecture from the ground up, rather than tacked on as an afterthought.

90

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

S T U D E N T

I N

S E C U R I T Y

When you decided to pursue a career in cybersecurity, how did your parents, peers, or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

S P O T L I G H T

my mindset from simply acquiring knowledge to delivering real security outcomes.

the decision to transition into cybersecurity sparked

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

curiosity and, at times, uncertainty. However, I was

Beyond my training at Cybersafe Foundation, I have

clear about my vision. I explained the opportunities

gained hands-on experience as a Cloud Security

in technology and the growing importance of

Analyst at Cloud Sec Network, where I secured

digital security. Over time, as I earned certifications

AWS environments through IAM and Identity Center

like AZ-500, ISC2 CC, CompTIA Cloud+, and AWS

configurations, designed secure VPC architectures,

Security certifications, and completed the Cybergirls

deployed applications with RDS, implemented

Fellowship, the support became stronger. I navigated

event-driven workflows with Lambda, and monitored

skepticism by staying consistent, showing results,

environments using CloudWatch. Through the

and letting my dedication speak for itself.

Cybergirls Fellowship, I further developed expertise

Coming from a background in Nutrition and Dietetics,

in identity and access management, threat detection,

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

compliance automation, and cloud resource

The Cybersafe Foundation’s Cybergirls Fellowship

and strategic understanding of cloud security.

protection across AWS and Azure platforms. These experiences allowed me to bridge theory and practice, strengthening both my technical execution

has been the most transformative influence in my

That experience sharpened my technical capabilities

The cybersecurity industry offers various certifications from different organisations.

Have you pursued, or do you plan to pursue, any of these certifications? If so, which ones, and what factors influenced your choice?

and strengthened my confidence. It helped me move

Yes, I’ve actively pursued several certifications to

from learning about security concepts to actively

strengthen both my technical skills and strategic

applying them in practical environments.

understanding of cybersecurity, with a particular

journey. It provided structured mentorship, hands-on labs, and exposure to real cloud environments. More importantly, it surrounded me with a community of women committed to excellence in cybersecurity.

focus on cloud security. I’ve earned: ISO/IEC

Recount the most memorable or significant event in your cybersecurity journey to date, highlighting why it left a lasting impression.

27001:2022 Lead Auditor, Microsoft Azure Security

One of the most defining moments in my journey

Management certifications, AWS Skill Builder training.

Engineer (AZ-500), Azure Fundamentals, Certified in Cybersecurity (CC) – ISC2, Identity and Access

was leading an AWS Security Hub integration project where I successfully remediated 67% of identified

Each certification was intentional. For instance,

vulnerabilities. Seeing measurable improvement in a

AZ-500 and AWS Security certifications align

cloud environment’s security posture was incredibly

with my specialisation in cloud security. As more

rewarding. It was the moment I truly felt the weight

organisations move to Azure and AWS, I recognized

and impact of my work. That experience shifted

the importance of mastering cloud-native controls,

I S S U E 29

WOMEN IN SECURITY MAGAZINE

91

UGWOKE JENNIFER SOCHIMA

identity management, encryption, monitoring, and

automated compliance monitoring through tools like

compliance. ISO 27001 Lead Auditor strengthened

AWS Security Hub and Azure Security Centre.

my understanding of governance, risk, and compliance, helping me connect technical security

For example, during an AWS Security Hub project,

with organisational policies. Looking ahead, I plan to

I remediated 67% of detected vulnerabilities.

pursue additional industry certifications to help me

Seeing a tangible improvement in security posture

solidify my experience.

was exhilarating. It reinforced my passion for cloud security.

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape?

What excites me isn’t just spotting threats, it’s designing systems that reduce risk before problems even arise. Cloud security blends governance,

My formal degree is actually in Nutrition and

architecture, automation, and analytics, which keeps

Dietetics, so most of my cybersecurity knowledge

me engaged and makes the work meaningful.

has come from certifications, fellowships, and hands-

that’s closely tied to real-world environments.

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management?

If yes, why?

Programs like the Cybergirls Fellowship and vendor-

Absolutely. Technical expertise alone isn’t enough.

specific training from AWS and Microsoft have been

Skills like communication, leadership, risk reporting,

invaluable in helping me stay ahead.

project management, and cross-team collaboration

on projects rather than a traditional degree program.

The field moves so fast that identity attacks, AIdriven risks, and supply chain vulnerabilities are constantly evolving that keeping up requires learning

are essential. Security professionals need to To stay current, I focus on hands-on labs and

explain risks to non-technical stakeholders, work

projects, tracking updates on cloud platforms,

with developers, collaborate with control systems

studying the MITRE ATT&CK framework, and

engineers, and influence executive decisions. My

connecting with the wider security community. For

volunteer advocacy and community engagement

me, learning in cybersecurity never really stops;

have strengthened my communication and

it’s a mix of curiosity, practical experience, and a

presentation skills, which are just as critical as

commitment to growing every day.

technical ones.

What aspect of your cybersecurity studies excites you the most, and why?

Are you actively engaged in the broader cybersecurity community? If so, what has been your involvement, and how has it enriched your experience?

Cloud security architecture and threat detection are what excite me most.

Yes, I actively engage in the cybersecurity community

92

Cloud environments are dynamic and complex,

through: The CyberGirls Fellowship, speaking to

requiring both strategic thinking and technical

over 100 young girls about tech and cybersecurity

precision. I’m particularly fascinated by identity and

via Tech Girls Drive, sharing security projects

access management, the principle of least privilege,

and insights on LinkedIn, Continuous learning

encryption with AWS KMS and Azure Key Vault, and

and research in cloud security. Engaging with the

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

community provides mentorship, peer learning, and

One challenge I’ve faced is the entry-level but

diverse perspectives. It also drives my commitment

requires experience paradox. To address this, I’ve

to improving accessibility and representation in tech.

built hands-on projects, including cloud vulnerability remediation work where I improved security posture.

Have you actively sought employment opportunities in the cybersecurity field, and if so, what has been your experience with the application and interview process?

This allows me to demonstrate measurable impact

Yes, I have actively pursued opportunities in

preparation, strengthened my communication skills,

cybersecurity, with a particular focus on cloud

and clarified my focus on cloud security and GRC-

security and security operations. The process has

aligned roles.

rather than theoretical knowledge.

Overall, the experience has sharpened my technical

been both eye-opening and growth-driven. While my certifications often help me get past initial screenings, interviews focus heavily on practical skills. Employers want to see how I would secure misconfigurations, respond to alerts, implement

www.linkedin.com/in/jennifer-ugwoke-30b9082aa www.instagram.com/cybernifer_

least privilege, or investigate incidents, not just list credentials.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

93

Aspirations: The Pentester Journey My goal is to become a Penetration Tester. I want to honor that little girl who chose a Computer LETHABO SANGWENI

Science degree because she thought it would help her ‘borrow’ the neighbor’s Wi-Fi. That early curiosity evolved into a professional passion for ethical

Lethabo Sangweni is currently pursuing a degree in Computer Science at the University of Western Cape.

Computer Science Student at the University of Western Cape.

hacking. I want to be the one who finds the cracks in the armor before the bad guys do, combining my love for technical puzzles with a mission to make systems unshakeable.

Navigating Support and Skepticism My path wasn’t exactly met with a standing ovation at home. When I joined Mido Academy, my family feared I was looking for a ‘shortcut’ , an easy escape

Articulating the Excitement of Cybersecurity

from the traditional university grind. To be fair, I’ve

I like to describe cybersecurity analysts as the

always had a natural instinct to ‘bypass the system’

digital world’s first responders and elite police

like a true hacker, looking for the most efficient route

force. We live in a time where our entire lives, our

through any challenge. To navigate their skepticism,

finances, our privacy, and our infrastructure exists

I had to make a firm commitment to both worlds.

in a digital space that never sleeps. The excitement

I promised them I wouldn’t drop my degree for a

lies in the constant evolution of the digital space;

certificate they didn’t yet understand. I’ve always

there is always a new puzzle to solve and a new

marched to my own beat, but I knew that to make

threat to outsmart. It’s a career of problem solving

this journey worth the risk, I had to prove that my

and learning. You cannot protect what you do not

‘shortcut’ was actually a strategic advantage.

understand. For someone who loves to learn and wants a job that actually matters, the potential here

The Power of Mentorship

is limitless.

The most influential factor in my journey has been having a mentor. In a field as vast as cyber, it’s easy

Initial Perceptions vs. Reality

to feel overwhelmed. My mentor has been the bridge

When I first started, I fell for the classic ‘hacker in

between a distant dream and an attainable reality,

a hoodie’ stereotype, the idea that it was

helping me see the bigger picture and keeping my

purely about breaking things. The

aspirations of becoming a pentester grounded in a

reality I’ve discovered is

clear roadmap. His support is the fuel that pushes

much more profound.

me through the most challenging technical hurdles.

It’s a multi-dimensional field that isn’t just about

The Certification Roadmap

hacking. It’s the art of

I believe in building a solid foundation, which is

building resilient systems

why I’ve pursued CompTIA A+, Security+, and ISC2

and ensuring that the

Certified in Cybersecurity (CC). Currently, I am

innocent are shielded from

focused on the TryHackMe Pentest+ (PT1). Looking

malicious actors. It’s as much

ahead, my target is the ‘gold standard’ for my niche:

about people and protection as

the OSCP (Offensive Security Certified Professional)

it is about code.

94

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

and AWS Security certifications. These aren’t just

Current Experience and Career Strategy

badges to me; they are the specialized tools I need to

I am currently six months into a year-long internship,

be an effective pentester.

which has been invaluable for seeing how theory meets practice. My strategy is deliberate: I want to

Community Engagement

secure my PT1 certificate and sharpen my technical

“I am an active citizen of the cyber community, a

edge before applying for full-time penetration

member of the ISC2E Cape Town Chapter, BSides,

testing roles. I respect the craft enough to know that

ShiftSecurely, DevSecCon, and WICS (Women in

pentesting requires elite skill, and I am dedicated to

Computer Science). Being part of these groups has

being fully equipped before I step into that arena.

transformed my experience,it’s where I keep my finger on the pulse of the industry. Networking with

Navigating the ‘Necessary Evil’ of Networking

like-minded professionals has shown me that while

Ironically, the aspect I find most challenging

the technology is great, the community is what keeps

is Networking. It is the absolute foundation of

you growing.

everything we do in cyber, yet it can be incredibly dense and dry to study. However, I’ve learned to

Hindsight and Reflections

embrace it because it is the ‘Skeleton Key.’ Once

If I could change one thing, I would have started

you truly master how data moves through a

sooner. I would have immersed myself in these

network, every other topic from exploits to defense

communities and started learning the ‘Cyber’ mindset

becomes a breeze. I work through the complexity

the moment I touched a keyboard. Knowing now how

because I know it’s the price of entry for high-level

much faster you grow when you’re surrounded by

security work.

a community of experts, I realise that the technical skills are only half the battle, the environment you put yourself in is the other half.

I S S U E 29

www.linkedin.com/in/lethabo-sangweni

WOMEN IN SECURITY MAGAZINE

95

to no awareness of risk, vulnerability management, or incident response. However, my internship with the New York Public Library (NYPL) was a turning OM VENUGOPAL

point. Working across various domains rather than strictly penetration testing shifted my perspective. I discovered that investigating threats and governing

Om Venugopal is currently working with IBM as a Security Engineer. She graduated with a Master of Engineering in Cybersecurity from the University of Maryland, USA. Master of Engineering in Cybersecurity graduate at the University of Maryland, USA.

an institution’s security posture is far more fulfilling than just “breaking things.” It fundamentally changed my career trajectory toward defense and governance.

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

My journey has been shaped by a diverse network, particularly the mentors I found at IBM. Engaging

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

with everyone from interns to managing partners

The coolest thing about my job is that I’m essentially

constant evolution of aspirations.

taught me how much there is to learn and how a career can evolve. These interactions helped me realize that a career in cyber isn’t static; it’s a

living in a Star Wars movie every single day. You’re

‘Good Lone Warrior’ who protects the world from

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

the shadows.What makes it addictive is that no two

Through my time at the NYPL, I gained hands-on

weeks are ever the same. The ‘villains’ are always

exposure to Risk Management and SOC operations,

evolving, coming up with new ways to break things

but discovering OT (Operational Technology) in

using AI or new exploits, so you’re constantly forced

my current role has been a revelation. I’ve found a

to learn and level up.It’s a career where you aren’t

fascination for the product lifecycle that goes far

just sitting behind a desk; you’re an investigator, a

beyond “breaking things.” Working within an IT/OT

protector, and a strategist all at once. If you love the

scope means my work isn’t confined to a box, it’s

idea of a job where something new is happening

incredibly diverse. Securing everything from a CCTV

every 24 hours and you get to be the person

network to, literally, a smart vape, has shown me just

standing between a major institution and total chaos,

how expansive and tangible modern security really is.

standing right at the edge of the ‘Force.’ You have the skills and the power to be on the Dark Side like a digital Trojan or you can choose to be the Jedi, the

that’s cybersecurity.

96

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

The cybersecurity industry offers various certifications from different organisations.

Have you pursued, or do you plan to pursue any of these certifications? If so, which ones, and what factors influenced your choice?

Initially, my perception of cybersecurity was narrow:

My current roadmap is heavily focused on the

I was “all in” on the idea of being a hacker. I had little

intersection of Cloud and OT. I am currently deep-

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

diving into Generative AI applications and the ISA/IEC

leverage AI for defense while mitigating its use as

62443 standards. These frameworks are essential

a weapon is now a prerequisite for job security.

for anyone serious about securing industrial

Similarly, the transition from traditional IT to OT

automation and control systems in an increasingly

(Operational Technology) is where the real-world

connected world.

stakes are highest. We need more hands-on training on how to secure the physical infrastructure that

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape?

keeps society running.

security i would have loved to get a hands on

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management?

If yes, why?

during university on how that is a field that is more

Technical skills are vital, but communication is the

interesting than applications.

“secret sauce.” Many engineers struggle to explain

OT cybersecurity. I never was exposed to OT , currently as someone who is specialising in OT

technical risks to non tech people. Thanks to my

Do you believe there are areas in cybersecurity that deserve more emphasis in your coursework or areas that could receive less focus?

time in an English boarding school, I developed

I believe academic coursework needs an urgent

no business” being in so early in my career.

interpersonal skills that have been a total game changer. It’s what has allowed me to secure a seat at the leadership table and open doors to rooms I “had

shift in focus toward Generative AI (GenAI) and OT

hacking. Every “script kiddie” now has access to tools

Are you actively engaged in the broader cybersecurity community? If so, what has been your involvement, and how has it enriched your experience?

that can generate exploits or craft perfect phishing

Yes I am.I am an active member of WiCyS (Women

emails at scale.

in Cybersecurity) and WISE. These communities

Security. These aren’t just buzzwords; they represent the current frontiers of the threat landscape. With GenAI, we are seeing the “democratisation” of

have been instrumental in broadening my thinking, If our education doesn’t include

connecting with greater minds in the industry

how to protect systems against

who have done some ground breaking work. The

AI-driven attacks, we are

mentorship and connections help me stay sharp on

leaving the next generation

current skills and emerging threats, while connecting

of professionals vulnerable.

me with individuals who challenge and refine my

Understanding

perception of global security.

how to

What is your preferred source for staying informed about cybersecurity trends and general information?

To keep pace with threats, I rely on a mix of podcasts, industry newsletters, blogs, and surprisingly specific Reddit subreddits, which often provide the first whispers of emerging vulnerabilities.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

97

OM VENUGOPAL

Have you ever encountered situations where being a woman in cybersecurity made you feel disadvantaged or discriminated against? If so, please share your experiences.

As an introvert, I stayed in my shell too long. I would

It’s a reality that, in certain spaces, I’ve noticed

are the “need of the hour,” and the demand for these

my opinions being passed over or my ideas being

skills is exploding.

have leaned into networking much earlier; it’s the best way to grow. Also, I would have started my deep dive into GenAI and OT (ISA 62443) sooner. These

“borrowed” and presented by others. While these

unapologetic confidence. I make sure my voice is

Have you actively sought employment opportunities in the cybersecurity field, and if so, what has been your experience with the application and interview process?

heard and that my contributions are clearly attributed

My experience with the application process has been

to me. I’ve also found that having an ally in the

a rigorous mix of in-person interviews, live coding

room, someone in your corner who can amplify your

sessions, HackerRank challenges, and technical

point or redirect the credit is a game changer. It’s

rounds, followed by behavioral and HR assessments.

about building a support system that ensures your

It’s a demanding process that truly tests both your

expertise isn’t just present, but respected.

hard skills and your cultural fit.

instances have been relatively low mostly during networking events or business calls they are still there. I’ve learned to navigate this by leading with

Reflecting on your journey thus far, would you, with the benefit of hindsight, make any changes to your career trajectory? If yes, what adjustments would you consider?

98

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/om-lakshmi-shanthi

M A R C H • A P R I L 2026

How We Got Cyber Smart addresses cyber safety, cyber bullying and online safety for elementary school-aged children.

Lisa has partnered with Cool.Org, and her content is found on the Department of Education website.

READ NOW

LISA ROTHFIELD-KIRSCHNER Author of How We Got Cyber Smart | Amazon Bestseller

Olivia and Jack learn about Face ID It was hot and sticky at Paradise Cove and the four tweenagers inside the house were getting restless. Olivia and Jack, twins who had been body boarding at the beach all morning, were lounging on the sofas while their cousin Roy paced the kitchen floor.

Roy was a bit nervous but was also curious to see if the trick would work. He picked up the phone, held it up to his own face and tried to mimic Johnny’s expression. To their absolute amazement, the little padlock icon on the screen clicked open.

Roy was deeply concerned about his big secret. He was planning a surprise birthday party for his brother, Johnny, but he had a major problem: he didn't have the contact details for Johnny’s school friends. He knew if he asked Johnny for his phone, the surprise would be ruined.

"I can’t believe we did it!" Roy whispered, feeling very satisfied, but also somewhat shocked.

Olivia and Jack looked at each other. They had a clever idea. "You know," Olivia said, "you and Johnny look so much alike. Even Grandma gets you mixed up!"

Olivia grinned. "Johnny is asleep on the beanbag downstairs. Why don't you try to unlock his phone using your face? We’ve heard that Face ID isn't always perfect with siblings."

Roy was hesitant. "We’ll get into trouble!" he whispered. But Olivia was determined to help with the party. "Don't worry, it’s for a good cause," she assured him. Reluctantly, Roy agreed. He was curious to see if their theory about the flaws in Face ID was true.

"Yippeeeee!" Olivia whispered as they crept onto the porch.

100

W O M E N I N S E C U R I T Y M A G A Z I N E

They quickly used their sleuthing skills to find the ‘basketball crew’ and ‘tennis mates’ in Johnny’s contacts. They jotted down the numbers and felt very clever for having bypassed the phone's security.

However, as they watched Johnny sleep, they started to feel rather uncomfortable.

If Roy could get in so easily, anyone who looked like him, or Johnny, could access Johnny’s private messages and photos.

That evening after a BBQ dinner, Olivia, Jack and Roy decided to confess. They told Johnny and their parents about their afternoon experiment.

"We need to tell you that we found a flaw in the phone's security," Olivia explained.

They showed everyone how Roy’s face had unlocked his brother Johnny’s device.

Their parents listened attentively. "We understand why you did it for the party," their father said, "but this shows why we

M A R C H • A P R I L 2026

have to be so careful with our technology.

Biometrics like Face ID are convenient, but they aren't a perfect shield."

Johnny admitted, "I thought my phone was unhackable, but it wasn't. It’s a bit scary to think how easily someone could see my private things."

The cousins soon realised that, while their trick had helped the party, it was a serious reminder about digital safety. Their parents helped Johnny update his settings to be more secure.

"And remember," their mother added, "technology is a wonderful tool, but we must always use it safely and respect each other's privacy."

Olivia, Jack, Roy and Johnny all felt more secure knowing they understood the risks better. They enjoyed the rest of their summer holiday, but with a newfound understanding of the need for strong passwords and extra protection.

TOP TIPS FOR USING FACE ID SAFELY

Using your face to unlock your device is fast, but it’s important to use it wisely to keep your information private.

• Turn on ‘Require Attention’. Always make sure this setting is enabled. It ensures the phone only unlocks if your eyes are open and looking at the screen. This stops people from unlocking it while you are asleep.

• Sibling caution. If you have a twin or a sibling who looks very much like you, be

I S S U E 29

aware that Face ID might struggle to tell you apart. In these cases, using a strong passcode is much safer.

• Use a strong backup passcode. Don't use numbers like 1234 or your birthday that are easy to guess. If Face ID fails or is bypassed, your passcode is your final line of defence.

• The quick lockdown. On most phones pressing the power button five times quickly will disable Face ID and force the phone to ask for a passcode. Use this if you feel you are in an unsecure area.

• Keep sensors clean. Dust or smudges on the camera can make the face recognition less accurate. Wipe the top of your screen regularly with a soft cloth.

• Update your software. Companies constantly release security updates to make Face ID harder to trick. Always install the latest updates on your device. www.linkedin.com/in/lisarothfield-kirschner

howwegotcybersmart.com

WOMEN IN SECURITY MAGAZINE

101

WOMEN IN SECURITY MAGAZINE CONTRIBUTORS 01

02

1. JAIMEE MULLINS

Technical Consultant, Saepio Information Security

2. AMANDA-JANE TURNER

Author of the Demystifying Cybercrime series and Women in Tech books. Conference Speaker and Cybercrime specialist

03

04

3. JACKIE ORCHARD

Head of Information and Data Security Advisory, Team Global Express

4. MEEGAN BRYANT

Defence Security Consultant

05

06

5. NADIA VEERAN-PATEL

LRMG as the CISO

6. HAJAR NACHATE

Chief Information Security Officer (CISO IT/OT)

7. KOKETSO RIHLAMPFU

07

08

Senior Manager: Lead Information Security Officer

8. LAURA JONES

CISO at Transdev Australasia

9. ERIN BLANCHARD

Technology Risk Consulting Vacationer

09

10

10. CLEO FAUL

Consultant (KPMG)

11. CRAIG FORD

11

12

Head Unicorn – Cofounder and Executive Director, Cyber Unicorns.

Australian Best Selling Author of A Hacker I Am, Foresight and The Shadow World book series. vCISO – Hungry Jacks, Wesley Mission, PCYC and Baidam Solutions

12. ADRIANA JONES

Engineer, Cybersecurity Advocate and founder of The Innocent Souls Project (TISP)

13

14

13. JO STEWART-RATTRAY

Oceania Ambassador, ISACA

14. LISA VENTURA MBE FCIIS

Chief Executive and Founder, Unity Group Solutions Limited/AI and Cyber Security Association

102

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

15

16

15. SIMON CARABETTA

National Cyber Security Training Advisor

16. DEARNE MCWHIRTER

Associate Director (KPMG)

17

18

17. JAY HIRA

Cyber Director – Financial Services, KPMG

18. KAREN STEPHENS

CEO and co-founder of BCyber

19. MARINA AZAR TOAILOA

19

20

Founder of the Mummy Safety Security Project

20. MADHURI NANDI

Madhuri Nandi, Head of security at Nuvei, AWSN Board Chair, author of Cyber Smart

21. SIENNA SMITH

21

22

Bachelor of Information Technology with a major in Cybersecurity student at Charles Sturt University

22. USWAH RAHMAN

Cybersecurity and Behaviour student at Western Sydney University

23. UGWOKE JENNIFER SOCHIMA

Cyber Security Instructor

23

24

24. OM VENUGOPAL

Master of Engineering in Cybersecurity graduate at the University of Maryland, USA

25. LETHABO SANGWENI

Computer Science Student at the University of Western Cape

25

26

26. LISA ROTHFIELD-KIRSCHNER

Author of How We Got Cyber Smart | Amazon Bestseller

I S S U E 29

WOMEN IN SECURITY MAGAZINE

103

SURFING THE NET

CYBER MANAGEMENT ALLIANCE BLOG

By Cyber Management Alliance Blog Cyber Security blog features articles, surveys, research and all things related to information security and data privacy including methods, technology and resources.

By Bleeping Computer The latest Technology and Security News to help you stay informed and protected on the Net. BleepingComputer is a premier destination for computer users of all skill levels to learn how to use and receive support for their computers.

WHAT IS SDP (SOFTWARE DEFINED PERIMETER)?

By Cloudbric Cloudbric provides free website security for everyone. Cloudbric aims to bring mainstream enterprise level website security to small and medium businesses.

Cloubric's blog aims to provide readers with the latest company news and trending infosec topics.

READ BLOG

READ BLOG

READ BLOG

UNDERSTANDING VULNERABILITIES ACROSS MODERN CYBERPHYSICAL SYSTEMS

ENTERPRISE WI-FI: THE MOST TRUSTED ATTACK SURFACE YOU’RE NOT TESTING (AND HOW TO FIX THAT)

2026 SCAM TRENDS: WHAT’S CHANGED, WHAT’S THE SAME & HOW TO STAY SAFE

By Claroty Blog Vulnerability management of cyberphysical systems (CPS) is one of the most frustrating challenges for enterprise security and networking teams, whose CPS protection efforts are often hampered on several fronts:

READ BLOG 104

WHEN IDENTITY ISN’T THE WEAK LINK, ACCESS STILL IS

W O M E N I N S E C U R I T Y M A G A Z I N E

By Hack The Box Blog Some security teams out there like to believe that the perimeter is gone. That everything important lives tucked behind identity controls, conditional access, and layers of cloud-native defense. The assumption is that if credentials are protected and endpoints are hardened, the rest will follow.

READ BLOG

By CyberCX Blog Scams have become the reality we can’t ignore with every Australian likely receiving one in some form. As cyber criminals grow more sophisticated, leveraging generative AI and cutting-edge tech, spotting scams has become trickier than ever.

READ BLOG M A R C H • A P R I L 2026

AN OPEN LETTER ON SECURITY, SOVEREIGNTY, AND THE RIGHT TO CHOOSE

By LogPoint' Blog For security leaders, service providers, and public sector organizations, this is no longer theoretical. It shows up in audits, procurement processes, customer contracts, and board-level risk discussions. At Logpoint, we see this every day.

HOW DOES IDENTITY THEFT MONITORING WORK?

By IdentityIQ In broad terms, identity theft monitoring is a service provided by private companies to help protect you from identity theft. While the details vary between services, they involve monitoring your identity in several different areas to identify risks and look for signs of fraud.

RANSOMWARE ENTRY POINTS ARE CHANGING. HERE IS WHAT TO DO ABOUT IT?

By CyberHoot Blog Ransomware groups are not breaking in organizations the same way they did five years ago. The entry methods have shifted, and understanding that shift is one of the most useful things you can do to protect your organization right now.

READ BLOG

READ BLOG

READ BLOG

HOW TO GET INTO CYBERSECURITY AND CARVE A CAREER PATH (WITHOUT LYING TO YOURSELF)

CYBER SCHOLARSHIPFOR-SERVICE STUDENTS SAY GOVERNMENT HAS PULLED RUG ON THEM, POTENTIALLY BURDENING THEM WITH DEBT

INTRODUCING "AI UNLOCKED: DECODING PROMPT INJECTION," A NEW INTERACTIVE CHALLENGE

By CyberScoop

This immersive simulation is designed to help security teams better understand the prompt injection threat landscape by putting them in the attacker’s seat.

Players are challenged to progress through three virtual rooms by using prompt injection techniques to convince the room’s supervisor, SAIGE, to reveal secret phrases that allow them to move forward.

By CodeLivly It’s either intimidating technical jargon from experts who forgot what being a beginner feels like, or empty hype from influencers selling you a dream. You’re told to “just learn to hack” while job postings demand 3 years of experience for entry-level roles.

READ BLOG I S S U E 29

A landmark program that offers scholarships in exchange for federal service is threatening to saddle students with hundreds of thousands of dollars worth of debt amid hiring freezes and budget cuts, raising questions about the future of an initiative proponents say has helped close the government’s cyber workforce gap.

READ BLOG

By CrowdStrike Blog

READ BLOG WOMEN IN SECURITY MAGAZINE

105

TURN IT UP SECURITY CONFIDENTIAL

CYBER SECURITY DISTRICT

CISO STORIES PODCAST

With Dark Rhiino Security Security Confidential provides weekly interviews and insights into the world of cybersecurity.

Produced entirely in-house by MSSP & global risk management firm Dark Rhiino Security.

With Laurens Jagt The interview podcast for cyber security professionals and for those who aspire to become one.

We interview industry experts about the latest trends, real life war stories and everything you need to know about this exciting industry.

With Jessica Hoffman SC Media and Saviynt are proud to present this month's CISO Stories program, where CISOs share tales from the trenches and unpack leadership lessons learned along the way. Hosted by Jessica Hoffman.

CLICK TO LISTEN

SEIDEA'S SPOTLIGHT

CYBERSECURITY SESSIONS

With Stephanie Itimi Seidea's Spotlight sheds light on the journeys of Black, Minority Ethnic women who are changing the face of cybersecurity. Through powerful interviews with bootcamp graduates and industry leaders, we explore the challenges and triumphs BME women face in this dynamic field. Join us as we uncover career advice, build a community of support, and celebrate the rise of a cyber sisterhood breaking down barriers and forging a brighter future in tech.

With Dani Middleton-Wren Cybersecurity Sessions is an insightful monthly podcast covering the latest cybersecurity news and hot topics, featuring security leaders from Netacea alongside other technology experts.At Netacea we are interested not just in the technology behind cyber-attacks, but also the intent. How do they affect different businesses, sectors, and even wider society?

What stories are out there of cybersecurity woes and wins?

CLICK TO LISTEN 106

CLICK TO LISTEN

W O M E N I N S E C U R I T Y M A G A Z I N E

CLICK TO LISTEN

CLICK TO LISTEN

TO THE POINT CYBERSECURITY With Rachael Lyon, Vince Spina and Eric Trexler Stay ahead in the dynamic world of cybersecurity with 'To the Point Cybersecurity.' This podcast offers in-depth discussions on the latest cyber threats, trends, and technologies impacting businesses, governments, and communities globally.Listeners will gain insights into how emerging technologies, such as AI and frameworks like data governance and expanded global cyber regulations, are shaping modern security practices

CLICK TO LISTEN M A R C H • A P R I L 2026

TECH WOKE

CYBER MADE HUMAN

HACKED OFF

With Christopher Okpala Most people are trying to break into cybersecurity the wrong way.

With Alice Violet Humans are the weakest link in cybersecurity.' We disagree and we're here to change the narrative.

Subscribe for monthly episodes.

With Holly Grace Williams Hacked Off demystifies the world of cybersecurity. Hosted

by Secarma's Managing Director, Holly Grace Williams, it features weekly interviews delving beneath the headlines of the latest hacks, breaches and vulnerabilities, providing expert advice on how to stay safe online. This podcast is brought to you by global cybersecurity and penetration testing company, Secarma.

In this episode of Tech Woke, I sit down with Destini Simmons (Cyber Shorty), Solutions Engineer, to break down what it really takes to enter cybersecurity in 2026 with no experience.

CLICK TO LISTEN

KBI.MEDIA With Karissa Breen Unlike every other security podcast, we don't get stuck down in the technical weeds. Our remit is to speak with experts around the globe at the strategic level how security technology can improve the experience and risk optimisation for every organisation. The Voice of Cyber® - In Partnership with Vanta

CLICK TO LISTEN I S S U E 29

CLICK TO LISTEN

SHARE TODAY, SAVE TOMMORROW With AUSCERT Anthony Caruana and Bek Cheb AUSCERT is Australia's pioneer Cyber Emergency Response Team, proudly a part of The University of Queensland. We help our members prevent, detect, respond and mitigate cyber-based attacks.

CLICK TO LISTEN

CLICK TO LISTEN

CYBER UNCUT With Momentum Media Cyber Uncut brings you the key decision makers and cutting edge innovators shaping Australia's cyber revolution. From cyber security to artificial intelligence and information systems, discover how businesses and government are navigating the transition to a digital future.

CLICK TO LISTEN WOMEN IN SECURITY MAGAZINE

107

OFF THE SHELF

THE DIGITAL BATTLE CYBER SECURITY Author // Lida The Digital Battle Cyber Security attempts to assist consumers by suggesting cyber security measures to protect PII, intellectual property, and critical infrastructure from compromise. To prevent exploitation, consumers need vigilance paired with knowledge.

BUY THE BOOK

YOU CAN STOP STUPID: STOPPING LOSSES FROM ACCIDENTAL AND MALICIOUS ACTIONS Authors // Ira Winkler and Tracy Celaya Brown Around the world, users cost organizations billions of dollars due to simple errors and malicious actions. They believe that there is some deficiency in the users. In response, organizations believe that they have to improve their awareness efforts and making more secure users. This is like saying that coalmines should get healthier canaries.

BUY THE BOOK

CONFIDENT CYBER SECURITY: THE ESSENTIAL INSIGHTS AND HOW TO PROTECT FROM THREATS Authors // Dr Jessica Barker Confident Cyber Security is here to help. From the human side to the technical and physical implications, this book takes you through the fundamentals: how to keep secrets safe, how to stop people being manipulated and how to protect people, businesses and countries from those who wish to do harm.

BUY THE BOOK

CYBERFEMINISM INDEX Author // Mindy Seu Hackers, scholars, artists and activists of all regions, races and sexual orientations consider how humans might reconstruct themselves by way of technology. When learning about internet history, we are taught to focus on engineering, the militaryindustrial complex and the grandfathers who created the architecture and protocol.

BUY THE BOOK

108

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

AI AND THE OCTOPUS ORGANIZATION: BUILDING THE SUPERINTELLIGENT FIRM Author // Jonathan Brill and Stephen Wunker In AI and the Octopus Organization: Building the Superintelligent Firm, leading futurist Jonathan Brill and innovation expert Stephen Wunker unveil a groundbreaking vision for how organizations must evolve to survive and thrive in the age of artificial intelligence.

BUY THE BOOK

PEOPLE-CENTRIC SECURITY: TRANSFORMING YOUR ENTERPRISE SECURITY CULTURE Author // Lance Hayden People-Centric Security: Transforming Your Enterprise Security Culture addresses the urgent need for change at the intersection of people and security. Esentially a complete security culture toolkit, this comprehensive resource provides you with a blueprint for assessing, designing, building, and maintaining human firewalls.

BUY THE BOOK

CYBER LIKE A GIRL: WISDOM & INSIGHTS FROM 100 WOMEN IN THE FIELD Authors // Agathe Merle Cyber Like a Girl is a powerful exploration of what it means to build a career in cybersecurity as a woman-against the odds and with purpose. Author Agathe Merle never planned to work in cybersecurity. Nearly a decade later, she's not only built deep technical expertise, particularly in Security Operations, but also observed the industry through the lens of a researcher, woman, and insider.

BUY THE BOOK

THE ADVENTURES OF SNACKER THE HACKER Author // Lyron Foster | Illustrator // Lauren Foster This book is an action-packed adventure that takes readers on a journey through the world of technology and crime-solving. The story follows Alexis, a young girl hacker with a love for Japanese snacks, and her best friend Tania as they navigate the challenging world of cybercrime in their hometown of Hilo, Hawaii. Together, they solve a series of complex and thrilling cases that require their expertise in technology and quick thinking to unravel.

BUY THE BOOK

I S S U E 29

WOMEN IN SECURITY MAGAZINE

109

OFF THE SHELF

CYBERAMA: ELECTRIC QUEST Author // Arthi Vasudevan | Illustrator // Jasmin Sorto In this middle grade adventure book about cyber safety, Maya, Dave, and their AI animals are plunged back into the high-stakes cyberworld where digital dangers are all too real.

“I couldn’t put the book down. I read it in one day as it’s as good as Percy Jackson. I really liked Cyber Panda and Maya. An amazing book with a wonderful story.”

BUY THE BOOK

LIZZY'S TRIUMPH OVER CYBER-BULLYING: CYBER SAFETY CAN BE FUN Authors // Nina Du Thaler Lizzy’s Triumph Over Cyber-Bullying is a heartfelt and empowering story that helps children understand the emotional impact of cyberbullying—and how to overcome it.

Told through the diary of Elle, a smart and caring 10-year-old, this book follows her best friend Lizzy as she navigates the pain of being bullied online and learns how to take back control with the help of trusted friends, family, and teachers.

BUY THE BOOK

CYBER SECURITY FOR KIDS Author // Dr Dheeraj Mehrotra This is to provide further insight into the concerns about the same. It is more necessary; Kids should be educated about cyber security early because the skills they gain will help safeguard them as they age and experience more digital hazards. The main reason for this is because it is more required. I do not doubt that the book will serve as a manual for all parties investigating the concept.

BUY THE BOOK

THE MAGIC PASSWORD: A KID'S GUIDE TO CODES AND SECRETS Author // Christian Blake What if your computer could be in two places at once?

The Magic Coin introduces children ages 8-12 to quantum computing using only everyday analogies they already understand. No math. No jargon. Just spinning coins, spooky best friends, and ice castles.

BUY THE BOOK

110

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

THE LEARNING HUB

FOUNDATIONS OF CYBERSECURITY Get on the fast track to a career in cybersecurity. In this certificate program, you'll learn in-demand skills, and get AI training from Google experts. Learn at your own pace, no degree or experience required.

VISIT HERE

CYBERSECURITY AND NETWORK DEFENSE FUNDAMENTALS This program equips aspiring cybersecurity professionals, SOC analysts, network engineers, and system administrators with the foundational knowledge and practical skills required to understand, analyze, and defend against modern cyber threats in enterprise environments.

VISIT HERE

INTRODUCTION TO CYBERSECURITY ESSENTIALS During the course, you’ll learn to identify common threats such as data theft, tampering, phishing, and malware. You’ll discover how cyberattacks unfold and explore the physical, environmental, and access control measures used to secure devices and facilities. Plus, you’ll develop strong digital hygiene habits using secure passwords, password management techniques, and multi-factor authentication, and understand the risks of password reuse, sharing, and default credentials.

VISIT HERE

HOMELAND SECURITY AND CYBERSECURITY Homeland security is about safeguarding the United States from domestic catastrophic destruction. Cybersecurity has emerged as a priority homeland security concern because a coordinated cyber attack against critical infrastructure could result in the worst catastrophe in the nation’s history.

VISIT HERE

112

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

FEATURING FREE SECURITY TRAINING RESOURCES THAT ARE AIMED AT INCREASING SECURITY AWARENESS AND HELPING PEOPLE BUILD AND UPSKILL THEIR SECURITY SKILLS.

CYBERSECURITY FOR EVERYONE Cybersecurity affects everyone, including in the delivery of basic products and services. If you or your organization want to better understand how to address your cybersecurity, this is the course for you and your colleagues to take -- from seasoned professionals to your nontechnical colleagues.

VISIT HERE

CERTIFIED IN CYBERSECURITY SPECIALIZATION Each course includes a case study that will require students to put into practice the knowledge they have gained throughout each course.

Successful completion of course projects will require the basic understanding of the topics covered and the ability to relate those topics to the real world. The objective of each project is to determine whether students have understood course concepts and are able to use them in a real world setting.

VISIT HERE

CYBERSECURITY FUNDAMENTALS WITH CISCO TOOLS SPECIALIZATION This specialization provides comprehensive training in cybersecurity operations, risk assessment, and strategic risk management, equipping learners with the skills to identify, analyze, and mitigate modern cyber threats.

VISIT HERE

AI FOR CYBERSECURITY SPECIALIZATION This Specialization is designed for post-graduate students aiming to master AI applications in cybersecurity. Through three comprehensive courses, you will explore advanced techniques for detecting and mitigating various cyber threats. The curriculum covers essential topics such as AI-driven fraud prevention, malware analysis, and the implications of Generative Adversarial Networks (GANs).

VISIT HERE

I S S U E 29

WOMEN IN SECURITY MAGAZINE

113

THE LEARNING HUB COMPTIA CYBERSECURITY ANALYST The CompTIA Cybersecurity Analyst+ (CySA+) Specialization prepares you to detect, analyze, and respond to cybersecurity threats. Guided by industry expert Aamir Lakhani, this course covers essential topics such as attack methodologies, incident response, and vulnerability management.

VISIT HERE

CYBERSECURITY ATTACK AND DEFENSE FUNDAMENTALS SPECIALIZATION This Specialization can be taken by students, IT professionals, IT managers, career changers, and anyone who seeks a cybersecurity career or aspires to advance their current role. This course is ideal for those entering the cybersecurity workforce, providing foundational, hands-on skills to solve the most common security issues organizations face today.

VISIT HERE

MICROSOFT CYBERSECURITY ANALYST PROFESSIONAL CERTIFICATE With this program, you can prepare for the Microsoft Cybersecurity Analyst SC-900 certification exam administered by Microsoft. Learners who complete this program will receive a 50% discount voucher to take the exam. Organizations rely on cybersecurity experts to protect themselves from threats, but nearly 60% of organizations report security talent shortages (1). Prepare for a new career in this high-demand field with professional training from Microsoft — an industry-recognized leader in cybersecurity. You'll also have the option to learn how generative AI tools and techniques are used in cybersecurity analysis.

VISIT HERE

CYBERSECURITY: DEVELOPING A PROGRAM FOR YOUR BUSINESS Cybersecurity is an essential business skill for the evolving workplace.

For-profit companies, government agencies, and not-for-profit organizations all need technologically proficient, business-savvy information technology security professionals.

VISIT HERE

114

W O M E N I N S E C U R I T Y M A G A Z I N E

M A R C H • A P R I L 2026

FEATURING FREE SECURITY TRAINING RESOURCES THAT ARE AIMED AT INCREASING SECURITY AWARENESS AND HELPING PEOPLE BUILD AND UPSKILL THEIR SECURITY SKILLS.

MANAGING CYBERSECURITY INCIDENTS AND DISASTERS Most organizations plan for routine operations, but what happens when unexpected events overtake the routine? This course examines contingency planning used to prepare for and manage non-normal operations, including cybersecurity incidents – like hacking attempts, web site defacement, denial of service attacks, information disclosures; a well as other natural and man-made cybersecurity disasters.

VISIT HERE

CYBERSECURITY TRAINING FOR IT PROFESSIONALS The no-cost curriculum includes all courses to support security-driven networking, adaptive cloud security, AI-driven security operations and zero-trust network access. Completion of these courses will help cybersecurity professionals defend their networks against the widest range of ever changing threats.

VISIT HERE

SECURE CODING 101: JAVASCRIPT In the Secure Coding 101: JavaScript Module, you will learn how to improve the security of your JavaScript code through reverse engineering advanced JavaScript obfuscation functions and identifying hard to find vulnerabilities, and learning how to patch them properly.

VISIT HERE

ANALYZING DATA In this course, you’ll learn key skills and tools for data analytics, including spreadsheets, structured query language (SQL), R programming, and Tableau. You will also understand the daily tasks of a data analyst and explore the kinds of jobs you could pursue after completing this program.

VISIT HERE

I S S U E 29

WOMEN IN SECURITY MAGAZINE

115

J O B B OA R D SENIOR SECURITY RESEARCHER | MICROSOFT FULL TIME

INDIA

RESPONSIBILITIES • Monitor, triage, and respond to security incidents using alerts and incidents from Microsoft Defender products (MDE, MDI, MDO, MDA, MDC, Sentinel etc.)

• Perform proactive threat hunting using hypothesis, and telemetry from endpoints, identities, cloud and network.

• Develop hunting queries using Kusto Query Language (KQL) or similar to uncover suspicious patterns and behaviours.

• Investigate security incidents across hybrid environments and contribute to root cause analysis and containment strategies.

• Collaborate with internal teams (defender, threat intelligence, engineering) to enhance detection logic, develop automations, and improve incident response workflows.

• Contribute to incident documentation, detection playbooks, and operational runbooks.

• Stay current with evolving threat landscapes, cloud attack vectors, and advanced persistent threats (APT).

• Develop necessary automation (e.g. using Jupyter Notebooks) to scale Threat Hunting.

APPLY HERE

DIGITAL ASSET RISK AND CONTROL SPECIALIST | EY FULL TIME

AUSTRALIA

YOUR KEY RESPONSIBILITIES This is an exciting period in the adoption of the technology with incoming regulation set to provide certainty for companies who’ve been sitting on the sidelines. You will have the opportunity to build on your strong Risk and Control skills and enthusiasm for digital assets by working with some of the most

innovative companies and vendors within Oceania and globally through EY’s global blockchain network. You will be given all the skills, knowledge, and exciting learning opportunities to build your career, and the chance to make a real impact.

APPLY HERE

SENIOR CONSULTANT - STRATEGY & RISK | CYBERCX FULL TIME

NEW ZEALAND

POSITION SUMMARY & PRIMARY OBJECTIVES • The Senior Consultant is an experienced cyber security professional capable of leading client meetings and producing high-quality deliverables with minimal supervision.

• There is the potential for this role to develop into a LEAD for our IR tabletop engagements if that was an avenue of interest.

KEY ROLES & RESPONSIBILITIES • Lead discovery activities with client stakeholders to inform deliverables and shape client outcomes • Support the development of cyber security strategies and solutions to protect clients and their customers

116

W O M E N I N S E C U R I T Y M A G A Z I N E

• Facilitate cyber security awareness amongst our clients’ leadership teams • Produce high-quality proposals, reports, and presentations for senior client stakeholders • Manage client expectations, communicate effectively, and develop professional relationships with clients • Prepare clients for critical cyber security incidents through contributing to their cyber security strategic direction

APPLY HERE

M A R C H • A P R I L 2026

CYBERSECURITY RISK MANAGEMENT ANALYST | MERCOR PART TIME

AUSTRALIA

ROLE RESPONSIBILITIES • Evaluate and assess content for potential security concerns in a cutting-edge AI context.

• Review and analyze security patterns to enhance AI model security.

• Collaborate asynchronously with a team of experts to solve real-world cybersecurity problems.

• Utilize Python and other data analysis tools to interact with large databases.

• Work independently to improve AI model performance and security analysis.

APPLY HERE

ANALYST, OPERATIONAL THREAT INTELLIGENCE | CIBC FULL TIME

CANADA

WHAT YOU’LL BE DOING Reporting to the Senior Manager, Operational Threat Intelligence, the Analyst, Operational Threat Intelligence is responsible for tactical level information and intelligence collection, analysis, and production.

This effort is geared predominantly towards protecting CIBC’s clients, assets, staff, and operations through the delivery of proactive intelligence across the cyber, financial, geopolitical, and physical security domains. The Analyst leverages knowledge and robust experience with intelligence methodologies to advance the Fusion Threat Intelligence program and deliver best in class intelligence products.

At CIBC we enable the work environment most optimal for you to thrive in your role. You'll have the flexibility to manage your work activities within a hybrid work arrangement where you’ll spend 1-3 days per week onsite, while other days will be remote.

APPLY HERE

DATA ANALYST (FRAUD) | TAKEALOT.COM FULL TIME

SOUTH AFRICA

• Driving Product Innovation: Serve as the primary • Scaling Experimentation: Build and analytical counterpart to product teams, contributing champion experimentation frameworks, critical insights that inform the development of methodologies, and tools that empower product cutting-edge features and help shape the future of our teams to test hypotheses rigorously and iterate digital experience. with confidence.

• Unlocking User Insights: Analyze user behavior • Fostering a Data-Centric Culture: Advocate for dataand feedback to identify patterns, uncover friction informed thinking across the organization, promoting points, and translate findings into actionable best practices and ensuring that product decisions recommendations that improve product usability, are consistently grounded in evidence and insight. engagement, and satisfaction.

• Defining Success: Design clear, scalable performance APPLY HERE frameworks and KPIs that enable teams to track progress, evaluate product outcomes, and align efforts across disciplines.

I S S U E 29

WOMEN IN SECURITY MAGAZINE

117

J O B B OA R D AI / EMERGING TECH SECURITY ANALYST | ALIGNERR FULL TIME

UNITED KINGDOM

We’re focused on the security of AI systems themselves, examining how modern models can be attacked, misused, or pushed beyond their intended boundaries. You will work with realistic scenarios to help ensure AI systems remain safe, reliable, and aligned with security best practices.

• Organization: Alignerr • Position: AI / Emerging Tech Security Analyst Type: Contract / Task-Based • Compensation: $40–$60 /hour • Location: Remote Commitment: 10–40 hours/week

WHAT YOU’LL DO • Analyze AI and LLM security scenarios to understand how models behave under adversarial or unexpected conditions • Review prompt injection, data leakage, model abuse, and system misuse cases • Classify security issues and appropriate mitigations based on real-world impact and likelihood • Help evaluate and improve AI system behavior so it remains safe, reliable, and aligned with security best practices

APPLY HERE

SR. STAFF ENGINEER, ENTERPRISE BROWSER | NETSKOPE FULL TIME

SOUTH KOREA

WHAT’S IN IT FOR YOU

WHAT YOU WILL BE DOING

As a member of this dynamic team, you will dive deep into the world of advanced browser technologies, particularly Chromium. You'll play a critical role in modifying and extending Chromium modules to support the full suite of Netskope Enterprise Browser functionalities. Expect to work with cuttingedge technologies such as C++ and gRPC services, and to tackle complex challenges in distributed systems—ranging from performance optimization and scalability to high availability, containerization, and advanced analytics.

• Modify and enhance the Chromium engine to support new features.

• Using advanced data structures and algorithms in C++ • Researching optimization algorithms and improving performance • Solving problems with quick and elegant solutions

APPLY HERE

ACADEMY CYBER | PWC ITALY FULL TIME

ITALY

• Digital Transformation: PwC Italy focuses on driving digital transformation for its clients through advisory and consulting services in areas such as deals, risk, analytics, and program management.

• Market Insights and Research: PwC Italy provides updated and informed macroeconomic insights and market reports, such as the Real Estate

118

W O M E N I N S E C U R I T Y M A G A Z I N E

Healthcare Market Report, to help clients navigate economic conditions and investment dynamics.

APPLY HERE

M A R C H • A P R I L 2026

SENIOR TRANSACTION & FRAUD OPTIMIZATION ANALYST | FXCAREER.EU FULL TIME

NIGERIA

ROLE OVERVIEW

KEY RESPONSIBILITIES

The Senior Transaction & Fraud Optimization Analyst will lead daily transaction monitoring, fraud risk optimization, routing strategy enhancement, and executive reporting development.

This role requires hands-on expertise in Fraud.net, strong knowledge of payment routing logic, and advanced analytics capabilities within fin-tech or payment processing environments.

Transaction Analysis and Monitoring • Analyze daily transaction volumes, approval rates, declines, charge-backs, and fraud ratios.

• Identify patterns, anomalies, and performance gaps.

• Deliver actionable insights to increase authorization rates and reduce false declines.

APPLY HERE

CYBER RESILIENCE RISK EXPERT | ALLIANZ SERVICES FULL TIME

SPAIN

ROLE OVERVIEW You will engage in a service that is responsible for the coordination and execution of the Top Cyber Threat Assessment for all Allianz Entities (70+). This role is part of the Resilience as a Service division, acting within it as a micro-cluster performing cyber threat assessments and Cyber Risk Quantifications (CRQs).

WHAT YOU DO • Manage and maintain the cyber risk quantification model in collaboration with the vendor • Regularly analyze and validate input data and model results

• Support the delivery of cyber risk quantification services provided to clients globally • Evaluation and presentation of model results • Analysis and coordination of model changes in collaboration with the vendor • Provide functional support for an internal platform, including conception and testing of functional requirements • Conduct training sessions and provide functional support for tool user • Prepare, revise, and maintain relevant documentation

APPLY HERE

L3 NETWORK ADMINISTRATOR - CCIE | LANCESOFT MIDDLE EAST FULL TIME

UNITED ARAB EMIRATES

JOB SUMMARY We are seeking a highly senior L3 Network Engineer / Network Architect with 8–10 years of hands-on enterprise experience to provide architecture-level support, lead complex network designvalidation,and drive network optimization, security posture, and availability improvements across enterprise and hybrid cloud environments.

I S S U E 29

The role requires CCIE-level expertise, deep Azure networking skills at L3 level, and strong leadership in critical escalations, Zero Trust implementation, and governance.

APPLY HERE

WOMEN IN SECURITY MAGAZINE

119

Support the Future of the

AUSTRALIAN WOMEN IN SECURITY AWARDS

®

We need your support to continue this important initiative into its 8th year.

The 2026 Awards will be hosted in Melbourne. To ensure this initiative continues, we invite you to partner with us as a sponsor.

NSORSH

I

Packages ava ilable from $6,000 to $50,000 Custom pack ages tailored to your organisa tion’s needs

PP

O

Your sponsorship will help us continue to celebrate and elevate the achievements of women in security across Australia.

O SP

P

JOIN US IN MELBOURNE FOR 2026

ORT

IE U NIT

S

To discuss how you can support and sponsor next year’s awards, please reach out to Aby at Aby@source2create.com.au.

We look forward to partnering with you to make the 2026 Australian Women in Security Awards our best yet.