Women in Security Magazine Issue31

31

JULY • AUGUST 2026

Truth Growth Apologise

I’ve made a point, it was ignored, and then someone else repeats it and receives credit

Trust I would like to negotiate for a leadership role

Tokenism

Listen Everyday bias and behaviour

I would like to get paid the same as him

Change Heal

Combating preconceptions Quotas vs. competence

Vulnerable Forgive Addressing microaggressions

Support Inclusion beyond headcount

W W W. W O M E N I N S E C U R I T Y M A G A Z I N E . C O M

FROM THE PUBLISHER

I

still remember the conversations that led to

But I did. Because I decided we were no longer going

the launch of the Australian Women in Security

to let these women stay in the background. No longer

Awards. They were not easy conversations. They

under cover. No longer doing the work, carrying the

were not polished. They were not the kind of

load, leading the change and receiving no recognition

conversations people have when everything is

or celebration for it.

going well.

Since then, I have had many more courageous

They were conversations about workplace bullying,

conversations. Some have been about my own story.

sexual harassment, equality in roles, women being

Many more have come from others: conversations

overlooked, sisterhood gangs, conference etiquette,

shared quietly after events, in messages, over coffee,

awards going to the same types of people, often men,

in moments where someone finally feels safe enough

while women doing incredible work stood quietly in

to say, “This happened to me,” or “I don’t know what to

the background.

do,” or “I can’t speak out.”

You name it, I had heard it from at least one person.

And I hear you. I really do.

Then, I sat down with my dear friend JL and found

Having these conversations in this industry can be a

she had been hearing the same things: different

double-edged sword. Speak up and you worry about

names, different workplaces, same stories.

being labelled difficult. Stay silent and you carry something that was never yours to carry alone.

That conversation became a turning point.

So, when someone says, “I can’t speak out,” I From there, the Australian Women in Security Awards

understand where that comes from.

and Conference were born. That was eight years ago.

But I also want to say this clearly: we are all in And, if I am honest, it was a scary time for me. It was

this together.

scary to voice my own opinion so publicly. Scary

2

to stand beside the women who had trusted me

Whatever your conversation may be, there are people

with their stories. Scary to say “no, this is not good

in this industry who will stand beside you. There are

enough anymore.”

people who will listen. There are people who know

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

Abigail Swabey

exactly what it costs to be honest when the room

traits that make women exceptional in cybersecurity.

would rather you stay polite.

Jay Hira explores the conversation that keeps happening. Karen Stephens reminds us that you do

This issue of Women in Security Magazine is

not need an executive title to affect change. Madhuri

about those conversations: the ones that make

Nandi shares what courageous conversations look

us uncomfortable; the ones that challenge old

like through real cybersecurity leadership. Marina

systems; the ones that ask why career ceilings still

Azar Toailoa takes us beyond discomfort and into the

exist, why equity is still treated as an optional extra,

hardest conversations, the ones that can save lives.

why belonging is still not a given, and why building influence in traditionally closed spaces can still feel

And there are many more.

like pushing against a locked door.

Each story, each article, each reflection adds Courageous conversations are not always loud.

something to this bigger conversation we are having

Sometimes they are quiet. Sometimes they happen in

as an industry. Courageous conversations built the

a meeting when one person says, “Can we look at this

foundation for the Awards. They continue to shape

differently?” Sometimes they happen when a woman

this magazine. And they are still needed.

asks for the promotion, the pay rise, the opportunity or the respect she should have received years ago.

Maybe now more than ever. So, let’s have them.

Sometimes courage is simply telling the truth without

Not perfectly. Not always comfortably. But honestly.

apologising for it.

For this issue, I want us to be unapologetically honest, to shed the need to make everything neat, to bring the vulnerability and speak the real talk. Because real

Abigail Swabey PUBLISHER, and CEO of Source2Create

change does not come from pretending everything is fine.

www.linkedin.com/in/abigail-swabey-95145312

In Issue 31 you will hear from incredible voices across

aby@source2create.com.au

the industry. Lisa Ventura writes about reclaiming the

I S S U E 31

WOMEN IN SECURITY MAGAZINE

3

CONTENTS

2

COLUMN

FROM THE PUBLISHER

Staying safe from cybercrime: more than not clicking links 20

UNAPOLOGETIC CONVERSATIONS FOR WOMEN IN SECURITY: THE REAL TALK TOOLKIT

The road to success is a bumpy one

48

You don’t need an executive title to affect change

74

The questions we stop asking: courageous conversations through real cybersecurity leadership 88

8

WHAT’S HER JOURNEY? Rachel Choong

22

Wendy Ngcongo

26

Samantha Finan

30

Nagammai Shanmugham

34

Stephanie Uzama

38

Sandra Estok

40

Isabella Schulz

44

INDUSTRY PERSPECTIVES

119 THE LEARNING HUB 122 JOB BOARD

Why AI governance needs more honest leadership conversations

54

“You’re too emotional for security”: reclaiming the traits that make women exceptional in cyber security

58

It’s not about a salary: it’s all about reality

62

The conversation that keeps happening 66 Why diversity of experience across engineering, sales and marketing can create stronger security leadership

70

JULY • AUGUST 2026

Support the Future of the

AUSTRALIAN WOMEN IN SECURITY AWARDS

®

We need your support to continue this important initiative into its 8th year.

Abigail Swabey

ADVERTISING

CAREER PERSPECTIVES Beyond discomfort: the hardest conversations can save lives

82

Abigail Swabey Jane Saafi JOIN US IN MELBOURNE FOR 2026

SURFING THE NET 112

The 2026 Awards will be hosted in Melbourne. To ensure this initiative continues, we invite you to partner with us as a sponsor.

ONSORSH

I

Packages ava ilable from $6,000 to $50,000 Custom packa ges tailored to your organisa tion’s needs

PP

O

Your sponsorship will help us continue to celebrate and elevate the achievements of women in security across Australia.

SP

P

The Gallagher Security User Group event in 2025 sets an attendance record

78

FOUNDER & EDITOR

ORT

U NIT

IE

S

M A G A Z I N E C O O R D I N ATO R Jane Saafi

JOURNALISTS Stuart Corner

108

To discuss how you can support and sponsor next year’s awards, please reach out to Aby at Aby@source2create.com.au.

We look forward to partnering with you to make the 2026 Australian Women in Security Awards our best yet.

SUB-EDITOR Stuart Corner

DESIGNER Rachel Lee

STUDENT IN SECURITY SPOTLIGHT

TURN IT UP 114

Sara Hashi

92

Lauren Mauro

98

Shafia Husna

104

Source2Create Pty Ltd is the publisher of this magazine and its website (www.womeninsecuritymagazine.com).

©Copyright 2026 Source2Create. All rights reserved.

Reproduction in whole or part in any form or medium without express written permission of Source2Create is prohibited.

OFF THE SHELF 116

ASSOCIATIONS & GROUPS SUPPORTING THE WOMEN IN SECURITY MAGAZINE

Thank You

TO OUR SUPPORTING ASSOCIATIONS

ABIGAIL SWABEY

UNAPOLOGETIC CONVERSATIONS FOR WOMEN IN SECURITY: THE REAL TALK TOOLKIT

by Abigail Swabey, Publisher of Women in Security Magazine

This toolkit playbook is designed for women working across the security industry: cyber, physical security, guarding, executive protection, risk, resilience, intelligence, emergency management and security leadership.

T

he scripts are not meant to make hard

HOW TO USE THESE SCRIPTS

conversations feel easy. They are meant

Before using any of these scripts, decide what kind of

to give you something steady to hold

conversation you are having.

onto when a conversation gets awkward, political or emotionally loaded.

Use the wording as a starting point. Change the language so it sounds like you. Keep the structure: name the issue, connect it to impact, ask for a concrete shift then bring the conversation back to shared standards.

8

W O M E N I N S E C U R I T Y M A G A Z I N E

• Influence conversation: you are trying to shift thinking, behaviour or language before it becomes a formal issue.

• Boundary conversation: you need to make clear that a pattern is not acceptable.

• Escalation conversation: you have already tried informal channels, or the behaviour is serious

J U LY • A U G U S T 2026

F E A T U R E

enough that HR, legal, compliance or senior leadership needs to be involved.

These scripts are for influence and boundary conversations. They do not replace formal reporting, workplace safety obligations, legal advice, union advice or HR processes where those are needed.

A useful frame: “I’m raising this because I want the standard to be clear, not because I want a fight.” That line works more often than people expect.

SCRIPT 1: CHALLENGING GENDER-BIASED HIRING MYTHS Use this when someone suggests women are less suited to certain security roles because of physical presence, technical depth, toughness, availability or ‘cultural fit’.

PREPARATION

communication under pressure and the ability to

Go in with one or two examples of what the role

follow through. Those things are not gendered.

actually requires. Separate the job requirements from assumptions about who traditionally looks the part.

“I’d like us to tighten the criteria. Instead of asking

If possible, bring the conversation back to capability,

whether someone has the ‘right personality’ for

evidence and risk.

security, can we ask what evidence they have of deescalation, decision-making, technical competence,

Ask yourself:

resilience and team leadership?

• What myth is being implied?

“That gives us a stronger hire. It also protects us from

• What does the role genuinely need?

repeating the same pattern and calling it merit.”

• What selection criteria would produce a fairer decision?

If the response is: “We’re just being realistic,” your response should be:

Avoid making the conversation about whether someone is ‘sexist’. That usually sends people

“I agree that we need to be realistic. That’s why I

into self-defence mode. Focus on the decision-

want the criteria to be specific. Realistic should mean

making logic.

evidence-based, not based on who has usually been hired before.”

SCRIPT TEMPLATE “Can I pause on that for a moment? When we say

If the response is: “Clients expect a certain type of

this role needs someone who can ‘hold their own’ or

person,” respond with:

‘fit the environment’, I want to make sure we are not using coded language that screens women out before

“Some clients may have old expectations. Our job is to

we have assessed capability.

meet the security needs, not reinforce a stereotype. If presence matters, let’s define what presence means

“The role needs judgement, presence, risk awareness,

I S S U E 31

in behaviour, not body type or gender.”

WOMEN IN SECURITY MAGAZINE

9

EXPECTED OUTCOMES AND NEXT STEPS

PREPARATION

• Constructive reaction: if the group agrees

Gather what you can without breaching

to refine selection criteria. move quickly into

confidentiality. Know the role levels, your

action. Suggest a short scorecard that assesses

responsibilities, market context if available and any

capability rather than ‘fit’.

expanded duties you are carrying. Be clear whether

• Defensive reaction: if someone insists they are not biased, acknowledge intent. Then return

you are asking for information, adjustment or a policy change.

to the process: “I’m not questioning intent. I’m questioning whether the criteria are clear enough.”

Decide your main ask:

• Dismissive reaction: if the issue is waved away as overthinking, ask for the decision to be

• “Show me the salary band.”

documented against the role criteria. That often

• “Explain how pay decisions are made.”

changes the level of care in the room.

• “Review my pay against scope.”

• “Create a transparent framework for the team.”

This constructive resolution is a hiring process that names what success looks like and tests for it fairly.

Do not over-explain. Pay conversations often get derailed when women feel they need to prove they

SCRIPT 2: ADVOCATING FOR PAY TRANSPARENCY

deserve the right to ask.

Use this when your pay bands, promotion increases,

SCRIPT TEMPLATE

overtime rates, loadings, allowances or leadership

“I’d like to talk about pay transparency for my role and

salary pathways are vague.

the pathway from here.

“At the moment, I don’t have enough visibility over the salary band, how progression is assessed, or what criteria are used for increases. That makes it hard to plan, and it also creates room for inconsistency.

“I’m asking for three things: the current band for my role, the criteria for moving to the next level and a review of whether my pay reflects the scope of my current role.

“I want this to be a practical conversation. If there is a gap, let’s name it and agree what changes are needed, and by when.”

If the response is: “We don’t discuss pay, reply with: “I’m not asking to discuss anyone else’s confidential information. I’m asking for transparency about the range, criteria and decision process that applies to my role.”

If the response is: “Budgets are tight,” say:

10

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

F E A T U R E

" Decide whether to address the issue in the moment or afterwards.

In the moment responses work best when the behaviour is public and the correction can be brief. A follow-up works better when emotions are high or the person has more positional power. Have a short line ready.

You do not need a speech."

“I understand budgets matter. I still need clarity on

Decide whether to address the issue in the moment

whether the organisation recognises the level of work

or afterwards. In the moment responses work best

I’m doing. If adjustment can’t happen immediately, I’d

when the behaviour is public and the correction can

like a written plan and timing rather than an open-

be brief. A follow-up works better when emotions are

ended ‘not now’.”

high or the person has more positional power.

EXPECTED OUTCOMES AND NEXT STEPS

Have a short line ready. You do not need a speech.

• Constructive reaction: if leadership provides the band, explains the process and agree to a review

SCRIPT TEMPLATE

date, get confirmation in writing after the meeting.

In the moment:

• Avoidant reaction: if you are told it is complicated or confidential, narrow the ask. “What can you

“I want to pause that. I don’t think that comment

share about the criteria and range for this role?”

lands well.”

• Minimising reaction: if you hear that money should not be the focus. reframe calmly: “Pay is

Or: “I’d like to finish the point before we move on.”

one part of how responsibility is recognised. It is appropriate to discuss it.”

Or: “That was my recommendation from earlier. I’m glad we’re picking it up. Let’s take it forward from there.”

This constructive resolution is not just about getting a pay rise, it is a visible pathway and a decision process

For a follow-up:

you can hold people to.

“I want to raise something from the meeting. When

SCRIPT 3: ADDRESSING MICROAGGRESSIONS IN TEAM MEETINGS

I was interrupted and the discussion moved on, it

Use this when a comment, joke, interruption or

considered.

made it harder for my contribution to be properly

repeated behaviour undermines women’s authority or belonging.

“I’m not assuming that was your intention, but the impact was that my expertise was sidelined.

PREPARATION Write down the exact words or behaviour. Be specific.

“In future, I’d like you to let me finish and, if my point

“He was disrespectful” is harder to act on than “He

is picked up later, I’d appreciate it being attributed

repeated my point five minutes later and it was

properly. That keeps the discussion cleaner

accepted as his idea.”

and fairer.”

If the response is: “It was just a joke.”

I S S U E 31

WOMEN IN SECURITY MAGAZINE

11

“ If there is a gap, I’d like us to define it properly and agree what opportunity will let me close it.

If there isn’t a material gap, then I’d like to discuss the role, title and compensation that match the work I’m already doing.”

PREPARATION List your leadership evidence. Include outcomes, not just effort. Security leaders are often assessed on confidence, authority, crisis judgement, stakeholder trust and commercial awareness. So, map your experience to those areas.

Prepare for vague feedback such as: • “You’re not quite ready.”

• “We need someone more strategic.”

• “You need more exposure.”

• “The timing isn’t right.”

“I understand it may have been intended lightly. I’m talking about the impact in a professional setting.

Your job is to turn vague feedback into criteria, timing

Jokes that undercut someone’s credibility still affect

and sponsorship.

the room.”

SCRIPT TEMPLATE If the response is: “You’re being sensitive.”

“I’d like to discuss my progression into a leadership role.

“I’m being specific. The behaviour interrupted the discussion and affected those whose expertise was

“I’ve been operating beyond my current title in

heard. That is worth addressing.”

several areas: leading incident response discussions, managing stakeholder expectations, mentoring newer

EXPECTED OUTCOMES AND NEXT STEPS

team members and improving how we report risk.

• Constructive reaction: if the person acknowledges the issue and adjusts, thank them briefly. Do not

“I’m not asking for a general sense of whether I’m

over-reward basic respect.

‘ready’. I’m asking for a clear assessment against the

• Embarrassed reaction: if they apologise but become awkward, keep it simple: “Thanks. Let’s

leadership criteria. Where do I already meet the bar, and where is there a gap?

move forward.”

• Hostile reaction: if they deny, mock or retaliate,

“If there is a gap, I’d like us to define it properly and

document the pattern and consider taking the

agree what opportunity will let me close it. If there

issue to a manager, HR or formal channel. One

isn’t a material gap, then I’d like to discuss the role,

conversation may not be enough.

title and compensation that match the work I’m already doing.”

This constructive resolution is a meeting culture

12

where women’s contributions are heard, attributed

If the response is: “We need someone with more

and not quietly absorbed by louder voices.

gravitas,” respond with:

SCRIPT 4: NEGOTIATING FOR A LEADERSHIP ROLE

“Can we define what gravitas means in this role? If

Use this when you are ready for a leadership position

stakeholder influence or commercial judgement, I’m

but are being kept in a ‘trusted operator’, ‘support

happy to discuss evidence against each of those

person’, ‘second-in-command’, or ‘safe pair of

criteria. I don’t want us to use a criterion that feels

hands’ box.

meaningful but can’t be assessed fairly.”

W O M E N I N S E C U R I T Y M A G A Z I N E

it means executive presence, calm decision-making,

J U LY • A U G U S T 2026

F E A T U R E

If the response is: “You need more visibility,”

SCRIPT TEMPLATE

respond with:

“I’d like to challenge how we are measuring security performance.

“I’m open to building visibility. I’d like that to be intentional, not accidental. Which meetings, projects

“At the moment, the most visible metrics are

or stakeholders do I need access to, and who will

incidents, interventions, removals and response

sponsor that exposure?”

times. Those matter, but they don’t tell the whole story. They can also create a culture where

EXPECTED OUTCOMES AND NEXT STEPS

force looks like effectiveness, and prevention

• Constructive reaction: if your manager agrees to

becomes invisible.

assess you against criteria and identify a pathway, ask for timelines and decision owners.

• Vague reaction: if feedback stays fuzzy, keep

“A strong security outcome is often the thing that didn’t happen: the conflict that was defused; the

asking for examples: “What would you need to see

person who was redirected before a confrontation;

that you are not seeing now?”

the staff member who felt safe enough to report early;

• Gatekeeping reaction: if leadership agrees you

the risk that was spotted before it became a headline.

are valuable but will not define the path, that is information. You may need a sponsor, a transfer

“I’d like us to add de-escalation and prevention

or an external opportunity.

measures to our reporting. Not as soft metrics, but as risk-control metrics.”

This constructive resolution is a leadership pathway that is specific enough to act on. If it remains vague,

If the response is: “We need hard numbers,” reply with:

the vagueness is part of the answer.

SCRIPT 5: RE-FRAMING SECURITY METRICS TO VALUE DE-ESCALATION OVER PHYSICAL FORCE Use this when performance is being measured by visible interventions, removals, arrests, shows of force, or ‘hard’ incident response while prevention and de-escalation are treated as invisible.

PREPARATION Identify what is currently being rewarded. Then identify what good security prevents: injuries, reputational harm, customer distress, staff trauma, liability, downtime, escalation to police, media attention and repeat incidents.

Bring examples of incidents resolved through calm communication, early detection, environmental awareness or relationship-building. If de-escalation is not recorded, it is part of the problem.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

13

• Cultural resistance: if team members mock de-escalation as weakness., bring the discussion back to professionalism. “Force is sometimes necessary, but needing less of it is usually a sign of better control.”

This constructive resolution is a reporting model that values prevention, restraint, safety and judgement alongside response.

SCRIPT 6: RESPONDING WHEN YOUR EXPERTISE IS INTERRUPTED, REPEATED OR REBRANDED Use this when you make a point, it is ignored then someone else repeats it and receives credit.

PREPARATION Notice the pattern. Is it one person, a meeting dynamic or a culture where women are expected to contribute but not visibly lead?

Prepare a line that reclaims the point without sounding like you are asking permission. The aim is not to embarrass the other person. The aim is to correct the record.

“Agreed. We can count prevention work too. We can record de-escalation attempts, welfare checks,

SCRIPT TEMPLATE

early interventions, repeat-location risks, customer

In the meeting, say:

complaints avoided, and incidents resolved without force.”

“Yes, that connects with the recommendation I made earlier. I’ll build on it with the next step.”

If the response is: “That sounds too soft for security,” reply with:

Or: “I want to bring us back to my original point, because the risk issue is still unresolved.”

“De-escalation is not soft. It is disciplined control under pressure. If we value only force, we are

For a private follow-up with the chair or manager:

measuring the loudest part of security, not necessarily the most effective part.”

“I want to talk about how contributions are being handled in meetings.

EXPECTED OUTCOMES AND NEXT STEPS • Constructive reaction: if leadership agrees to

“Today I raised the issue of [specific issue]. It didn’t

broaden the dashboard, suggest a pilot for one

get traction until it was repeated later by someone

site, event, shift or reporting period.

else. That may not have been deliberate, but it affects

• Sceptical reaction: if the idea is treated as nice

whose expertise is seen.

but secondary, ask what current metrics miss and whether those blind spots create operational risk.

14

W O M E N I N S E C U R I T Y M A G A Z I N E

“I’d like you to help correct that in the moment.

J U LY • A U G U S T 2026

F E A T U R E

If I raise a point and it gets picked up later, I’d

PREPARATION

appreciate you saying, ‘That builds on Abigail’s earlier

Track the pattern over a few meetings or projects.

recommendation,’ or simply inviting me to continue.”

Assignment bias is easier to dismiss when it appears to be an isolated incident. It becomes harder to ignore

If the response is: “You should speak up more,” come

when you can show repeated occurrences.

back with: • Be clear on the changes you want: “I did speak up. The issue is not only whether I speak.

• Rotation of admin tasks.

It is whether the room recognises and uses the

• Fair assignment of visible work.

contribution when I make it.”

• Tasks matched to development goals.

• No assumption that women will handle

If the response is: “That happens to everyone,” say:

emotional labour.

“It may happen broadly, and I’m raising it because

SCRIPT TEMPLATE

there is a pattern here. If we want the best risk

“I want to raise how work is being allocated.

decisions we need to track where ideas come from, and not just who says them loudest.”

“I’ve noticed I’m often asked to take notes, coordinate follow-ups, smooth stakeholder issues or support

EXPECTED OUTCOMES AND NEXT STEPS

others, while higher-visibility operational work is going

• Constructive reaction: the chair starts attributing

elsewhere.

points and inviting you back into the discussion.

• Deflecting reaction: if you are told to be more

“Those support tasks matter. I’m not above them.

assertive, restate the difference between

But if they are repeatedly assigned to the same

assertiveness and recognition.

people, they affect development, visibility and

• Repeated pattern: if disregard of your

promotion readiness.

contributions continues, document examples and raise this as a meeting effectiveness issue, not

“I’d like us to rotate the support work and be more

just a personal frustration.

deliberate about who gets stretch assignments.

For this project, I’d like to lead [specific task

This constructive resolution is not about seeking

or workstream].”

applause, it is about accurate attribution and better use of expertise.

If the response is: “You’re good at it,” come back with:

SCRIPT 7: CALLING OUT ASSIGNMENT BIAS

“Thank you. I know I do it well. That’s exactly why we

Use this when women are repeatedly given note

need to be careful it doesn’t become a default role

taking, welfare, coordination, admin, mentoring or

that limits my exposure to other work.”

‘people smoothing’ tasks while men receive visible operational or strategic opportunities.

If the response is: “Everyone has to pitch in,” respond with:

" This constructive resolution is not about seeking applause, it is about accurate attribution and better use of expertise."

I S S U E 31

WOMEN IN SECURITY MAGAZINE

15

“Agreed. Pitching in should be shared. I’m asking for

• “Executive presence”

the pattern to be shared too.”

• “Fit”

EXPECTED OUTCOMES AND NEXT STEPS

These words are not always unfair, but they

• Constructive reaction: tasks are redistributed and

need definitions.

stretch work becomes more visible.

• Polite but unchanged reaction: if everyone agrees

SCRIPT TEMPLATE

in principle but nothing changes, follow up in the

“I’d like to make sure the promotion criteria are being

next allocation meeting, not weeks later.

applied consistently.

• Resentful reaction: if someone implies you are refusing teamwork, clarify by saying: “I’m asking

“I’ve heard that I’m ‘not quite ready’, but I need

for fair distribution, not exemption.”

to understand what that means in observable terms. Which part of the next-level role am I not

This constructive resolution is a work allocation

yet demonstrating?

pattern that does not quietly turn women into the team’s support infrastructure.

“I’d also like to compare that with the work I’m already doing: [name two or three examples].

SCRIPT 8: CHALLENGING PROMOTION GATEKEEPING AND ‘READINESS’ LANGUAGE

“If the standard is experience, let’s define the

Use this when promotion standards shift, feedback

experience. If the standard is leadership behaviour,

stays subjective or men are promoted on potential

let’s name the behaviour. If the standard is visibility,

while women are asked for more proof.

let’s agree who will create that visibility and by when.”

PREPARATION

If the response is: “You just need more time,”

Prepare a simple evidence table for yourself: criteria,

reply with:

evidence, gaps, next action. Bring examples of work that show you are already operating at the next level.

“Time by itself won’t close an undefined gap. What specifically should be different three or six months

Listen closely for subjective terms:

from now?”

• “Ready”

If the response is: “You need to be more confident,”

• “Polished”

reply with:

• “Strategic” • “Confident”

“Can you give me an example of where confidence was missing and what you would expect to see instead? I want feedback I can act on.”

“ Prepare a simple evidence table for yourself: criteria, evidence, gaps, next action. Bring examples of work that show you are already operating at the next level.”

EXPECTED OUTCOMES AND NEXT STEPS • Constructive reaction: feedback becomes specific, and a promotion pathway is agreed.

• Foggy reaction: if you receive language but no criteria, ask for examples in writing.

• Unfair standard becomes visible: if the bar keeps moving, name that carefully: “I’m concerned the criteria are shifting. I’d like us to document the standard we’re using.”

16

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

F E A T U R E

This constructive resolution is a promotion conversation with evidence, criteria and a decision date.

SCRIPT 9: RESPONDING TO BEING LABELLED ‘TOO AGGRESSIVE’ OR ‘NOT COLLABORATIVE’ Use this when directness, challenge or authority is being interpreted more negatively because it comes from a woman.

PREPARATION Separate style feedback from substance. There may be useful feedback inside the comment, but vague labels are not enough. Ask for examples, impact and an alternative behaviour that still allows you to lead.

Do not apologise for having a view. If you did interrupt, dismiss or speak harshly, own that specific behaviour. But do not accept a broad personality label without examination.

SCRIPT TEMPLATE “I want to understand the feedback properly.

“Discomfort can happen when risk is challenged.

“When you say I was ‘too aggressive’ or ‘not

I want to know whether the discomfort came from

collaborative’, can you point to the specific behaviour

my behaviour or from the issue being raised. Those

you mean? Was it my tone, the timing, the fact that I

are different.”

challenged the recommendation or something else?

EXPECTED OUTCOMES AND NEXT STEPS “I’m open to adjusting how I communicate. I’m not

• Constructive reaction: if the feedback

open to losing the ability to challenge risk decisions

becomes specific and usable., agree to adjust

clearly. That is part of my role.

behaviour where reasonable while keeping your authority intact.

“What would strong, direct challenge look like to you in that situation?”

• Gendered double standard becomes clearer: if similar behaviour from men is accepted, raise consistency: “I’d like the same standard applied

If the response is: “It’s just how you came across,” respond with:

across the team.”

• Label sticks without evidence: document the conversation and seek a second view

“I hear that, but I need more than an impression if I’m

from a sponsor, mentor, HR partner or trusted

expected to change something. What did I say or do

senior leader.

that created that reaction?”

This constructive resolution is feedback that If the response is: “You made people uncomfortable,”

improves communication without punishing women

respond with:

for being clear.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

17

SCRIPT 10: REFRAMING INCIDENT DEBRIEFS SO WOMEN ARE NOT BLAMED FOR SYSTEM FAILURES

SCRIPT TEMPLATE “I want this debrief to be useful, so I’d like us to look beyond the final moment of the incident.

Use this when an incident review focuses on one person’s actions while ignoring staffing, training,

“The decision made on the floor matters, and I’m

equipment, process, rostering, role clarity, client

prepared to discuss it. But if we only focus there,

pressure or leadership decisions.

we may miss the system conditions that shaped the outcome.

PREPARATION Write down the timeline. Include decisions made

“We should also look at staffing levels, role clarity,

before the incident, resourcing constraints, escalation

escalation options, client instructions, training,

points and what information was available at the

communication channels and whether the team had

time. Avoid making it personal, even if the review

enough authority to act earlier.

feels personal.

“My concern is that, if we frame this as an individual Prepare to move the conversation from blame

failure, we may think we’ve solved it without actually

to learning.

reducing the risk.”

A useful question would be:

If the response is: “Someone has to be accountable,” respond with:

“What would have needed to be true for a better outcome to be more likely?”

“Accountability matters. I’m asking for complete accountability, not narrow accountability. That means looking at the person, the process and the leadership conditions around the decision.”

If the response is: “Don’t make excuses,” respond with: “I’m not trying to remove responsibility. I’m trying to understand cause. If we confuse cause analysis with excuse-making, we will keep repeating the same issue.”

EXPECTED OUTCOMES AND NEXT STEPS • Constructive reaction: the debrief expands to include system factors and preventive actions.

• Blame-focused reaction: if leadership pushes for a simple culprit, keep returning to risk reduction: “What change will prevent recurrence?”

• Political reaction: if people avoid naming seniorlevel decisions, document the unanswered questions and ask that they be included in the debrief record.

This constructive resolution is an incident review that improves the system, not just one that finds someone to carry the discomfort.

18

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

F E A T U R E

A CLOSING LINE FOR ALMOST ANY DIFFICULT CONVERSATION When the room gets tense, this line can bring people back.

“I’m not asking Confidentiality block

“We can’t talk about that.”

I’m raising it because the current pattern is already

Reaction

sound like

response

criteria that apply

“Fine, I’ll

what I’m asking

Retaliatory

never say

for. I’m asking

awkwardness

anything

for a more

again.”

professional

QUICK REFERENCE: WHEN SOMEONE REACTS BADLY

A steady

asking for the

“That’s not

hard, just not equally hard for everyone.”

What it may

information. I’m

to this role.”

“I’m not raising this to make the conversation harder.

Then pause. Silence can do some of the work.

for private

standard.”

False agreement

“Sure, we’ll keep it in mind.”

“Thank you. What will change, and when should we review it?”

“I’m not debating Denial

“That’s

intent. I’m

not what I

naming the

FINAL REMINDER

meant.”

impact so we

A courageous conversation does not have to be

can address it.”

dramatic. Sometimes it is just one woman refusing to

“It may happen Deflection

“This

broadly. I’m

happens to

raising the

everyone.”

pattern I’m

let a vague comment pass as a fair process.

The aim is not to win the room in one sentence.

The aim is to move the standard.

seeing here.”

“You’re Minimising

overthinking it.”

“I’m being specific, because the impact is practical.”

“I’m open to

“You need Tone-policing

to say it differently.”

discussing delivery. I also want us to stay with the substance.”

" A courageous conversation does not have to be dramatic.

Sometimes it is just one woman refusing to let a vague comment pass as a fair process.

“Then let’s separate Budget excuse

“There’s no

recognition,

money.”

timing and the decision pathway.”

I S S U E 31

The aim is not to win the room in one sentence. The aim is to move the standard.”

WOMEN IN SECURITY MAGAZINE

19

AMANDA-JANE TURNER Adjunct Lecturer School of Social Science (Cyber-Criminology) Cybercrime is big business, thanks to technical advancement and interconnectivity creating more opportunities. This regular column will explore various aspects of cybercrime in an easy-to-understand manner to help everyone become more cyber safe.

C O L U M N

Staying safe from cybercrime: more than not clicking links When people think about cybersecurity awareness,

It should help people pause when something feels

the same advice tends to surface: don’t click

slightly off, even if it looks legitimate on the surface.

suspicious links, watch for poorly written emails, be

It should give them practical ways to verify requests,

cautious with unexpected attachments.

especially when they arrive through less scrutinised channels like phone calls or in-person interactions.

It is still good advice. It is just no longer enough.

Just as importantly, it needs to create an environment Cybercrime has evolved well beyond obvious

where checking is encouraged.

phishing attempts. AI-generated content, convincing impersonation, and phone-based social engineering

Employees should feel confident pausing a request

have shifted the landscape. Today, an employee can

and asking for validation, whether that means calling

be manipulated into sharing sensitive information

back through an official number, confirming with a

or authentication codes without ever seeing a

colleague, or reaching out to a security team. That

suspicious email.

moment of hesitation is often the difference between a near miss and an incident.

The risk no longer sits neatly in an inbox.

There is no loss of credibility in verifying something.

Criminal groups are refining their approach. They

There is risk in assuming it is safe.

study behaviour, mimic legitimate interactions, and exploit moments of pressure or routine. A call that

Awareness programmes need to reflect this shift.

sounds like IT support. A message that appears to

They should move beyond teaching people what

come from a trusted supplier. A request that feels

to avoid, and instead focus on how to think, how to

familiar enough not to question.

question, and when to slow down.

The methods change. The intent does not.

Because the most effective attacks no longer rely on obvious mistakes.

This is where traditional awareness programmes can fall short. Static training modules and occasional

They rely on trust, familiarity, and just enough urgency

phishing simulations still have a role, but they tend

to stop someone asking one more question.

to focus on patterns that are becoming easier to spot and easier for attackers to avoid.

If awareness stops at “spot the

And often, that is the question that matters most. www.linkedin.com/in/amandajane1

obvious,” it leaves a gap. www.empressbat.com

Effective cyber awareness now needs to build judgement, not just recognition.

20

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

WHAT’S HER JOURNEY?

More than a decade later, her passion for cyber remains as strong as ever. Rather than specialising narrowly, Rachel has intentionally sought out diverse experiences across different cyber streams, technologies and products.

“What has kept me interested over more than 10 years in cyber is deliberately taking on different cyber streams and products. I try to not stay in one stream of work within cyber. Each new stream brought a different set of technologies and stakeholders and that variety kept the work engaging. As the threat landscape itself keeps evolving, there is always something new to learn and something important to defend.”

Rachel Choong Cyber Security Senior Project Manager

Her transition into cybersecurity was far from conventional. After building strong project management credentials including PMP, Certified Scrum Master, PRINCE2 and Scaled Agile certifications an unexpected opportunity emerged.

F

“My transition from digital into cyber security was not something I planned. It happened because I or Rachel Choong, cybersecurity was never

speak several languages and a global cyber security

part of a carefully mapped career plan.

program needed a project manager who could work

Instead, her journey unfolded through

effectively with Asian teams. That language and

curiosity, opportunity and an unwavering

cultural capability opened a door that pure technical

commitment to delivering outcomes.

skills would not be sufficient.”

Today, as a Cyber Security Senior Project Manager, she sits at the intersection of technology, leadership

Thrown into complex cyber programs involving data

and security proving that some of the most impactful

centres, identity access management and forensic

careers are built not by following a script, but by

solutions, Rachel had no formal cybersecurity

saying yes to challenges others avoid.

background. What she did possess, however, was curiosity, determination and a willingness to learn.

Rachel entered cybersecurity through project

22

management, bringing with her a talent for delivering

“I spent long hours at work learning and delivering at

complex technology programs. It was a skillset that

the same time; they were genuinely interesting hours.

naturally aligned with an industry increasingly tasked

That curiosity, that willingness to push myself into

with protecting the very systems organisations

something unfamiliar, learning and support from the

rely upon.

global team, was what carried me through.”

“I came into cybersecurity through project

Her commitment to lifelong learning has remained a

management; I was good at delivering complex

defining feature of her career. Studies in Leadership

technology programs and that naturally led me to the

Principles at Harvard Business School, AI in

intersection of what organisations were building and

Healthcare at Stanford, and AI Security Specialist

what they needed to protect.”

training reflect a philosophy she continues to live by.

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

W H A T ’ S

H E R

J O U R N E Y ?

“I believe in staying relevant. That mindset of

Like many entering cybersecurity, Rachel experienced

proactive learning has been one of the most

moments of uncertainty. Without a formal cyber

consistent decisions of my career, even when

background, the steep learning curve could easily

managing my projects day to day.”

have become a barrier. Instead, she chose to see it as an opportunity.

While cybersecurity is often viewed as a technical profession, Rachel believes its greatest challenges

“When I first entered cybersecurity, I had no formal

are deeply human. Across complex, high-pressure

background in it, the projects were complex, the

environments, she has learned that success is less

learning curve was steep, and there was uncertainty if

about technology and more about people.

I could deliver. What carried me through was choosing to see things differently. I embraced a growth mindset

“Technical problems have solutions. Most of the

and saw the difficult projects as opportunities to

security architects I worked with were experts in

shape my future.”

solutioning. Human complexity is different.”

She views cybersecurity not merely as a profession, Her leadership philosophy centres on trust, belonging

but as a responsibility.

and psychological safety principles she believes separate high-performing teams from average ones.

“I see being in cybersecurity as a kind of good fortune, like a guardian protecting organisations

“What I have learned and what I genuinely believe

and the communities from threats. I have strong

separates great teams from average ones, is that

self-awareness that the work is hard, but my work is

performance is more than just about competency.

shaping a better future.”

It is about the environment. You can hire the most technically brilliant people in the room and still have

Rachel’s career has continued to evolve organically,

an underperforming team if the environment does not

driven by delivery and trust rather than predetermined

support them.”

titles. One recent achievement involved establishing a hybrid SOC team and implementing a new SIEM

Throughout her career, Rachel has repeatedly

platform under significant time pressure, earning

transformed struggling teams into thriving ones by

praise from senior executives.

placing people first.

Yet when asked what advice she would offer the “I treat people like they matter, because they do. When

next generation, her focus shifts firmly away from

people feel disrespected, they disengage. When they

technical capability.

feel valued, acknowledged, and seen, even something as simple as communicating if they perform a job

“My advice to my high school self and to any young

well, their motivation changes completely.”

person entering cyber security today, starts with something that does not appear in any curriculum:

For Rachel, leadership is not about perfection but

develop your emotional intelligence and your

about unlocking potential.

soft skills.”

“There is no such thing as a perfect team. There

She believes human skills are increasingly becoming

will always be problems. But if you align people to

cybersecurity’s greatest differentiator.

a shared goal, look for the strengths each person brings, stay optimistic, and work as one team, you can

“Your technical skills will get you a job. Your human

bring out things in people they did not know they had.”

skills will keep you there.”

I S S U E 31

WOMEN IN SECURITY MAGAZINE

23

As a people leader, Rachel sees communication and

“The 54 leaders I interviewed for my book shaped

stakeholder management as critical skills for future

me more than I expected. The book was purely an

cyber professionals.

act of giving back and using my strengths which is listening.”

“The most common gap I see in cyber security professionals is not technical. It is the ability to

The experience reinforced her belief that leadership

translate complex risk into language that a board,

and cybersecurity are inseparable.

an executive team, or a non-technical colleague can understand and act on.”

“I was not brought into the CISO’s most critical programs because I was the most technical person

She also advocates strongly for project management

in the department. I was brought in because I deliver,

skills and emerging knowledge areas such as

which means I can lead people, manage complexity,

AI governance.

navigate stakeholders, and get things done under pressure. That is leadership applied to cyber security.”

“The professionals who stay ahead are the ones who built the habit of learning continuously.”

At the heart of Rachel’s career lies a strong sense of purpose.

Looking ahead, Rachel sees artificial intelligence as the defining force shaping cybersecurity.

“I make no money from the book. And I find genuine joy in the work. That is my higher purpose. Achieving

“AI is the biggest shift since the industrial revolution.

something meaningful and having fun along the

The question for every professional, every

way. If I can help uplift even one person out there to

organisation, every leader right now is not whether to

become a better leader, I declare that a victory.”

engage with it. It is whether you are going to ignore it or make something good out of it.”

That same philosophy extends to the way she approaches work-life balance. Through meditation,

She believes AI presents both unprecedented

small habits and deliberate recovery, she prioritises

opportunities and risks.

sustainability in an industry known for its intensity.

“AI is both the greatest defensive tool we have, and

“The same philosophy applies to burnout prevention.

the most powerful weapon threat actors have ever

Do not wait until you are depleted to rest. Build

been given. That duality is what makes this moment

recovery into the routine. Sustainability is a strategy,

so critical.”

not a luxury.”

From sophisticated phishing campaigns to deepfakes

For Rachel Choong, cybersecurity has never been

and voice cloning, Rachel believes organisations must

solely about technology. It is about people, leadership

rapidly adapt their security awareness strategies.

and creating environments where others can thrive.

Her journey demonstrates that while technical

“Voice cloning means that hearing someone’s voice is

expertise may open doors, it is empathy, resilience

no longer verification of their identity.”

and purpose that create lasting impact.

Beyond cybersecurity itself, one of Rachel’s proudest

And perhaps her most powerful message is the

achievements has been interviewing 54 senior

simplest: come as you are, keep learning, and use

leaders for her book, 54 Inspired Leaders. What began

your strengths to lift others along the way.

as an act of giving back became an extraordinary learning experience.

24

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/rachel-choong-80160014b

J U LY • A U G U S T 2026

SOURCE2CREATE.COM.AU

AISA.ORG.AU

IS NOW AISA'S NEW PUBLISHING PARTNER Click here to read the newest edition of Cyber Today

Wendy Ngcongo Cybersecurity Architect | Data | Cloud | AI

“I was always curious about how things worked, and that curiosity introduced me to computers,” Wendy says. “I remember being fascinated by the simple ability of a computer to type a document, save it,

W

and retrieve it later. Coming from an underprivileged background, that felt powerful to me.” endy Ngcongo’s path into cybersecurity was never linear, but

That moment was simple on the surface. It was

it was always deliberate.

enough to pull her further in.

“My journey into cybersecurity has

Ngcongo began working with computer and cellphone

not been a straight line, but it has

repairs. It was hands-on, sometimes messy, and

been deeply intentional,” she says.

exactly what she needed.

Born in Izingolweni, a small and underprivileged

“That practical exposure revealed something

community in KwaZulu-Natal, South Africa, Wendy

important about me: I was drawn to how systems

spent her early years there before later being raised in

connect,” she explains.

Durban, where her journey began to expand through education, exposure, and mentorship.”

That realisation led her into networking, where the bigger picture started to form.

“She instilled in me the importance of education,

26

discipline, and learning a skill,” Ngcongo reflects.

“Networking helped me understand how devices

“She taught me that growth requires effort, and that

communicate, how data moves, and how

education can open doors far beyond the environment

infrastructure supports the digital services people rely

you come from.”

on every day.”

That sense of possibility first showed up as curiosity.

From there, the transition into cybersecurity felt less

Not a grand career plan. Just questions.

like a pivot and more like a continuation.

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

W H A T ’ S

H E R

J O U R N E Y ?

“Once you understand how systems connect, you also begin to understand where they can be exposed, misconfigured, attacked, or protected,” she says.

“Networking became the bridge between my early technical curiosity and the cybersecurity work I do today.”

Along the way, mentorship played a quiet but important role. A lecturer from the Durban University of Technology offered guidance that sharpened her focus and discipline.

“That mentorship exposed me to the value of guidance, discipline, and learning from people who

“Many people think they need to know everything before they begin.

My experience has taught me the opposite. You grow by building strong foundations, asking questions, practising consistently, and allowing your path to unfold with discipline and patience.”

had already walked ahead of me.”

Wendy continued to build on that foundation through

Still, the journey hasn’t been without doubt. There

formal studies and ongoing certifications, expanding

were moments where stepping into certain rooms

her scope beyond technical execution into cloud, data,

felt uncertain.

and governance. Each layer added context. Each step made her thinking broader, not just deeper.

“There were moments where I questioned whether I was ready for certain spaces,” she admits. “Those

“One of the most important lessons I have carried

moments taught me that confidence is built through

from networking into cybersecurity is that security

preparation, exposure, and the willingness to

is shaped long before an incident occurs,” she says.

keep growing.”

“The way systems connect, the way traffic moves, the way access is granted, and the way environments

It’s a sentiment that sits in contrast to the common

are monitored all influence how resilient an

assumption that people need to “arrive” before

organisation becomes.”

they begin.

It’s a perspective that now defines her work as a

“Many people think they need to know everything

cybersecurity architect. Security, for her, isn’t reactive.

before they begin. My experience has taught me the

It’s designed.

opposite. You grow by building strong foundations, asking questions, practising consistently, and allowing

“Cybersecurity is not only a technical function, but an

your path to unfold with discipline and patience.”

architectural and operational responsibility.”

Today, Wendy sees cybersecurity as one of the Consulting has become a natural extension of that

defining fields of this era, shaped by rapid digital

mindset. She works closely with organisations to

transformation and shifting risk landscapes.

translate technical complexity into something more usable, something that informs real decisions.

“Organisations are becoming more digital, cloud adoption is increasing, AI is changing how businesses

“I enjoy helping organisations understand technical

operate, and cyber threats are becoming more

risk in a practical way, especially where security

sophisticated,” she says. “Security professionals

decisions influence operations, resilience, and long-

must think beyond tools and understand how risk,

term business confidence.”

architecture, and people influence security outcomes.”

I S S U E 31

WOMEN IN SECURITY MAGAZINE

27

Looking ahead, she is clear about where the pressure points will sit.

“Cybersecurity will be heavily shaped by AI-driven threats, cloud security, identity protection, data privacy, and operational resilience,” she says.

“Attackers are becoming faster, more automated, and more creative.”

But with that complexity comes a shift in responsibility.

“There is no single path into this field. Some people enter through IT support, networking, software development, audit, risk, governance, cloud, or data. What matters is not where you start, but how intentionally you build.”

“This is where cybersecurity becomes more than a technical career. It becomes a

She’s also quick to challenge the idea of a single

leadership responsibility.”

entry point.

For Wendy, the most meaningful part of her work

“There is no single path into this field. Some people

isn’t just solving problems. It’s helping reshape how

enter through IT support, networking, software

organisations think.

development, audit, risk, governance, cloud, or data. What matters is not where you start, but how

“I find purpose in helping security become

intentionally you build.”

clearer, more practical, and more connected to business decisions.”

For women stepping into cybersecurity, she keeps it simple.

And when it comes to those considering the field, especially women, her advice is steady and grounded.

“Stay curious, build the foundation, and allow your voice to grow with your journey.”

“Build the foundation first. Learn networking, understand how systems connect, and do not rush to

Her own journey is still unfolding, shaped by

look advanced before you understand the basics.”

each decision, each lesson, each stretch into something new.

“My journey is still unfolding, but I am grateful for every step,” she says. “Cybersecurity has challenged me, stretched me, and given me opportunities to contribute to something bigger than myself.”

At its core, that’s what continues to drive her.

“At the heart of my journey is a desire to help build safer digital environments and to inspire others to believe that they too can grow into meaningful, impactful roles in this industry.”

www.linkedin.com/in/wendy-ngcongo-455035155

28

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

EXCLUSIVE

ADVERTISING PACKAGE For the past four years, Source2Create has proudly delivered Women in Security Magazine to the industry free of charge, championing diversity, inclusion, and the incredible contributions of women in cybersecurity. As we continue to grow, we now need partners to help us sustain and expand this vital platform.

By supporting this package, you’re not just backing us—you’re investing in the magazine, its community, and the future of women in security.

To ensure we can keep delivering this high-value publication, we’re introducing a nominal fee for $900 Ex GST, an exceptional package that provides extensive coverage and visibility.

WHAT'S INCLUDED? OFFICIAL PARTNER RECOGNITION Your logo will be prominently displayed at the beginning of the magazine in our “Partner of the Issue” panel.

GLOBAL AUDIENCE REACH Your brand will be seen by 5,000+ global subscribers through our free, bi-monthly digital publication, dedicated to supporting and showcasing women in security.

2 FULL-PAGE ADVERTS Feature your brand in two issues of your choice between March and December.

2 JOB POSTINGS Advertise up to two job opportunities in the magazine and across our social media platforms, reaching a highly engaged cybersecurity audience.

ONLINE BANNER ROTATION on WomenInSecurityMagazine.com

This high-value package ensures maximum visibility for your brand while directly supporting the continuation of Women in Security Magazine.

Join us in making an impact—partner with us today!

EMAIL JANE@SOURCE2CREATE.COM.AU

threat landscape shifts, the technology changes, the regulatory environment moves and you have to move with it.”

Samantha Finan Independent CISO

Over the years, Samantha’s own perspective evolved alongside the profession itself. What was once considered a backoffice IT function has transformed into a board-level priority, placing security leaders at the centre of business strategy.

C

“What started as a happy accident has become something I’m deeply passionate about,” she says. ybersecurity was never part of Samantha

“My own interest mirrors that journey: from the

Finan’s master plan. In fact, as she

technical and operational nuts and bolts early on, to

reflects on her career today as an

now thinking about how security enables business

Independent CISO with more than two

strategy and how you quantify and communicate risk

decades of experience, she is the first to

at the highest levels of an organisation.”

admit that the industry found her rather than the other way around.

Early in her career, Samantha embraced opportunities before feeling entirely ready. Working in Access

“Honestly, I completely fell into it and I mean that in

Control at SBC Warburg and later expanding her

the best possible way,” she says. “When I emigrated

expertise at Dresdner and Standard Chartered, she

back to the UK from Canada, I needed to find my

built her knowledge through hands-on experience

footing in a new job market, and cybersecurity found

while investing in professional development.

me more than I found it.”

“I didn’t wait to feel completely ready before stepping What began as an unexpected career move quickly

into bigger roles,” she says. “I also invested in my

evolved into a lifelong passion. For Samantha, the

credentials early.I first achieved my CISSP back

dynamic nature of cybersecurity became impossible

in 2002, which at the time was a real marker of

to resist. The ever-changing threat landscape,

seriousness in the field.”

emerging technologies and shifting regulations ensured there was always something new to learn.

That blend of practical experience and formal certification became a powerful foundation.

30

“There is genuinely never a dull moment,” she

Yet Samantha believes curiosity has been

explains. “The field is constantly evolving, the

equally important.

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

W H A T ’ S

H E R

“There came a point where I became more intentional about the kind of leader I wanted to be and the culture and standards I wanted to set. That intentionality around leadership has become just as central to who I am professionally.”

J O U R N E Y ?

Her path to leadership unfolded organically rather than through rigid career planning.

“I had no five-year plan that involved becoming a CISO,” Samantha says. “For a long time I was focused on doing the current job really well rather than plotting the next three moves.”

Instead, she followed challenging problems wherever they emerged, particularly in identity and access management long before identity security became a boardroom issue.

“I think there’s real value in being genuinely engaged

“Cybersecurity rewards people who ask ‘but why?’ and

with the work in front of you, rather than always

‘what if?’ constantly,” she says.

looking over your shoulder at the career ladder,” she reflects.

Like many leaders in the industry, Samantha’s journey has not been without moments of self-doubt. Without

As her career progressed into Managing Director

a traditional computer science background, she

roles, her focus shifted beyond technical excellence to

sometimes questioned whether she belonged in

leadership and culture.

the field.

“There came a point where I became more intentional “There were absolutely moments of imposter

about the kind of leader I wanted to be and the culture

syndrome particularly when stepping into more senior

and standards I wanted to set,” she says. “That

roles or presenting to increasingly senior audiences,”

intentionality around leadership has become just as

she says.

central to who I am professionally.”

Rather than focusing on what she lacked,

Today, one of the most complex challenges

Samantha leaned into the strengths she brought to

Samantha tackles is the safe adoption of artificial

the profession.

intelligence. In her current work, she has been developing security frameworks and guardrails for AI

“What helped me was focusing on what I did bring:

and generative AI technologies.

strong communication skills, an ability to see the bigger picture, genuine curiosity, and a real

“The technology is moving so fast that the risk

commitment to understanding the business context

landscape is shifting almost in real time,” she

of security, not just the technical side.”

explains. “You’re trying to enable innovation while managing real data protection, access and

She also found strength in the cybersecurity

model risks.”

community itself.

Her approach is rooted in collaboration rather “People in this field tend to be generous with their

than restriction.

knowledge and time,” she says. “Leaning into that community rather than trying to go it alone made a

“If you just say ‘no’ to everything, you lose credibility

huge difference.”

and people go around you,” she says. “Understand

I S S U E 31

WOMEN IN SECURITY MAGAZINE

31

the tools deeply, engage with the business on what they’re actually trying to achieve, and build practical guardrails that protect without paralysing them.”

Looking ahead, Samantha sees AI reshaping cybersecurity on both sides of the equation.

“Both cybercriminals and cybersecurity teams are racing to leverage AI, and the arms race is intensifying

“Cybersecurity needs people who can think critically, communicate clearly, understand human behaviour and navigate organisations.”

rapidly,” she says. “AI-powered detection and response will become genuinely transformative, but the risks are real and growing.”

That influence continues through Samantha’s own commitment to mentorship. Five of the people

Among the emerging threats that concern her most

she has mentored have gone on to become CISOs

are AI-enabled attacks, identity-based threats and

themselves, a legacy she values deeply.

growing geopolitical tensions.

“I hope I gave them some fraction of what Wendy “None of these are entirely new,” she says, “but their

gave me,” she says.

scale, sophistication and speed are escalating in ways that demand constant vigilance.”

For the next generation considering a cybersecurity career, Samantha’s advice is simple but powerful.

When reflecting on the people who shaped her career, one name stands above all others: Wendy Nather.

“Don’t wait until you feel ready,” she says.

“Cybersecurity needs people who can think critically,

“Without question, Wendy Nather took a chance

communicate clearly, understand human behaviour

on me early in my career, and I genuinely haven’t

and navigate organisations.”

looked back since,” Samantha says. “The fact that she saw potential in me and gave me an opportunity

Her own journey proves exactly that. From an

when I was finding my feet shaped not just my

accidental introduction to cybersecurity to becoming

career trajectory but also the kind of leader I’ve tried

a trusted boardroom advisor and Independent CISO,

to become.”

Samantha Finan’s career demonstrates that there is no single path into the profession. Curiosity, courage, community and continuous learning can open doors that no carefully constructed plan could ever predict.

And perhaps her greatest lesson is one that resonates far beyond cybersecurity itself: success is rarely achieved alone.

“Find your people early,” she says. “The mentors, the colleagues, the community. This is not a field where you succeed alone, and the relationships you build will shape your career in ways you can’t predict.”

www.linkedin.com/in/samantha-finan

32

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

delayed security integration created operational friction, increased risk exposure and impacted business confidence.”

That experience ignited a passion to change the narrative.

“I wanted to contribute toward building security practices that support sustainable production environments while enabling business growth and innovation,” she says.

Nagammai Shanmugham CISO Standard Chartered

Over time, her interests expanded far beyond infrastructure and operational security into areas including Governance, Risk and Compliance (GRC), Identity and Access Management (IAM), Cloud Security, Security Operations Centre (SOC) functions and Application Security.

Today, her philosophy is clear.

N

“I view cybersecurity not as a control function alone, agammai Shanmugham, was never

but as a business enabler that builds trust, resilience

simply about protecting systems.

and long-term organisational value.”

It was about transforming the way organisations think about security itself.

Her rise into cybersecurity leadership was driven by deliberate and continuous learning. Recognising the

Today, Nagammai serves as Vice

multidisciplinary nature of the profession, Nagammai

President, Identity & Access Management SME in the

invested heavily in building both technical and

CISO Organisation for Group Functions at Standard

governance expertise. Alongside certifications such

Chartered, where she leads strategic initiatives that

as CISSP, Certified CISO, ISO 27001 Lead Auditor and

enhance identity security, enable business resilience,

Implementor, SCJP and CCNP Route & Switch, she

and foster trust in an evolving digital landscape.

pursued a Post Graduate Diploma in Cyber Law and Cyber Forensics.

She started her career working closely with enterprise systems and production environments, gaining

Her learning journey continues even today as

firsthand insight into the realities of business

she undertakes a Master’s program in Artificial

operations. It was during these formative years that

Intelligence and Machine Learning with MLOps as

she observed a challenge that would ultimately define

an elective.

her professional mission.

“I strongly believe cybersecurity professionals must “I witnessed several situations where information

evolve alongside emerging technologies,” she says.

security was perceived as a blocker to business

34

productivity rather than a strategic enabler,”

Beyond formal qualifications, practical

Nagammai recalls. “One particular real-world

experimentation became an essential part of

incident deeply influenced my thinking. I saw how

her growth.

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

W H A T ’ S

H E R

J O U R N E Y ?

“I consistently worked on personal design and development initiatives to sharpen my practical skills and stay relevant in a rapidly evolving industry.”

Leading cybersecurity in the banking and financial services sector brings unique challenges. The rapid pace of cloud adoption, AI integration, automation and digital transformation means security leaders

“Most importantly, I would remind myself that authenticity matters.

There is no single perfect path into cybersecurity.”

must constantly balance competing priorities.

“One of the most challenging aspects of leadership

“I consciously chose not to allow temporary setbacks

in cybersecurity within the BFSI sector is balancing

to divert me from my long-term vision. Instead, I

security, compliance, innovation and business agility

focused on strengthening my technical capabilities,

simultaneously,” Nagammai explains.

leadership skills and industry knowledge.”

Yet for her, the challenge extends beyond technology.

Communities also played a vital role in her development. Through mentorship and involvement

“The challenge is not only technical, it is also cultural

in professional networks, she found both support

and strategic. Security leaders must communicate

and purpose. In particular, Toastmasters became a

risk in a language business stakeholders understand

transformative experience.

and ensure that security becomes part of decision-making from the beginning rather than

“Public speaking and mentoring others allowed me to

an afterthought.”

reflect on my own journey and recognise the impact I could create beyond technical contributions alone.”

Her approach to overcoming complexity centres on collaboration, trust and mentorship.

If she could speak to her younger self, her advice would extend beyond technology.

“I strongly believe in enabling teams rather than operating through fear-based security models,”

“I would tell my younger self that cybersecurity is

she says. “Building trust with stakeholders and

not just about technology it is about people, trust,

demonstrating how cybersecurity contributes to

communication, resilience and continuous learning.”

resilience and business continuity has helped me navigate complex environments successfully.”

She also emphasises the value of leadership and authenticity.

Like many professionals, Nagammai has faced moments of uncertainty throughout her career.

“Technical expertise is important, but the ability to

Cybersecurity is a field that demands constant

influence, collaborate and inspire others is what

adaptation, and periods of transition can challenge

truly accelerates long-term success,” she says.

even the most experienced practitioners.

“Most importantly, I would remind myself that authenticity matters. There is no single perfect path

“Cybersecurity is a demanding field that requires

into cybersecurity.”

constant adaptation, and there were moments where the path ahead seemed unclear,” she reflects.

Looking to the future, Nagammai believes artificial intelligence will reshape the cybersecurity

What kept her moving forward was a commitment to

landscape in profound ways. AI-powered threat

growth and a refusal to let setbacks define her future.

detection, predictive analytics and adaptive security

I S S U E 31

WOMEN IN SECURITY MAGAZINE

35

architectures will become increasingly central to

ideas, influencing audiences and inspiring others

enterprise security strategies.

through storytelling and mentorship.”

“At the same time, the convergence of AI, cloud

Yet perhaps the most meaningful aspect of her work

computing, identity security and zero trust

lies in helping others succeed.

frameworks will redefine enterprise security models,” she explains.

“I draw inspiration from mentoring early-career professionals and helping them realise their true

She also believes cybersecurity’s place in the

potential,” she says. “Seeing others grow through

boardroom will continue to strengthen.

guidance and encouragement has been one of the most rewarding aspects of my journey.”

“Cybersecurity is no longer viewed purely as an IT responsibility; it is becoming a business-critical

While industry recognition such as the SheLeads

leadership function.”

CyberAI Award and the Chanakya Award have been significant milestones, Nagammai measures

However, emerging threats continue to evolve just

success differently.

as rapidly. Nagammai points to AI-powered attacks, sophisticated social engineering, deepfakes and AI-

“The true fulfillment comes from knowing that my

generated phishing campaigns as some of the most

work contributes to a safer and more empowered

pressing risks organizations will face.

digital ecosystem.”

“The challenge will not only be technological but also

Amid the demands of cybersecurity leadership, she

related to governance, visibility and skilled talent

remains intentional about maintaining balance. Family

availability,” she warns.

time and moments of reflection are essential to sustaining long-term success.

Among the greatest influences on her journey have been professional communities and a lifelong

“One practice that helps me maintain balance is

commitment to learning. Her involvement with

listening to spiritual music during my personal time,”

cybersecurity organisations and Toastmasters has

she shares. “It gives me a sense of calm, grounding

helped shape her into the leader she is today.

and divine connection.”

“Toastmasters helped me transform from a technical

Her philosophy on leadership and life is simple

professional into someone capable of articulating

yet powerful.

“Sustainable success comes not from constant pressure, but from maintaining clarity, discipline and inner stability.”

Nagammai Shanmugham’s journey is a testament to the power of lifelong learning, purposeful leadership and the belief that cybersecurity is not merely about protecting systems, it is about building trust, empowering people and shaping resilient futures.

www.linkedin.com/in/nagammai-shanmugham

36

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

DO YOU WANT TO CONTRIBUTE? EDITORIAL THEMING & DEADLINES MONTH

THEME

EDITORIAL SUBMISSION

ISSUE LIVE

SEPT / OCT 2026 ISSUE 32

UNLEASHED

SEPTEMBER 3RD

OCTOBER 24TH

NOV/DEC 2026 ISSUE 33

UNCHARTED TERRITORY

NOVEMBER 14TH

DECEMBER 19TH

Send submissions to: JANE@SOURCE2CREATE.COM.AU

WOMENINSECURITYMAGAZINE.COM

Her transition into the field was driven by intentionality. Rather than consuming information broadly, she focused on building practical capability in areas that directly translated to real-world impact.

“The turning point for me was deciding to move from passive learning to structured building,” she says. “I stopped consuming information randomly and started focusing on areas that would actually translate into professional capability.”

That shift led Stephanie to develop tangible projects such as risk assessments, compliance

Stephanie Uzama GRC Analyst and Consultant

documentation and governance frameworks that mirrored the realities organizations face every day.

She deliberately aligned her learning, writing and portfolio with the type of work she wanted to pursue.

“Clarity made a huge difference,” she reflects. “I began aligning my learning and projects to reflect the kind of

F

roles I actually wanted, instead of staying broad.” or Stephanie Uzama, cybersecurity was

Like many professionals entering cybersecurity,

never part of a grand career plan. Instead,

Stephanie experienced moments of uncertainty. The

it began with something far simpler

field can appear vast, highly technical and difficult

than curiosity.

to navigate, especially for those transitioning from another industry.

Coming from a healthcare background,

Stephanie was already familiar with environments

“There’s always that internal question asking whether

where precision, trust and accountability mattered

you are catching up fast enough or if you are heading

deeply. Yet as she observed the increasingly digital

in the right direction,” she says.

world around her, she became fascinated by a question that sits at the heart of cybersecurity:

Rather than measuring herself against others,

how can systems we rely on every day fail or be

Stephanie chose a different perspective.

manipulated without obvious signs?

“What helped me was focusing on direction rather That curiosity slowly evolved into purpose.

than speed. I kept building, kept learning, and allowed progress to show itself over time.”

“Over time, I stopped seeing cybersecurity as just technical security work and started

Her journey into GRC itself was also an evolution

understanding it as a governance and risk discipline,”

rather than a fixed destination. Initially drawn to

Stephanie explains.

the technical side of cybersecurity, she eventually discovered governance, risk and compliance and

Today, as a GRC Analyst and Consultant, Stephanie

immediately recognised something familiar.

has carved out a path that blends structured thinking,

38

risk management and business alignment proving

“I realised GRC aligns with how I naturally think,”

that cybersecurity careers rarely follow a straight line.

she says.

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

W H A T ’ S

H E R

J O U R N E Y ?

That alignment continues to shape her approach

“As organisations become more interconnected,

today. One of the greatest challenges in cybersecurity,

vulnerabilities don’t just come from internal systems

she believes, is bridging the gap between frameworks

but from partners and external dependencies,”

on paper and the complexity of real organisations.

she notes.

“In cybersecurity, frameworks are clear on paper, but

Professional growth remains central to Stephanie’s

real environments are messy,” Stephanie explains.

journey. She views certifications such as ISO 27001,

“Systems are layered, priorities compete and

CRISC and CISSP not simply as credentials, but as

decisions are rarely black and white.”

opportunities to deepen practical understanding.

As a result, she has learned to think less about

“For me, the focus is not just collecting certifications,

perfection and more about context.

but choosing ones that deepen practical understanding of how security is implemented and

“Instead of trying to find perfect answers, I

governed in real organisations.”

focus on risk-based reasoning: what matters most, what the impact looks like and what is

Among the many influences on her career, Stephanie

realistically implementable.”

credits both her healthcare background and the guidance of her mentor, Chineye Udechukwu, for

Her work with startups has further reinforced

shaping her professional outlook.

this mindset. Through freelancing engagements, Stephanie spends much of her time helping early-

“Having someone who consistently reinforces clarity

stage companies understand and manage security

in direction has helped me approach my growth more

risks in practical, actionable ways.

intentionally rather than randomly exploring different paths,” she says.

“A lot of my work involves helping teams understand their risk posture in practical terms, not overly

If she could speak to her younger self, Stephanie’s

complex frameworks, but clear direction they can

advice would be simple yet powerful: focus

act on.”

on consistency.

What she finds most rewarding is the opportunity to

“Cybersecurity can look overwhelming at the

bring structure to complexity.

beginning because of how broad it is,” she says. “But clarity comes with time and repetition.”

“There is something satisfying about connecting the dots between risk, controls and outcomes,” she says.

Her message is one that resonates far

“Taking something complex and unstructured and

beyond cybersecurity.

translating it into something clear and actionable makes me feel fulfilled.”

“Progress in this field is not linear, so it is better to stay consistent than to try to rush competence.”

Looking ahead, Stephanie believes artificial intelligence will significantly reshape the cybersecurity

In a profession often defined by rapid change and

landscape in the coming years, creating new

emerging threats, Stephanie Uzama’s journey is a

governance and security challenges as organizations

reminder that success is not built overnight. It is built

increasingly rely on AI-driven systems.

through curiosity, intentional growth and the courage to follow a path that evolves along the way.

At the same time, she sees third-party and supply chain risk as one of the most pressing threats

www.linkedin.com/in/stephanie-uzama-40619a273

organizations face.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

39

Sandra Estok Founder & CEO, Way2Protect | Author | Speaker | Podcast Host

S

andra Estok was eleven years old when

Her first step into the working world came through

life narrowed quickly.

an internship at Heinz in Venezuela. She was still a teenager, working as an administrative assistant,

“I was eleven years old when my mom

learning structure, responsibility, and rhythm. Then

and I were evicted,” Sandra says. “The

one ordinary task shifted something in her.

only place she could afford to rent was

a small shack. There was no running water. No

“One morning, Gisela, the administrator I supported,

bathroom. Just enough space for the two of us.”

called me over and handed me an envelope,” Sandra recalls. “She said, ‘Sandra, please take this package to

At that age, she didn’t have the language to describe

a hotel.’”

what she was living through. No talk of resilience. No framing of adversity. Just observation.

The errand felt simple. The destination did not.

“I only knew that my mother woke up every day and

“I looked up and realised it was the Hotel Pipo

kept going, and so did I.”

International, a five-star hotel,” she says. “As I walked inside, I felt like I had stepped into another world.”

That pattern didn’t let up. The instability continued, and eventually, even that small space was gone. By

Sandra remembers the details. The kind that stays

sixteen, Estok had graduated high school and moved

with you.

in with relatives, choosing a one-year secretarial program with a clear goal in mind.

“The marble floors reflected the light overhead. A stunning chandelier hung from the high ceiling, and

40

“I wanted to help support my family. I was practical.

elegant flower arrangements decorated the space in a

Dreams felt expensive.”

way that felt effortless and intentional.”

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

W H A T ’ S

H E R

J O U R N E Y ?

After delivering the envelope, something

“For the first time in my life, I realised there were

unexpected happened.

possibilities beyond the world I had experienced.”

“He looked at me and said, ‘Sandra, have a seat.

She thought about her family. What they needed.

Order breakfast and charge it to my room.’ Then he

What she could become.

walked away.”

“And quietly, I made a decision. I am going to become She hesitated. Then she sat.

a businesswoman. I do not know exactly how yet. But education will be my path.”

“It was a buffet. And to me, that was extraordinary,” she says. “There were more options than I knew what

She still comes back to that moment.

to do with.”

“That breakfast changed my life.”

But it wasn’t the food that stayed with her.

From there, the path was built piece by piece.

“As I sat eating, people started arriving for breakfast.

Work during the day. Study at night. Eventually, a

Some wore business suits and carried briefcases. At

qualification in systems engineering and a growing

one table, a woman opened what looked to me like a

career in technology. It was a movement. Not always

tiny computer.”

smooth, but forward.

She watched. Quietly.

Years later, in 2005, that trajectory carried her across continents. Her employer relocated her and her

“Not because I wanted luxury. Not because I wanted

husband from Venezuela to Milwaukee, Wisconsin.

the hotel. But because I realised something that had never occurred to me before: people lived like

“I still remember my first winter there, snow rising

this. People worked like this. People traveled. People

to my knees, the cold shocking my body and my

created an impact.”

imagination,” Sandra says. “I had built a life that once felt impossible.”

And then, something shifted.

And then, without warning, everything shifted again.

“My mind started visualising. I could see myself wearing a suit. Carrying a briefcase. Traveling.

After a trip to South America to visit family, Estok

Learning. Making an impact.”

boarded a flight expecting to return home. Instead, she was pulled aside.

It was subtle, but decisive.

“Two Homeland Security officers boarded the plane. I handed over my passport,” she says. “Suddenly, I was

“And quietly, I made a decision.

I am going to become a businesswoman. I do not know exactly how yet. But education will be my path.”

the only passenger escorted off the plane.”

What followed was confusion, then fear.

“Hours passed. Questions. Silence,” she recalls.

“Eventually, they returned my passport. Stamped in red: REVOKED.” The reason would take time to surface.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

41

“A criminal in China had stolen my identity and was

She doesn’t frame her story around the most dramatic

using my information to smuggle women into the

chapter, though.

United States.”

“But if you ask me what changed my life, I would not The next six years were defined by something most

say identity theft. I would not say moving countries. I

people never imagine needing to prove.

would not say entrepreneurship,” Sandra says.

“For six years, I had to prove I was myself. Again. And

Instead, she returns to something much quieter.

again. And again.”

“I would say it was breakfast. A single moment when It took a toll.

possibility entered the room and sat across from me.”

“That experience nearly broke my marriage, my career,

The identity theft taught her something different.

and my mental wellbeing.”

Something harder.

But it also forced a deeper question to the surface.

“Identity cannot be built only on achievement, titles, or

One that would quietly redirect everything.

documents. It must be rooted deeper.”

“What does it mean to protect what matters?”

Now, as technology accelerates and the boundaries between physical and digital lives continue to blur, her

That question became the turning point into

perspective remains steady.

cybersecurity. Not out of fear, but clarity.

“Artificial intelligence is reshaping work. Cybersecurity “I realised cybersecurity was never only about

has become part of everyday life,” Sandra says. “Yet

systems, networks, or devices,” Estok says. “It was

my advice remains simple: do not wait for certainty

about people. Identity. Trust. Safety. Human lives.”

before imagining a different future.”

From there, Sandra’s work expanded with intention.

Sandra is careful about how she frames challenge

She founded Way2Protect , created the Happily

and identity.

®

Ever Cyber® book series, developed cyber literacy resources for children, and began shaping

“Your circumstances are not your identity. Your

conversations around digital wellbeing in a way that

challenges are not your ending.”

feels accessible, not abstract.

And she leaves space for what stories can become when they are used with intention.

“Our stories are not meant to hold us back,” Sandra says. “When we use them with intention, they become our superpower.”

Then, almost as a quiet signature on everything she’s built: “We all deserve to live Happily Ever Cyber®.” www.linkedin.com/in/way2protect

42

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

Isabella Schulz Graduate Consultant

F

or Isabella Schulz, technology was

“What initially attracted me to cybersecurity was how

never something distant or unfamiliar.

dynamic the field is. Unlike many areas of technology

Growing up in a household where both of

that follow more predictable development cycles,

her parents worked in IT, conversations

cybersecurity constantly evolves alongside the threat

about technology were simply part of

landscape, whereby new risks, technologies and

everyday life. Those early experiences planted the

challenges emerge every day, which means there is

seed for what would eventually become a career in

always something new to learn and a new problem

cybersecurity, although at the time she could never

to solve.”

have imagined just how diverse and rewarding the profession would prove to be.

Today, as a Graduate Consultant at KPMG, that fascination has only deepened. Working across a

“My interest in cybersecurity started when I was

wide variety of clients and industries has shown

young since both of my parents work in IT, so

her that cybersecurity extends far beyond technical

technology was always part of conversations growing

controls and security tools. Every engagement offers

up. From an early age, I developed an appreciation for

a new perspective, a fresh challenge and another

how much modern life depends on technology and

opportunity to learn.

the importance of protecting the systems people rely on every day.”

“Since joining KPMG, my understanding of cybersecurity has expanded significantly. I’ve had

44

What captivated Isabella most was not simply the

the opportunity to work across multiple different

technology itself, but the pace at which cybersecurity

clients, industries and engagements, which has given

evolves. In a world where new threats emerge daily,

me a much deeper appreciation of how broad the

she saw a profession that would continually challenge

profession is. The combination of technical learning,

her to grow.

problem solving and working with experienced

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

W H A T ’ S

H E R

J O U R N E Y ?

" I still regularly question whether I am technical enough, and I think that is something many people in cybersecurity experience regardless of their level of experience because fundamentally, cybersecurity is a field where there is always more to learn. New technologies, threats and approaches emerge constantly, so it is impossible to know everything.

Over time, I have learned that feeling challenged is often a sign that you are growing.”

professionals has reinforced that this is a field I am

Rather than avoiding the challenge, I took the time to

genuinely passionate about.”

understand the mathematics behind the model and how it connected to cyber risk frameworks. Once I

Like many graduates entering the profession,

understood the foundations, it became one of the

Isabella quickly realised that cybersecurity can feel

most interesting and rewarding pieces of work I have

overwhelming at times. The breadth of knowledge

ever been involved in.”

required, coupled with the rapid pace of technological change and the emergence of artificial intelligence,

That experience fundamentally changed her outlook.

means there is always something new to understand.

Rather than allowing that to become intimidating, she

“That experience reinforced an important lesson for

has learned to embrace the challenge.

me: many challenges become opportunities when you are willing to stay curious and invest time in learning.”

“One of the most challenging aspects of starting a career in cybersecurity is adapting to the breadth of

Even with those successes, Isabella is refreshingly

the field. Understanding that there is always more

honest about the self-doubt that can accompany

to learn, and as a graduate it can sometimes feel

a career in cybersecurity. She believes imposter

overwhelming trying to understand complex concepts

syndrome is something many professionals experience,

whilst keeping pace with a rapidly changing industry,

regardless of where they are in their careers.

especially since the adoption of AI has increased so rapidly.”

“Absolutely. I still regularly question whether I am technical enough, and I think that is something

One project in particular transformed the way she

many people in cybersecurity experience regardless

viewed difficult problems. Asked to work on Monte

of their level of experience because fundamentally,

Carlo simulations to model cyber risk outcomes,

cybersecurity is a field where there is always more

Isabella initially questioned whether she was capable

to learn. New technologies, threats and approaches

of contributing to such advanced work. Instead of

emerge constantly, so it is impossible to know

stepping back, she leaned into the discomfort.

everything. Over time, I have learned that feeling challenged is often a sign that you are growing.”

“A project that stands out to me involved using Monte Carlo simulations to model potential cyber risk

She credits much of her confidence to the people

outcomes for organisations. Initially, I felt completely

around her, particularly the supportive culture she has

out of my depth because it combined advanced

found at KPMG and the guidance of one mentor who

quantitative analysis with cybersecurity concepts.

has played a significant role in her development.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

45

“What helped me navigate those doubts was the

“While I joined KPMG with an interest in cybersecurity,

support of mentors and colleagues. I have been

it was only through hands-on experience that I

fortunate to work alongside incredibly talented

realised how passionate I was about the field, and the

people at KPMG who are so generous with their time

more exposure I gained, the more I appreciated the

and knowledge. In particular, one of my mentors,

diversity of the challenges and opportunities available

Mina Zaki, has had a significant impact on my

within cybersecurity.”

development. She consistently encouraged curiosity, provided guidance at any time and helped me build

“What has kept me engaged is the fact that no

my confidence as I learned. Having people who

two days are the same. Every client, project and

so positively support your growth by encouraging

problem presents a new learning opportunity, and

learning makes a tremendous difference when you

my evolving curiosity has confirmed that I am in the

are starting your career.”

right profession.”

Interestingly, Isabella’s journey into cybersecurity

If she could offer advice to her younger self, Isabella

wasn’t mapped out from the beginning. While she

says she would challenge one of the biggest

always knew she wanted to work with technology,

misconceptions about cybersecurity.

the exact destination only became clear through experience.

“I would tell my younger self that cybersecurity is much broader than most people think, it’s not

“My path unfolded quite organically. In high school,

just coding.”

I was interested in technology and knew I wanted to work in IT in some capacity, but I did not have a

“While technical skills are important, cybersecurity

clear picture of what that career would look like. At

also relies on communication, business

university, I gravitated towards data analytics because

understanding, critical thinking and problem solving.

I enjoyed working with information, identifying

Many of the most successful professionals in the field

patterns, solving complex problems, and turning data

can efficiently and clearly bridge the gap between

into meaningful insights.”

technical concepts and business outcomes, providing an immense amount of clarity in important moments.”

Her time at KPMG ultimately confirmed she had found the right career.

She would also encourage aspiring professionals to develop the confidence to ask questions.

“I would also encourage myself to focus on developing strong communication skills and to never underestimate the value of asking questions. Being able to clearly explain complex ideas and collaborate with different stakeholders is a skill that becomes increasingly valuable throughout your career.”

For Isabella, the people she works alongside continue to be one of the greatest influences on her career. Surrounded by experienced professionals who are generous with their knowledge, she has learned that curiosity is every bit as valuable as technical expertise.

46

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

W H A T ’ S

H E R

“My mentors at KPMG and all of the individuals who I am able to ask questions to have had an incredible impact on my career and their patience and encouragement has propelled me to strive for success. As a graduate I feel the most important quality one can have is a love of learning, curiosity, and being able to dive head first into a problem and start solving it. The incredibly talented individuals at KPMG have greatly encouraged me to develop my problem solving skills, and I am incredibly fortunate to be surrounded by such amazing individuals and be able to use my skills to solve fascinating security

J O U R N E Y ?

“One lesson I have learned throughout my journey is that a love of learning is often more important than starting with all the answers. If you are willing to take the time to learn, ask questions and embrace challenges, there is a place for you in cybersecurity.”

problems every single day.”

That passion for solving problems is also what makes her role so rewarding.

to succeed in cybersecurity, but the industry benefits enormously from diverse perspectives

“The most rewarding aspect of my role is helping

and experiences. Skills developed in fields such as

organisations better understand and manage

business, law, accounting, marketing or data analytics

their cyber risk. I particularly enjoy working with

can all be incredibly valuable.”

stakeholders to understand risk at an organisational level and identify practical ways to strengthen

“Cybersecurity needs people who can communicate

security. There is something incredibly satisfying

effectively, think critically, solve problems and

about contributing to work that helps an organisation

understand business risk. Technical skills can be

make better decisions and improve its resilience.”

learned over time, particularly when you have curiosity and a willingness to continuously develop yourself.”

“Seeing recommendations implemented and knowing that your work has had a tangible impact is one of the

Ultimately, Isabella believes there is one quality that

most fulfilling parts of the profession. It’s incredibly

stands above all others.

rewarding to know that the effort you put into understanding a problem can ultimately help protect

“One lesson I have learned throughout my journey is

an organisation and the people who rely on it.”

that a love of learning is often more important than starting with all the answers. If you are willing to

For those considering a move into cybersecurity

take the time to learn, ask questions and embrace

from another profession, Isabella’s advice is both

challenges, there is a place for you in cybersecurity.”

practical and reassuring. She believes the industry thrives because of its diversity of backgrounds

For a graduate already making her mark in the

and perspectives.

industry, that mindset of continuous learning, curiosity and resilience is not only shaping Isabella

“At first I assumed that you need a highly technical

Schulz’s own career it is also a reminder that some of

background to succeed in cyber, but whilst this

the most successful journeys in cybersecurity begin

may make things easier at first, a love of problem

not with knowing everything, but with being willing to

solving, sharp critical thinking skills, and the ability

keep learning.

to communicate and effectively understand threats has proven to be enormously beneficial. Many people

www.linkedin.com/in/isabella-schulz-241b31172

assume they need a highly technical background

I S S U E 31

WOMEN IN SECURITY MAGAZINE

47

CRAIG FORD Craig is an experienced cyber security professional with various qualifications including two master’s degrees. He is the Head Unicorn (co-founder and director) of Cyber Unicorns, in which he acts as a vCISO to clients such as Baidam Solutions, Wesley Mission, PCYC, Hungry Jacks and Ipswich City Council. He was CTO (Chief Technology Officer) for Baidam Solutions between January 2022 to June 2023, where he led the technical services team, helping to build out the internal services capability for Baidam. Craig was QLD chair for AISA for two years until he was appointed to the national board of directors in December 2022.

The road to success is a bumpy one I want to be clear from the start. This is not a polished success story. It is simply how I see it. You may not agree, and that’s fine. The point is to make you think.

Because the road to success is not smooth. It is uneven, unpredictable, and at times uncomfortable.

There are setbacks you don’t expect and lessons you don’t particularly want but they tend to stick.

I’ve been fortunate to build a visible career in

I grew up in Inverell, a regional town in New South

cybersecurity, both in Australia and internationally,

Wales. I started in IT as a trainee at a small shop at

through public speaking and writing over the

most, a team of four or five. Before that, I completed

past seven or eight years. That visibility brings

Certificates III and IV in ICT at TAFE, driven by a

conversations. People share their journeys,

general curiosity about how things worked.

their frustrations, their questions. I value those conversations.

At the same time, I was working nights as a supermarket security guard and weekends as a

Often, I hear the same thing: that I’ve had an

bouncer. For a while, I did all three. Not because it

impressive career, that I’ve achieved a lot, that I’ve

was strategic, but because it was necessary.

been lucky.

Eventually, I built enough experience to move from And yes, on the surface, it looks that way. In the past

trainee to technician, working on-site and building

year, I’ve received eight awards, five international book

networks. I made mistakes. I still do. But I kept going.

awards and three cybersecurity industry awards. I’ve

I stayed in that role for five years before moving to the

been shortlisted for others and included in various

Gold Coast to look for something bigger.

“top” lists.

From there, my career developed gradually into That matters. I don’t dismiss it.

support roles, security responsibilities, before they were formally labelled as “cyber,” then into a dedicated

But it is not the full picture.

cybersecurity position with an MSP. I ran a SOC, worked on penetration testing, and explored different

What matters more is the twenty-plus years behind it.

paths within the field.

The part you don’t see. The missteps, the setbacks,

48

the long stretches where nothing seemed to

I enjoyed pentesting, but couldn’t quite break fully

move forward.

into it. So I shifted direction, continued in blue team

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

Craig is a published author with three different book series – ‘A Hacker I Am’ cyber education series, ‘Foresight’ is his Cyberpunk/hacker fantasy novel series and then there is ‘The Shadow World’, a co-authored kids cyber education book. He is a freelance cyber security journalist and is a regular columnist with the Women in Security Magazine, as well as a freelance contributor for Cyber Today, Top Cyber News, SecureGov, Careers with STEM and Cyber Australia magazines.

C O L U M N

work, and moved into senior consulting and eventually

a senior role without experience. Occasionally,

CISO-level responsibilities.

someone gets a break but most people build their way there, slowly.

That progression might sound linear when summarised. It wasn’t.

That process can be uncomfortable. It can feel like you are not moving at all.

When I tried to move into a formal cybersecurity role, I faced hundreds of rejections. Not dozens—hundreds.

And you will have setbacks. Everyone does.

It was relentless.

The difference is what happens next. Whether you At that point, I already had over a decade of

keep going, adjust your approach, or decide to step

experience in IT and security-related work. I was

away. All of those are valid decisions but they should

building secure systems, even if my job title didn’t

be conscious ones.

reflect it. I held a master’s degree and was working on a second.

If you choose to stay, then commit to it. Build your network. Support others. Pay attention to what the

None of that guaranteed an opportunity.

difficult moments are teaching you, even if it only becomes clear later.

It was frustrating. At times, it felt like there was no clear way in. And I know many people still experience

There is no single path through this industry. There

that same barrier today.

are many, and most of them are not obvious at the beginning.

But this is the point I want to make: what you see now is not the full story. It never is.

So go into it with open eyes. Expect detours. Expect delays. Expect the occasional setback that forces you

Comparing yourself to someone else’s visible

to rethink your direction.

success, especially the version presented online, rarely helps. It tends to distort reality more than

And remember that everyone you meet is carrying

clarify it.

their own version of that journey, whether you can see it or not.

A better question is simpler: Is this the field you actually want to be in?

If the answer is yes, then the next step is yours to

Be decent to people. It matters more than you think. www.cyberunicorns.com.au

figure out. Not mine, not anyone else’s. You can learn from other people’s paths, but you cannot follow them

www.linkedin.com/in/craig-ford-cybersecurity

exactly. That approach usually leads nowhere useful. www.facebook.com/CyberUnicorns

There is also a harder truth worth stating plainly.

Progress takes time. You are unlikely to step into

I S S U E 31

www.instagram.com/cyberunicorns.com.au

WOMEN IN SECURITY MAGAZINE

49

Co

N

WOMENINSECURITYAWARDS.C

ongratulations to the

NOMINEES

COM.AU | #2026WISAWARDS

INDUSTRY PERSPECTIVES

JO STEWART-RATTRAY

WHY AI GOVERNANCE NEEDS MORE HONEST LEADERSHIP CONVERSATIONS

by Jo Stewart-Rattray, Oceania Ambassador, ISACA

Artificial intelligence is already drafting reports,

Globally, 90 per cent of respondents believe

automating decisions, analysing data, influencing

employees are already using AI within their

hiring and reshaping how organisations operate

organisation. Yet only 22 per cent say AI return on

quickly. Adoption is accelerating. The conversations

investment has met or exceeded expectations. More

that should sit alongside it are not.

than half were unsure how long it would take to shut down an AI system following a security incident.

Not the technical ones. The human ones.

Thirty-nine per cent did not know whether formal shutdown processes even existed.

Who is accountable when AI systems fail?

Who speaks up when governance lags behind

It is a familiar pattern. Innovation moves first.

innovation?

Accountability, culture and governance follow behind.

And who carries the quieter work of raising ethical

For many women and underrepresented professionals

concerns, challenging blind spots, or pushing for

in security, that gap is not new. Raising concerns,

more inclusive decision-making often in rooms where

questioning assumptions, or asking whether

they are still the only one?

organisations are genuinely prepared for risk can still come at a cost.

New findings from ISACA’s 2026 AI Pulse Poll point

54

to an industry moving quickly on adoption, but far

Historically, influence in security has not always

more cautiously on governance, accountability

come with formal authority. Many have learned to

and readiness.

lead through persistence, collaboration and careful

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

I N D U S T R Y

advocacy rather than title alone. Those skills are

P E R S P E C T I V E S

This is where more honest conversations matter.

becoming more important as AI moves deeper into organisations.

ISACA’s research shows only 38 per cent of organisations currently have a formal, comprehensive

Good governance is not just policy or compliance.

AI policy in place. At the same time, respondents

It is culture. It is whether people feel safe enough to

identified misinformation, privacy violations, social

speak early before issues become incidents. Whether

engineering and intellectual property loss among the

they can question unintended consequences without

most immediate AI-related risks.

being labelled difficult. Whether uncertainty can be acknowledged without losing credibility.

These are not future concerns. They are current governance challenges, and they do not sit neatly

And still, many hesitate.

within one function or team.

Some fear being seen as resistant to innovation.

Honest conversations are not about confrontation.

Others worry about appearing overly cautious in

They are about creating conditions where people can

environments that reward speed. For women, there

say what needs to be said.

can be an added layer balancing technical credibility with expectations around communication style,

That might look like a junior analyst questioning

confidence and presence.

whether an AI system has been properly tested.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

55

• A governance lead pushing back on unrealistic expectations around AI ROI. • A leader admitting uncertainty rather than filling the space with confidence.

• A colleague asking who is missing from the

In security, some of the most important leadership happens quietly. Through advocacy. Through mentoring. Through raising concerns before they become problems. Through making space for others to be heard.

decision-making table.

• A manager recognising the often invisible work

As AI becomes more embedded across organisations,

of mentoring, inclusion and ethical advocacy

the ability to have these conversations honestly, and

happening alongside formal roles.

early may prove to be one of the profession’s most important skills.

The security profession has always depended on people willing to surface uncomfortable truths early.

AI raises the stakes, but the principle is the same.

ABOUT THE AUTHOR Jo has over 25 years’ experience in the security

There are signs of progress. AI literacy is increasingly

sector. She consults in risk and technology issues

recognised as essential across the workforce.

with a particular emphasis on governance and

Organisations are starting to acknowledge

cybersecurity as a director with BRM Advisory.

the complexity.

Jo is the Oceania Ambassador for global IT professional association, ISACA, and an ISACA

But responsible AI will not be delivered by technology

Hall of Fame inductee. Jo is the former Vice

alone. It will depend on whether organisations build

President, Communities of the Australian

cultures where people can question, challenge and

Computer Society and Ambassador of the

speak openly about risk, accountability and inclusion.

National Rural Women’s Coalition. She regularly provides strategic advice and consulting to the

AI governance cannot sit solely within IT. It requires

banking and finance, utilities, healthcare, tertiary

legal, risk, privacy, HR, communications and

education, retail and government sectors.

executive leadership working together and listening to one another. www.linkedin.com/in/jo-stewart-rattray-gaicd-4991a12

56

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

LISA VENTURA

“YOU’RE TOO EMOTIONAL FOR SECURITY”: RECLAIMING THE TRAITS THAT MAKE WOMEN EXCEPTIONAL IN CYBER SECURITY

by Lisa Ventura MBE FCIIS, Chief Executive and Founder, AI and Cyber Security Association

I have lost count of how many times I have been told

Being told you are too emotional is not feedback. It is

I am “too emotional.” It has come through formal

a signal about the culture you are operating in.

feedback, passing comments, and carefully worded suggestions to dial something down. Each time, the

WHEN FEEDBACK ISN’T REALLY FEEDBACK

reaction is the same: a flicker of doubt, followed by a

This experience is not unique. A senior cyber security

quiet refusal to accept it.

leader I know was recently given formal feedback that she was “too emotional” at work. It was not tied

I have worked in cyber security for more than sixteen

to a specific incident or lapse in judgement. It was

years. I have built programmes, led campaigns,

about how she works, how she engages, thinks and

written books, spoken on stages and founded

shows up.

organisations. I have done all of that as my whole self including the parts others have chosen to

A characteristic, not a behaviour.

label emotional.

When she tried to interpret it, the questions came And I am done treating that word as an insult.

58

W O M E N I N S E C U R I T Y M A G A Z I N E

quickly. Does it mean caring too much about the

J U LY • A U G U S T 2026

I N D U S T R Y

P E R S P E C T I V E S

quality of work? Thinking deeply about decisions and their impact? Asking questions, challenging assumptions, pushing for better outcomes?

The problem is the word itself. “Emotional” becomes a catch-all, broad enough to mean almost anything and precise enough to explain nothing. It makes it difficult to understand what is actually being assessed, or what is expected to change.

In practice, it often becomes a container for traits that feel inconvenient. And inconvenient can mean unfamiliar, uncomfortable, or simply not aligned with

Empathy allows security awareness programmes

how things have always been done.

to actually change behaviour rather than tick boxes. Emotional intelligence shapes how leaders

THE DOUBLE STANDARD HIDING IN PLAIN SIGHT

communicate risk in a way that boards engage

The behaviours labelled as emotional in women are

is said and what is not is what makes culture

often praised in men.

assessments meaningful.

Caring deeply about outcomes. Challenging what is

These are not secondary skills. They are the

not good enough. Showing visible investment in the

difference between a programme that exists and one

work. In one context, this is called passion or drive. In

that works.

with. The ability to read nuance between what

another, it is framed as a problem.

Yet they are the same qualities that are often The behaviour does not change. The label does.

dismissed as “emotional.”

If emotion is only an issue when it comes from

WHAT SUPPRESSION COSTS

certain people or shows up in certain ways, then

When women are repeatedly told the way they show

professionalism is not what is being measured.

up is a problem, the outcome is predictable.

Comfort is.

Some adapt. They suppress the qualities that More specifically, how comfortable people are

make them effective and perform a version

with women who do not minimise themselves to

of professionalism that takes constant effort

fit expectations.

to maintain.

THE SKILLS WE UNDERVALUE

Others leave.

Cyber security is, fundamentally, about people.

The industry has spent years focusing on the pipeline Phishing works because it exploits human behaviour.

problem attracting more women into cyber security.

Social engineering succeeds because attackers

That work matters. But it avoids a harder question:

understand how people think, trust and respond under

what happens once they arrive?

pressure. Even the strongest technical controls can be undone by a single moment of hesitation, urgency

If the culture signals, subtly or directly, that your

or misplaced trust.

natural way of working is a liability, staying requires

I S S U E 31

WOMEN IN SECURITY MAGAZINE

59

And that limitation does not belong to you.

LISA ON SOCIAL MEDIA @cybergeekgirl

www.linkedin.com/in/lisasventura/

www.facebook.com/lisasventurauk

www.instagram.com/lsventurauk

continuous self-editing. Over time, that becomes

bsky.app/profile/cybergeekgirl.bsky.social

exhausting. Exhaustion turns into disengagement.

And eventually, exit.

You can find examples of the talks she has done previously and of interviews, panel discussions and

This is not just a pipeline issue. It is a culture issue.

THE CONVERSATION WE ACTUALLY NEED The conversation we need is not about how women can better manage their emotions at work.

moderating/chairing events on her YouTube channel: www.youtube.com/@CyberSecurityLisa

AI AND CYBER SECURITY ASSOCIATION’S CHANNELS

It is about what we mean when we use that language and what it costs when we do.

x.com/AICyberSecAssoc

It costs trust. It strips away the very qualities that

www.linkedin.com/company/aicybersecassoc

make people effective. It shapes how others see the industry, and whether they choose to stay in it.

www.facebook.com/aicybersecassoc

And it undermines something we often claim to value: a genuinely human-centred approach to security.

You cannot build that by treating human qualities as

ABOUT THE AUTHOR

a liability.

Lisa Ventura MBE FCIIS is Founder and CEO of Unity Group Solutions Limited, a specialist cyber

To every woman who has been told she is too

security awareness, strategic communications

emotional: you are not. You are not too much, and you

and thought leadership consultancy. She received

should not have to reshape yourself to fit.

her MBE from King Charles III in 2023 for services to cyber security and diversity, equity, inclusion

The empathy, the care, the instinct to question and

and belonging. She is a Fellow of the Chartered

push for better these are not weaknesses. They are

Institute of Information Security, Founder and

part of what makes security work.

CEO of the AI and Cyber Security Association (AICSA), and author of Artificial Intelligence in

When they are dismissed, it is not a reflection of

Cybersecurity (Kogan Page, April 2026).

your professionalism. It is a reflection of someone else’s comfort.

60

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

LET US HELP YOU OVERCOME YOUR BUSINESS DATA CHALLENGES

Our team understand the importance of time and efficiency when it comes to data projects.

Core Services Database creation Database admin cleaning Database appending services Data enrichment Data verification Telemarketing services CONTACT US!

0415 500 580

Aby@source2create.com.au source2create.com.au

SIMON CARABETTA

IT’S NOT ABOUT A SALARY: IT’S ALL ABOUT REALITY

By Simon Carabetta, Cyber Security Workforce Skills and Education | Podcaster | DEI advocate

I may have submitted this article late to the editors

Conflict of interest? “No way”, some would utter, while

because, during the entire writing process, I found it

looking up from their copy of The Wall Street Journal.

hard to see my screen through the continuous tears

“It’s just how capitalism works.” That’s a fair point,

of laughter.

but let me ask you this: is it OK for capitalism to raise expectations and then disappoint us severely? (Don’t

Three boxes of Kleenex and a Valium later, I finally

answer that question)

achieved the almost impossible; writing about salary guides without using any sarcasm, expletives or

A few months ago, Deany Jaghdour and I spoke on

references to Dante’s Inferno. I am very happy to

our podcast, Rejected or Selected, about the reality

report to you all that I can now say I’ve seen the tenth

of modern-day salary guides. It’s no secret that

Circle of Hell: it’s the room in which salary guides

companies such as Michael Page, Hudson, Hays and

are written.

Seek, among others, publish their own guides on a regular basis, and some smaller boutique recruitment

It’s not the concept of salary guides that evokes pain,

agencies create their own.

laughter and torment all at the same time, like the

62

screams emanating from Nurse Ratched’s mental

Apart from the obvious questions such as, “What am

ward. It’s the reason why they’re written in the first

I doing with my life?”, “What are the odds of winning

place. More to the point, the very companies that

Powerball?” and “How much can I get for one kidney?”,

create salary guides are the same companies paid by

here are some less obvious questions you should be

clients to publish that information in the first place.

asking when reviewing a salary guide:

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

I N D U S T R Y

P E R S P E C T I V E S

which made me think they’ve either taken their offer straight out of the Hays Salary Guide, or they’re expecting candidates with very diverse experiences. I then made my way onto the Hudson Salary Guide.

Now, Hudson’s is a little bit different in that it does not just give you a typical range, it breaks that range down into junior, mid and senior grades and, within those three grades, it also gives you a lower, mid and an upper range. (Well done, Hudson).

That last little discrepancy opened many more questions for me: • Where were these companies getting this data from?

• Who was verifying these figures?

• When people submit data to contribute to these salary guides, how trustworthy are they?

• Why on Earth would anyone ever submit their own salary to feed the data in a salary guide?

WHERE ARE THE DISCREPANCIES? According to Hays, a typical cybersecurity engineer

WHO’S FUNDING THIS?

role in Australia can attract between $110k and $180k

When you ask a toddler where the last cookie went.

with an average around the $150k mark. However, if I

When their mouth has crumbs on it, there’s chocolate

were to go on Seek (which I did) I would find only one

smeared on their hands and a look of guilt on their

cybersecurity engineer role that advertised, and this is

face that would make a prosecuting attorney salivate,

at $103k yearly salary. Seek did not specify whether

it’s obvious they took the last cookie.

this was entry-level, mid or senior (If it were senior, we all have permission to storm this company’s

It’s also obvious that global recruitment agencies are

headquarters by the end of the week).

putting together these salary guides to generate more business. Showing their expertise, increasing brand

I then looked at the Hays salary guide for the ‘typical’

awareness, giving their clients bang for their buck:

salary of a GRC analyst (Side note: when you’re

it’s all there. These salary guides are designed to help

researching these roles and you type the word

you in the same way that a crocodile that’s learnt to

‘analyst’ into a Google search, make sure you finish

stand upright and put on a captain’s uniform is there

typing the whole word before your co-worker comes

to navigate you safely across the river.

into your office to have a chat. Trust me!)

We don’t simply go to a salary guide, look at our It shows a range from $90k-$180k with a median

desired profession and say “Eureka, that’s what I’ll

salary in the range $125k-$140k. That’s a big gap.

be making.” It’s not as simple as that, because these figures are all over the place. That’s not because the

Then I went onto Seek again (after explaining to said

cybersecurity industry is a mess (that’s a subject for

co-worker that my search history is indeed quite

a different article), but because recruitment agencies

innocent). One of the first roles (and one of very few)

make it their business to advise us on salaries on

that came up gave me a salary range of $100k-$140k,

behalf of their clients.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

63

Go to any job board Seek, Indeed, even LinkedIn and tell me how many jobs you see each day that have a specific salary listed in the advertisement. I can guarantee you: if the advertisement has been posted by an agency, there is little to no chance there will be a figure to give you any indication of how much you’ll make.

My first job in cybersecurity was as an awareness

"This is one of the factors contributing to the atrocious gender pay gap we have in this country. If we don’t know what other people are making, then how can we negotiate our own salary?"

trainer with Water Corporation in WA. I was never given any indication of how much I’d make until after the interview (should have been a red flag right there, but, at the time, I was still a wide-eyed,

noise by speaking with those who can tell you exactly

naive newcomer). I shudder to think how many

what the industry is like and how much you can

graduates and newbies to cybersecurity are being

expect to get paid.

taken advantage of by small, mid and large-sized recruitment agencies alike.

“But Simon,” you’re probably yelling, “It’s rude to ask someone how much they get paid!”

The confusion and noise out there in salary guide land are intentional.

Yes, it’s rude to start a conversation that way, but guess what? It should never be rude to ask someone

SO, WHAT DO WE DO?

that question. Here’s the thing: we’ve been gaslit

Get educated by speaking with current cybersecurity

continuously by Corporate Australia to believe this

professionals in your network, or attend networking

to be a faux pas and something to be avoided. This

events, conferences and meetups to cut through the

is one of the factors contributing to the atrocious gender pay gap we have in this country. If we don’t know what other people are making, then how can we negotiate our own salary? How can we empower ourselves to ask for a fair and equitable amount without knowing where the benchmark is?

The next time you’re at a networking function and you meet someone else in the cybersecurity industry, ask them how their job’s going, ask them what’s challenging them at work right now, and ask them how much money they get paid.

Like the legendary and hugely influential hip-hop figure, KRS-One, is very well known within hip-hop, but much less well known among the general public.” rapped on his track, My Philosophy, in 1988, “It’s not about a salary, it’s all about reality.” www.linkedin.com/in/simoncarabetta

64

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

08

MAY • JUNE

IN 2022, YOU CAN NO LONG ER TAKE SECU RITY WORK ERS FOR GRAN TED P10-13

20 22 W W W. W O

AS THE SECU RITY THREAT MORP DEFE NSIV E HS, TEAM S MUST CHAN GE TOO P76-79 IF YOU CAN’T YOUR WAY TO SPEND SECURITY THISGOOD TRY FOCU SINGYEAR, ON YOUR PEOP LE P94-97

YEAR OF THE SECURITY WORKER

MENINSE

WHO RUNS

CURITYM

AGAZINE.

COM

WORLD the

W W W. W O

MENINSE

CURITYM

AGAZINE.

COM

TO O U R M A

GAZINE

SUBSCRIBE

07

MARCH • APRIL

Never miss an edition again!

Subscribe to the magazine today for exclusive updates on upcoming events and future issues, along with bonus content.

SUBSCRIBE NOW

JAY HIRA

THE CONVERSATION THAT KEEPS HAPPENING

by Jay Hira, Cyber Director – Financial Services, KPMG

It usually comes up at the dinner table.

pattern: warmth, acknowledgement, and a quiet move away from the discomfort.

My parents-in-law are visiting from India. They come often, and time with them in Sydney settles into a

The conversation happens. It just never

familiar rhythm: long meals, unhurried conversation,

lands anywhere.

a kind of presence that only family travel seems to allow. The food is generous, as always. The

The decision itself was made when she was sixteen.

conversation drifts to work, family, who has called

In India, that is when students choose their stream.

whom, whose children are doing what.

Science, physics, chemistry, maths, biology if you are heading toward medicine or engineering. Or

Somewhere between a second helping of paneer

commerce, for a different path entirely. The choice

biryani and the tea, my wife says it again.

shapes what comes next: university options, career trajectories, the edges of what feels possible.

She should have been allowed to choose science. She wanted to be a doctor. She would have got to where

She wanted science. She had always wanted to be

she is now much sooner.

a doctor.

The table pauses. Someone nods. Someone offers

Her older sister had struggled with the science

something kind. Then it moves on. Tea is poured.

stream. From that, a conclusion was formed. Science

Plates are cleared. The room settles, as though

is too hard. Commerce is more practical. This will suit

nothing has shifted.

her better.

This has been happening for years.

No one set out to limit her. It was a decision made the way many family decisions are carefully, with

66

She is not bitter when she says it. She is not looking

experience, and with assumptions that go untested.

to provoke. She is naming something she has carried

Her path narrowed through a quiet consensus that no

for a long time. Each time, the response follows a

one thought to question.

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

I N D U S T R Y

P E R S P E C T I V E S

She studied commerce and did well. Over time, she

The setting is different. The language is more refined.

built a career across industries and roles, not linear,

The room is more diverse than it might have been

but layered. Today, she works in professional services,

years ago. But the shape of the moment feels familiar.

specialising in cyber security. She is excellent at it.

There is warmth. There is acknowledgement. And

The breadth she brings has made her sharper than

then, very little changes.

many who followed a more direct path.

This is not about insincerity. The people in those And still, she did not get to choose the one

rooms care. My parents-in-law cared. The pattern is

she wanted.

older than any one of us.

That is the part the dinner table cannot quite hold.

Systems have a way of absorbing truth without being altered by it. They can hold a difficult conversation,

I find myself thinking about this in a different

even make space for it, and still return to their

context now in rooms where we hold what are called

original shape.

“courageous conversations.” They are thoughtful spaces. People listen. They speak carefully. Someone

Over time, it becomes clear that courage is not really

shares something real about being overlooked, or

tested in the conversation itself. Most rooms can hold

unheard, or passed over. The room receives it well.

a hard conversation for an hour. There is structure.

There is permission. There is enough safety for

And then, almost without noticing, the pattern repeats.

someone to say something.

A pause. A shift. The next agenda item arrives

That matters. But it is not the hardest part.

on time.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

67

What comes after is where it becomes real.

But neither, on their own, are what we mean by courage.

It shows up in small decisions. In what changes, and what does not. In whether the next decision is

Courage begins once the conversation has ended. It

different from the last. Whether a path that once

lives in what changes because of what was said. In

narrowed is widened for someone else. Whether the

whether we widen paths that were once narrowed. In

next sixteen-year-old is given a choice that another

whether we revisit decisions made in someone else’s

was not.

absence and ask if they still hold.

Whether the person who speaks up in a meeting is

The conversation is not about courage.

followed up with. Sponsored. Advocated for when they are not in the room.

It is the beginning.

This is where it gets uncomfortable. Because if it

When the tea is poured and the plates are cleared,

costs nothing, the system remains intact. It becomes

one question remains.

informed, but unchanged.

The conversation happened. We all heard it.

And an informed system that does not shift can be harder to move than one that never heard the truth at

What changes now?

all. It can point to the conversation as evidence that something was done.

www.linkedin.com/in/jayhira

My wife is not waiting for an apology. She is not asking for one.

What she does, each time she names it at the dinner table, is keep the truth present. She does not

ABOUT THE AUTHOR

let it soften into something easier to forget. She

Jay Hira is a cyber security practitioner, lifelong

ensures that a decision made for her, however well

learner, and advocate for inclusion. With nearly

intentioned, is not quietly removed from memory.

two decades of global experience, he has helped more than 100 organisations transform cyber

There is a kind of courage in that. Not a single

risk into opportunity by making security simple,

moment, but a pattern. The same sentence, said

accessible, and a driver of growth. Known for his

again. Another year. The same gentle response.

pragmatic, people-first approach, Jay simplifies complex challenges to deliver actionable

And it leaves a question sitting there, whether anyone

advice that empowers teams and strengthens

picks it up or not.

resilience. He values diverse perspectives and believes the best solutions arise from

Will the conversations we have today look the same

collaboration and continuous learning. Jay’s

in twenty years? Will the people who speak up still be

experience spans across the spectrum of attack,

naming the same things, in different rooms, to people

defence, architecture, governance, strategy, and

who listened but did not act?

transformation, with a strong focus on building high-performing, inclusive teams. He simplifies

We often talk about courageous conversations.

security, inspires authentic leadership, and ensures security serves as a force for good in

There is value in speaking openly. There is value in

every organisation.

listening well.

68

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

UNLEASHed

? us in jo to y ad re .

26 20 . ne ur bo Mel Step into the spotlight as a champion of Australia’s vibrant, diverse, and resilient security sector.

By joining the Australian Women in Security Awards as a sponsor, you’ll be recognised as a leader driving innovation and inclusion—while supporting the remarkable trailblazers shaping cyber, IT, and protective security.

Help foster a future where everyone can thrive.

Become a sponsor.

Register your interest today!

Contact Aby at aby@source2create.com.au womeninsecurityawards.com.au

POUPAK ENBOM

WHY DIVERSITY OF EXPERIENCE ACROSS ENGINEERING, SALES AND MARKETING CAN CREATE STRONGER SECURITY LEADERSHIP

by Poupak Enbom, Chief Market and Business Development Officer, Yubico Cybersecurity leadership has traditionally been

mindset, discipline and awareness of the importance

viewed through a highly technical lens, and for good

of solid foundations. Sales provides a direct

reason. The sector has been shaped by engineers

understanding of customer pain points, business

and architects who understand how systems

pressures and varying risk tolerances. Finally,

work and where vulnerabilities sit. Yet, the role

marketing helps educate and brings clarity, ensuring

of security leadership is changing. Cybersecurity

that the overall strategy and positioning are aligned

is no longer a narrow IT discipline or a technical

with what the market genuinely needs.

problem to be solved once. Today, it is a business imperative spanning every function; from developers to business owners to the boardroom. This shift demands a broader kind of leader who not only deeply understands the technology, but can also connect it to customer needs, business priorities, market drivers and organisational change.

My own career has spanned engineering, sales and marketing, which has profoundly shaped how I view cybersecurity. Engineering brings a solution-oriented

70

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

I N D U S T R Y

P E R S P E C T I V E S

Together, these experiences have given me a

proves that the best security solution is the one

comprehensive perspective. In cybersecurity this

that enables and de-risks the business in which an

viewpoint matters, because our industry cannot afford

organisation operates.

to operate in silos. We need leaders who can combine technical development with a market-driven approach

Marketing also plays an important role in security

to create a truly unified business strategy.

leadership. Organisations need to understand exactly why a risk matters, how it specifically

FROM TECHNICAL AFTERTHOUGHT TO SECURITY BY DESIGN

affects the business and what actions they can

Security has evolved significantly over the past

bring proof and deliver outcomes. This is critical,

two decades. In the past, it was often treated as an

because security decisions are rarely made by a

afterthought, something added after a product was

single function. They involve technical stakeholders,

built or a system deployed. It was frequently viewed

financial leaders, compliance teams and boards.

take. Strong marketing helps inform, drive value and

as a ‘one-and-done’ compliance box to tick.

EXPANDING THE DEFINITION OF DIVERSITY That mindset is no longer fit for purpose. The

The cybersecurity industry has made notable

modern security approach requires organisations

progress on diversity, but there is still work to do.

to constantly adapt to evolving technology while

Women in senior executive roles, including chief

considering privacy, integrity and resilience from the

technology officers and chief revenue officers, remain

outset. Security by design is now essential.

in the minority. However, there is growing recognition that diverse teams deliver stronger outcomes.

This is particularly important as organisations manage more data and identities (human and

This diversity could include gender, culture and

non-human) and serve customers across a variety

professional background. Leadership teams benefit

of industries operating in increasingly complex

when people bring different lived experiences,

regulatory environments. We have shifted from

career paths and ways of thinking. In security, where

securing the parameters to securing the most

technologies constantly evolve and cyber threats

valuable assets. We have shifted from static access

become more sophisticated at a speed and scale

control to a flexible, ‘just in time’ authentication

never seen before, a narrow leadership profile limits

and authorisation framework. Today, security

how organisations understand risk and respond

serves as the essential trust layer, directly affecting

to change.

customer confidence, brand reputation and competitive advantage.

THE NEXT EVOLUTION OF SECURITY LEADERSHIP

WHY ENGINEERING NEEDS SALES AND MARKETING

Cybersecurity is now undergoing another massive

Technical expertise remains critical for assessing

cryptography will reshape how organisations think

system resilience and emerging threats. However, it

about resilience and de-risking the business.

shift. Artificial intelligence (AI) and post-quantum

is no longer sufficient. Security leaders need to know exactly how a security investment will reduce risk,

The future of the industry will be championed by well-

support strict compliance mandates, enable growth

rounded leaders who combine engineering discipline

and improve the user experience.

with market understanding and clear communication.

That is how security becomes a strategic enabler of

It is easy to focus solely on security features,

trust, resilience and growth.

architecture or specifications. Sales experience reinforces the critical importance of listening and

I S S U E 31

www.linkedin.com/in/poupak-modirassari-enbom-a6284

WOMEN IN SECURITY MAGAZINE

71

MEET THE JUDGES FOR THE 2026

Tara Dharnikota CISO at Victoria University

Alana Lundy CIO and CISO for Department of Social Services

Cairo Malet Senior Manager / Deliver Lead - Cyber Security Services at Fujitsu

Dai Head Awa Me

Helen McLeish Chief Cyber Security Officer at East Metropolitan Health Service WA

Jackie Montado Chief Digital and Technology Officer at Wesfarmers Industrial and Safety

James Ng CISO at Insignia Financial

Jasmin Principa Con at Deci

Maxine Harrison CISO from Department of Energy, Environment and Climate Action

Meagan O'Mahony Director of Security at Zip Co

Mona Sidhu Cyber Security Education and Awareness Manager at NSW Department of Education

Nadia Region Manag Amazon

Sam Fariborz CISO at David Jones

Sana Rashed CISO at HSBC

Sharin Yeoh Technical ISO at Systematic

Tams ICF Exec Diversity Coachi

WOMENINSECURITYAWARDS.COM.AU |

6 AUSTRALIAN WOMEN IN SECURITY AWARDS

Dr Greg Adamson CISO at Department of Transport and Planning

isy Wong of Security areness at edibank

Derek Winter CISO at UNSW

Doris Tidd CISO at Intellihub

n McCrudden al Recruitment nsultant ipher Bureau

Jenna Whitman Head of Security Operations and Deputy CISO at Vocus

John Taylor Group Executive | CIO | CTO | CISO

a Hammoud nal Security ger - APAC at n Web Services

Neha Sharma Industry CISO

Nikita Newell CISO at Lendlease

Peter Gigengack Director Cyber Security | Capability at the Department of the Premier and Cabinet of WA

sin Jowett cutive Coach & y Consultant at ing To Thrive

Tamsyn Harris Director of Scam Prevention at Optus

Tharaka Perera CISO at Estia Health

Wayne Rodrigues Board Member Membership Director at ISACA Melbourne Chapter

#2026WISAWARDS

Hayley van Loon CEO of Crime Stoppers International

Kate Raulings Lukasz Gogolkiewicz CISO Head of Cyber Security at Environment Protection for Accent Group Authority Victoria

Roxanne Pashaei Director Cyber Security Operations at Western Sydney University

KAREN STEPHENS Karen Stephens is the co-founder and CEO of BCyber. After more than 25 years in financial services, Karen moved into SME cybersecurity risk management. She works with SMEs to protect and grow their businesses by demystifying the technical aspects of cybersecurity and helping them to identify and address cybersecurity and governance risk gaps. She was named inaugural Female Cyber Leader of the Year at the 2023 at the CyberSecurity Connect Awards in Canberra and has been a finalist in 2024 and 2025 in the Australian Cyber Awards for Cyber Security Professional of the Year - Professional and Financial Services.

C O L U M N

You don’t need an executive title to affect change Early in my career late last century (yes I am THAT

There is no quick fix here. It takes time. But a few

old) I was often the youngest person in the room,

things make a real difference.

and usually the only woman. I worked alongside colleagues and clients whose experience exceeded

Reliability matters more than most people think.

my actual age, and I regularly walked into situations

Do what you say you will do, when you say you will

where I was very aware I didn’t look like everyone else.

do it. It sounds obvious, but consistency builds credibility. If something slips, communicate early.

In those moments, it felt like a choice.

A quick note to reset expectations goes further than

Fight or flight.

silence ever will.

If you know me, you might assume it was always

Data helps your ideas land. Clear, evidence-based

“fight.” It wasn’t that simple. There were deep

thinking makes it easier for others to see both the

breaths in the hallway, the occasional confidence-

value and the impact of what you are proposing.

boosting pose in the bathroom, and a steady stream

It also shifts the conversation away from opinion and

of quiet self-talk before stepping into a meeting

toward outcomes.

or presentation.

Treat “no” as information, not a dead end. It is easy to Was it hard? Yes.

take it personally. It is More useful to ask what can be

Did it always work? No.

learned from it. And if the answer is not obvious, ask.

Does it still happen? Also, yes.

Feedback, when you can get it, is a great shortcut.

But there are ways to manage it.

We often think of leadership as something tied to a title, senior roles, large teams, formal authority. In reality, meaningful change rarely starts there. It is often driven by individuals who do not have the “right” title, but do have credibility, consistency, and the trust of those around them.

Influence, without authority, comes down to trust.

Once people trust you, they listen. And once they

Influence, without authority, comes down to trust. Once people trust you, they listen. And once they listen, change has somewhere to start.

listen, change has somewhere to start.

74

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

Build your support network deliberately. This is not

for those at the top. They are practiced every day,

just about mentors. It is about peers, advocates, and

often quietly, by people who choose to engage rather

people who will back your ideas when you are not in

than step back.

the room. Change is rarely a solo effort.

You do not need to wait to be given permission to None of this guarantee’s success. Some

make a difference.

environments take longer to shift than others. Some will resist, even when the case is clear.

You just need to start acting like someone who already does.

But change does not wait for a title. www.linkedin.com/in/karen-stephens-bcyber

It builds through small, consistent actions. Through showing up prepared. Through following through.

www.bcyber.com.au

x.com/bcyber2

karen@bcyber.com.au

youtube.bcyber.com.au/2mux

Through earning trust over time and using it well.

The ability to influence outcomes, to shape decisions, to open doors for others these things are not reserved

I S S U E 31

WOMEN IN SECURITY MAGAZINE

75

CAREER PERSPECTIVES

MARINA AZAR TOAILOA

BEYOND DISCOMFORT: THE HARDEST CONVERSATIONS CAN SAVE LIVES

by Marina Azar Toailoa, Founder of the Mummy Safety Security Project

In security, we are trained to identify vulnerabilities,

development for educators. The focus is simple:

assess risk and act before harm occurs. Prevention is

prevent harm before it happens.

the standard.

THE UNCOMFORTABLE REALITY Yet when it comes to our most vulnerable children we

The data is confronting.

often wait until after a breach.

The Australian Child Maltreatment Study found that I spent years in law enforcement, witnessing crimes

28.5 per cent of Australians have experienced child

against children firsthand. What stood out was not

sexual abuse. In 2021, children under 18 accounted

only the actions of perpetrators, but a broader failure

for 49 per cent of all recorded sexual assault victims.

of prevention. Too often, children reach crisis points without the language, boundaries or confidence to

But prevalence is only part of the story. Silence is the

speak up.

deeper issue.

Why are we still waiting until harm has

Among survivors who engaged with the Royal

already occurred?

Commission into Institutional Responses to Child Sexual Abuse, 57 per cent did not disclose until

78

That question led to the creation of the Mummy

adulthood, with an average delay of nearly 24 years.

Safety Security Project a movement grounded in

eSafety’s 2025 Keeping Kids Safe Online research

frontline experience, translating law enforcement

adds another layer: 74 per cent of children reported

insight into practical, evidence-based prevention

exposure to harmful online content, and 53 per cent

education for children, alongside professional

experienced cyberbullying.

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

C A R E E R

P E R S P E C T I V E S

These are not isolated incidents. They reflect a

allows them to become normal, not something

pattern where harm occurs, and children carry

introduced only in response to fear or crisis.

it alone.

Children are already navigating the world. The If we know this, the question shifts. Not whether harm

question is whether we equip them to do so safely.

is happening but what we are doing to change the conditions that allow silence to persist.

WHAT EARLY EDUCATION LOOKS LIKE Effective early safety education is practical and

WHY EARLIER MATTERS

consistent. It does not rely on a single conversation,

The idea of starting these conversations at age two

but on everyday reinforcement.

can feel confronting. For some, it raises concerns about innocence.

It includes:

But body safety education at that age is not about

• Using correct anatomical language for all body

exposing children to adult concepts. It is about building simple, age-appropriate foundations: understanding their body, recognising boundaries, and knowing who to trust.

parts. This reduces shame and supports clear communication if a child needs to disclose harm.

• Teaching body autonomy. Children are allowed to say no to physical contact, even in situations framed as polite or expected.

By age two, children are developing language rapidly

• Explaining private parts in simple terms, such

and beginning to understand rules and relationships.

as areas covered by clothing, and reinforcing

That window matters. Introducing these ideas early

that these should not be touched without clear,

I S S U E 31

WOMEN IN SECURITY MAGAZINE

79

appropriate reason and trusted supervision.

The goal is not awareness alone, but capability.

• Distinguishing between surprises and secrets, and making it clear that no one should ask them to

PREVENTION IS THE STANDARD

keep secrets about their body.

In cyber security, we do not wait for an attack before

• Building a trusted network of adults. Children

implementing controls. We build frameworks, test

should know who they can speak to and

responses and prepare people to act under pressure.

understand that if one person does not listen, they can keep telling until someone does.

Child safety requires the same mindset.

None of this is complex. But it does require

Talking to a young child about their body, their

consistency and a willingness to have conversations

boundaries and their right to say no may feel

that may feel uncomfortable at first.

uncomfortable. But discomfort is not a reason to delay. In many cases, it is a signal that the

WHERE RESPONSIBILITY SITS

conversation matters.

Child safety does not sit with parents alone. It is a shared responsibility.

Because the alternative is silence.

Educators play a critical role. When they understand

And silence is where harm persists.

the signs of harm, model appropriate language and build safety into everyday classroom culture, they

At its core, this is about giving children something

become part of a child’s protective network.

simple but powerful: the language to speak, the confidence to use it, and the certainty that someone

At the Mummy Safety Security Project, this includes

will listen.

professional development across all levels from foundational child safety awareness and reporting

That is where prevention begins.

obligations through to more advanced training in risk assessment and emergency response. Parent

www.instagram.com/mummysafetysecurityproject

education is equally important, ensuring these conversations continue beyond the classroom.

80

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/marina-azar-toailoa-66259511a

J U LY • A U G U S T 2026

NICOLA JOHNSON

TESSA WILLIAMS

THE GALLAGHER SECURITY USER GROUP EVENT IN 2025 SETS AN ATTENDANCE RECORD

by Nicola Johnson, National Events Manager – Australia, Gallagher Security and Tessa Williams, National Marketing Manager – Australia, Gallagher Security

THE GALLAGHER SECURITY USER GROUP EVENT IN 2025 SET AN ATTENDANCE RECORD — WHAT DO YOU THINK CONTRIBUTED TO THAT SUCCESS?

the University of Sydney, alongside breakout and

Nicola: We host the Gallagher Security User Group

training at the conclusion of the event, which speaks

(GSUG) event every two years, and in 2025 it was

to the engagement.

networking sessions to allow our attendees to make those all-important connections. Nearly half of attendees also opted in to take part in additional

South Australia’s turn. We were delighted by the

82

strong early interest from across the industry, which

Tessa: While GSUG is held biennially, our ongoing

carried through to our highest-ever GSUG attendance.

marketing and communications efforts supported

More than 100 valued industry colleagues joined us

by a strong calendar of events, help foster sustained

for the two-day event. Early in the planning process,

interest from the security industry. Gallagher

we curated an agenda which acted as a real drawcard

speakers and guests from our Australian, APAC IMEA,

for the industry, drawing from insights from our

and Global Head Office teams travelled to GSUG

annual Gallagher Security Trends Report which

to meet, listen to, and learn from our End Users.

highlighted a need for more industry education.

Bringing people together in person makes a huge

This data-led approach helped us secure engaging

difference in this area. We know attendees value

speakers, such as Jodie Lowe, Senior Product Owner,

hearing real-world experiences of how our products

Information Communications and Technology at

support our End Users, and they also appreciate the

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

C A R E E R

P E R S P E C T I V E S

opportunity to network, and experience the Gallagher system in person. It’s all about the face-to-face and hands‑on experience.

HOW DO YOU APPROACH DESIGNING EVENTS AND MARKETING STRATEGIES THAT TRULY ENGAGE THE SECURITY COMMUNITY? Nicola: When planning major events, we collaborate closely with our sales and technical internal teams to understand the topics and content our Channel Partners and End Users want to learn more about.

Drawing on our long-standing relationships across the industry and with our End Users, we weave these insights into events people genuinely don’t want to miss - and the results speak for themselves. Over the past 12 months, each of our registered events has seen stronger demand than the last. To truly engage our community, we set ourselves a high bar of running professional, high-quality events that reflect the strength of the Gallagher system itself, and our people who support it - and we look for ways to build on that success with every event we host.

Having the right people is key, supported by our strong team of experts based across Australia who

Tessa: Our deep understanding of our audience

are committed to sharing knowledge nationwide.

allows us to design, host, and deliver events that meet

What happens after the event is just as important

the evolving needs of the security industry, ensuring

– like capturing and sharing key insights internally,

attendees walk away with practical insights they can

whether that’s valuable conversations, requests for

apply in their day-to-day work.

more information, or passing leads on to our broader Australian team.

IN YOUR VIEW, WHAT ROLE DOES COLLABORATION PLAY IN STRENGTHENING AUSTRALIA’S SECURITY INDUSTRY NETWORK? Tessa: Collaboration plays a critical role in strengthening Australia’s security industry, particularly by creating space for people to learn and share beyond the walls of their own organisations. When industry professionals come together, they gain exposure to different perspectives, challenges, and solutions, some of which they may not encounter in their day-to-day roles.

Collaboration opens the door for honest discussion and practical problem-solving, and over time, that lifts the capability of the whole industry, not just individual teams.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

83

and communities safe, and there’s a real sense of satisfaction in seeing the difference that can make beyond the technology itself. Gallagher’s purpose, which is to protect what matters most, resonates strongly with me, and partnerships like Bravehearts, a leading Australian child protection organisation, bring that purpose to life in a very tangible way. Supporting community organisations also helps them grow through stronger local connections, and being part of that journey is incredibly rewarding both personally and professionally.

Our Australian and state-based teams are encouraged to support important national and local community projects, from Bravehearts through to the Bloom PopUp Café in Melbourne and the Bennelong Cup in NSW. That collective effort strengthens our connection to

COULD YOU SHARE SOME INSIGHTS INTO HOW YOU BALANCE CREATIVITY WITH THE TECHNICAL AND OPERATIONAL ASPECTS OF THE SECURITY SECTOR?

the communities around us and to each other.

Nicola: Balancing creativity in a technical industry

stronger connection to the work, and to the people

really comes down to how you tell the story. We

around you.

Nicola: I feel that same sense of purpose through Gallagher’s community involvement. It gives you a

try to keep it grounded in real examples and actual outcomes where Gallagher solutions have helped

Through our roles, we can give back and contribute to

organisations solve something, work smarter, or get

causes that extend well beyond our own organisation,

more value out of what they’re doing.

which supports both personal growth, professional fulfilment, and most importantly – provides support

Creativity also plays a key role in the look and feel

to those who need it.

of our events and experiences. We place emphasis

like interactive elements, QR codes on tables, and

HOW DO INITIATIVES LIKE THE CHARITY GOLF DAY CONTRIBUTE TO BUILDING A STRONGER, MORE CONNECTED INDUSTRY CULTURE?

branded merchandise.

Nicola: Initiatives like the Charity Golf Day play an

on quality and interaction, from the way a space is themed and designed to thoughtful touches

important role in reinforcing our responsibility to give These details elevate the experience and reflect the

back to the communities we operate in. They create

professionalism of the security sector, while still

an environment where industry can come together

creating an engaging and memorable environment.

in a more relaxed setting, build genuine connections, and unite around a shared purpose that goes beyond

GALLAGHER’S PARTNERSHIP WITH BRAVEHEARTS IS AN INSPIRING EXAMPLE OF CORPORATE SOCIAL RESPONSIBILITY — WHY IS COMMUNITY INVOLVEMENT IMPORTANT TO YOU PERSONALLY AND PROFESSIONALLY?

business. Over time, the Charity Golf Day has become a flagship event on the industry calendar, with strong year‑on‑year growth that reflects how much the industry values opportunities to connect while contributing to something meaningful.

Tessa: Community involvement connects directly

84

to the impact of what we do every day. Our

Tessa: The Charity Golf Day also shares the

solutions play a role in keeping people, places,

Bravehearts mission with our wider industry

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

C A R E E R

P E R S P E C T I V E S

community. For many attendees, it’s their first

through the industry. Ultimately, it strengthens

exposure to the work Bravehearts does and the

the industry by ensuring leadership reflects the

difference it’s making. Without this annual event,

communities and customers we serve.

we wouldn’t have the opportunity to engage more than 100 people in those important conversations or reach a new audience that Bravehearts may not otherwise connect with – as every dollar supports their incredible work.

WHAT ARE YOU MOST EXCITED ABOUT FOR 2026 AND BEYOND — EITHER FOR GALLAGHER SECURITY OR FOR YOUR PERSONAL CAREER GOALS? Tessa: Looking ahead to 2026 and beyond, I’m

It’s that shared experience that builds awareness over

excited about continuing to strengthen our connection

time. The fact it’s grown into the largest fundraising

with the communities we support while building on

event delivered by a Bravehearts partner is something

the strong relationships we have across the industry.

we’re genuinely proud of and it speaks to what can

I’m also excited about maintaining consistency in the

happen when people come together around a cause

market and continuing to unlock more for Australian

like this.

customers by showcasing the power of our solutions and the real difference they make. Supporting

WHAT DOES FEMALE LEADERSHIP REPRESENTATION MEAN TO YOU WITHIN THE SECURITY INDUSTRY CONTEXT?

engagement, education, and connection through our growing calendar of events and tradeshows remains a key focus for me.

Both: Female leadership representation is incredibly important. Visibility really matters - seeing women

Nicola: 2026 is shaping up to be an incredibly

in decision-making positions, having a voice at the

exciting year creatively. I’m looking forward to

table, and speaking at industry events helps create

bringing our major events to life, particularly the

a more inclusive, balanced industry where different

upcoming Security Exhibition and Conference, and

perspectives are valued and reflected in how we lead,

our Australian team conference, by designing new

innovate, and connect. When women are visible in

experiences that are engaging, memorable, and

leadership, it creates pathways for others coming

aligned with the Gallagher brand. Security Exhibition and Conference, as our largest trade show, presents a great opportunity to push creative boundaries through new stand designs, activations, and ways to connect with attendees.

IF YOU COULD GIVE ONE PIECE OF ADVICE TO WOMEN ASPIRING TO LEAD IN MALEDOMINATED INDUSTRIES, WHAT WOULD IT BE? Tessa: Your credibility grows when you speak up early, take up space, and make decisions with confidence – even while you’re still learning. Most leaders, regardless of gender, are figuring it out as they go. The difference is that women are often taught to wait until they feel “ready”. www.linkedin.com/in/nicola-johnson-273147b1

www.linkedin.com/in/tesswilliamsnz

I S S U E 31

WOMEN IN SECURITY MAGAZINE

85

TO THE SPONSO

CATEGORY SPONSOR

CATEGORY SPONSOR

PHOTO BOOTH SPONSOR

EMERALD SPONSOR

NETWORKING DRINK

EMERALD SPONSOR

WOMENINSECURITYAW

ORS OF THE

CATEGORY SPONSOR

KS SPONSOR

CATEGORY SPONSOR

EMERALD SPONSOR

EMERALD SPONSOR

CATEGORY SPONSOR

EMERALD SPONSOR

ASSOCIATION SPONSOR

WARDS.COM.AU | #2026WISAWARDS

MERCHANDISE SPONSOR

MADHURI NANDI Madhuri Nandi is a cybersecurity leader with nearly two decades of experience spanning strategy, governance, risk, compliance, product, and engineering. Recognised as the Global Cyber Security Leader of the Year (2025 and 2026), she is known for building security programmes that balance business outcomes with human-centred leadership.

The questions we stop asking: courageous conversations through real cybersecurity leadership Children ask questions adults tend to move past.

Some of the hardest conversations in cybersecurity are not technical. They are about whether the way

Why should passwords be stronger?

we work is still sustainable. They ask leaders to look

Why shouldn’t we trust every link?

beyond dashboards, incident reports, and compliance

What actually happens when something goes wrong?

metrics, and pay attention to what teams are actually experiencing.

They keep going until the answer makes sense.

I have also seen organisations become highly In cybersecurity, that instinct matters more than we

effective at demonstrating governance without

often admit.

necessarily strengthening accountability. Controls exist. Policies are documented. Reports are

Because many problems do not begin when

circulated. On paper, everything appears mature.

systems fail. They begin earlier when questions stop, assumptions go unchallenged, and silence starts to

The real test comes when something unexpected

feel normal.

happens and ownership is unclear.

Over time, a different pattern can take hold in

One example stands out. During a review of access

organisations. The conversations that matter most

governance, the control looked solid: regular reviews,

become the ones least likely to be questioned.

documented approvals, structured reporting. From a

Processes continue because they always have.

compliance perspective, it held up well.

Teams adapt to pressure without always naming it. Burnout is reframed as resilience. Governance

But a closer look told a different story.

looks complete on paper while gaps quietly grow in practice.

Reviews were being completed, often without full operational context. Access was approved because it

Curiosity gives way to assumption.

had always existed, or because ownership had shifted over time without being clearly reassigned. No one

I have seen teams praised for “always delivering”

was acting incorrectly. It was the slow accumulation

while operating under sustained pressure. The ability

of assumptions.

to absorb that pressure becomes valued more than

88

the willingness to question it. Over time, that trade-

What changed was not the control itself, but

off is rarely made explicit—but it shapes culture all

the clarity around it. Ownership was simplified.

the same.

Responsibilities were made explicit. Teams

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

She holds a Master’s degree in Cybersecurity Digital Forensics and currently serves as Head of Security at Nuvei and Chair of the AWSN National Board. Madhuri is the author of Cyber Smart and creator of a cybersecurity awareness framework focused on making security more accessible and practical for everyday users. She is a strong advocate for inclusive leadership, mentorship, and community building across the cybersecurity industry.

C O L U M N

reconnected with the purpose behind the process,

This gap extends beyond the workplace.

so it stopped being a routine exercise and became a

Cybersecurity awareness is growing, but

meaningful control.

understanding does not always keep pace. People know they should be careful, but not always why. The

The improvement did not come from adding more

behaviour is there; the reasoning is thinner.

processes. It came from restoring intent.

Children keep asking until something makes sense.

Courageous conversations also shape who gets heard and who does not. In many organisations,

Organisations often stop asking once something

the same voices dominate by default. Operational

sounds acceptable.

perspectives often arrive late, if at all.

Perhaps courageous conversations are not about Yet some of the most useful insights come from

having the loudest voice in the room. Perhaps they

those closest to the work: teams managing day-to-

begin with staying curious a little longer than is

day risk, early-career professionals who still question

comfortable and not letting the first answer be the

what others have accepted, and people who approach

final one.

problems from a different angle.

When those perspectives are included earlier, risks

www.linkedin.com/in/madhurinandi

surface sooner and decisions tend to hold up better under pressure. Inclusion is not separate from security outcomes. It influences them directly.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

89

STUDENT IN SECURITY SPOTLIGHT

response, digital forensics, risk and governance, cloud security, penetration testing, and even security awareness and training. That means people with SARA HASHI

very different strengths can find a place in it, whether they’re technical, analytical, detail-focused, or strong communicators.

Sara Hashi is currently studying a Bachelor of Cybersecurity at Deakin University Bachelor of Cybersecurity student at Deakin University

For me, the most meaningful part is knowing the work has real-world impact. You’re helping protect organisations and individuals from harm that isn’t theoretical, it’s happening every day. That sense of purpose is what makes the challenges worth it.

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

When I first thought about studying cybersecurity, I honestly pictured it as something very technical

I usually describe cybersecurity as the part of the

hacking systems, writing code all day, and using

digital world that quietly keeps everything safe.

advanced tools to catch attackers. I thought the focus would be mostly on breaking into systems or

So much of our daily life now runs through

defending them in a very hands-on, technical way.

technology, whether it’s banking, healthcare, studying, or just staying in touch with people.

While those elements definitely exist, my experience

Cybersecurity sits behind all of that, making sure

has shown me that cybersecurity is much wider

our information stays private, systems stay reliable,

and more human than I initially expected. It’s not

and trust isn’t broken. It’s not just about computers

just about tools or technical skills, but also about

or code, it’s really about protecting people in a world

ethics, communication, risk management, legal

that happens to be digital.

considerations, teamwork, and critical thinking. I’ve come to understand that behind every system and

What makes it so interesting is how fast it moves.

every alert, there are real people and organisations

There’s always something new happening, new

who can be impacted by the decisions we make.

threats appearing, new tools being built, and new ways attackers try to get in. Because of that, you’re

For example, when I started learning about areas

always learning and adapting. A big part of the work

like data privacy and digital forensics, it became

is thinking critically and solving problems before they

clear that this field requires a lot of responsibility

turn into real issues, which can feel a bit like being a

and attention to detail. It’s not just about finding

step ahead in a constantly changing game.

information, but making sure it’s handled correctly, ethically, and in a way that can stand up to scrutiny.

I also like to point out that cybersecurity isn’t just

92

one type of job. People often think it’s all coding

Some of the technical topics, like networking,

or hacking, but it’s actually a really broad field.

programming, and packet analysis, definitely took

You’ve got areas like security analysis, incident

time to click. There were moments where it felt

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

S T U D E N T

I N

S E C U R I T Y

challenging, but working through practical exercises helped everything make more sense. Over time, I started to feel more confident as I could connect what I was learning in theory to real-world situations.

S P O T L I G H T

When you decided to pursue a career in cybersecurity, how did your parents, peers, or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

Overall, my view of cybersecurity has shifted quite a

When I decided to pursue cybersecurity, the

bit. I now see it less as a purely technical discipline

reactions around me were mixed.Some people

and more as a profession that blends technology

were supportive and saw it as a strong career path

with people, ethics, and problem-solving. It’s this

because technology is growing and cybersecurity

combination that makes it both challenging and

skills are in demand. Others did not fully understand

genuinely interesting.

what cybersecurity involved and assumed it was only about hacking or sitting behind a computer all day. I

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

would not describe it as strong opposition, but there were moments where I had to explain my choice more clearly.

After graduation, I am interested in securing a role such as a Cybersecurity Analyst, Security Operations

I had to explain that cybersecurity is not just one

Centre Analyst, or Junior Security Engineer.These

narrow area. It includes protecting data, securing

roles interest me because they provide a strong

networks, investigating,understanding privacy, and

foundation in understanding real security threats,

helping organisations manage risk. I navigated

monitoring systems, analysing alerts, responding

this by focusing on my own goals and continuing

to incidents. What motivates me is the practical

to learn more about the field.The more practical

nature of the work. I like the idea of investigating

tasks I completed, the easier it became to explain

suspicious activity, identifying patterns,and helping

why cybersecurity matters. I also reminded myself

organisations respond to cyber risks. I also think

that choosing a career path is

these roles would allow me to keep learning and

a personal journey. Not

gradually build stronger technical skills in areas

everyone will understand

such as networking, threat detection, vulnerability

it at first, but that

management, and incident response.

does not mean the choice is wrong.

I am also motivated by the fact that cybersecurity

Over time, I became

has a direct impact on people and organisations.

more confident in my

A good security professional helps prevent data breaches, protects sensitive information, and supports safer digital environments. That sense of purpose is important to me because I want a career where my work feels useful and meaningful. Starting in an analyst or junior engineering role would also give me exposure to different areas of cybersecurity, which would help me decide where I want to specialise in the future.

I S S U E 31

WOMEN IN SECURITY MAGAZINE

93

SARA HASHI

is in almost

Recount the most memorable or significant event in your cybersecurity journey to date, highlighting why it left a lasting impression.

every industry.

One of the most memorable parts of my

decision because I could see how valuable cybersecurity

cybersecurity journey was completing practical

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations

digital forensics and network analysis tasks. These

The most influential factor

when you know what to look for.

activities stood out because they showed me how cyber evidence can be collected, analysed,and interpreted. Instead of only reading about attacks or security concepts, I was able to work with evidence and tools directly. For example, analysing network packets or examining digital evidence helped me understand how much information can be found

in my cybersecurity journey so far has been the practical

It also showed me how careful and accurate

learning experience. Before

cybersecurity work needs to be. A small detail,

completing hands-on tasks, many concepts felt

such as an IP address, timestamp, file name, or

abstract. However, when I started working with

protocol, can change how evidence is interpreted.

tools, analysing network traffic, writing programs,

This experience left a lasting impression because

and completing security-related activities,the field

it made cybersecurity feel real. It showed me that

became much more real to me. Practical work

cyber incidents are not just theoretical problems;

helped me understand that cybersecurity is not just

they involve actual systems, users, data, and

about memorising definitions. It is about applying

consequences. It also helped me appreciate the

knowledge, solving problems, and thinking carefully

responsibility that comes with working in the field.

about how systems behave.

That experience made me more interested in analysis-based roles, especially areas such as digital

For example, working with networking concepts,

forensics, incident response, and security monitoring.

Wireshark, Python programming, and digital

in roles that involve investigation, analysis, and

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

problem-solving. I enjoy tasks where I need to look

Right now, most of my cybersecurity experience

at evidence, understand what is happening, and

comes from hands-on university work rather than a

explain my findings clearly. It also showed me that

formal job or internship, but it has still felt very real

I still have areas to improve, but that improvement

and practical.

forensics tasks helped me see how different areas of cybersecurity connect. This has impacted my career aspirations by making me more interested

comes with practice and consistency.Overall, handson learning has shaped my confidence and helped

Through my studies, I have spent time using tools

me see cybersecurity as a realistic and meaningful

and techniques like Python scripting, network

career path.

analysis, digital forensics labs, secure coding exercises, packet inspection, and basic vulnerability

94

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

tasks have pushed me to think more logically,

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape?

automate little tasks, and troubleshoot on my own.

My course has given me a really solid base to

assessment. Working with Wireshark, for example, helped me actually see and understand what is happening in network traffic, and the programming

work from, especially in areas like networking, I have not yet worked in a cybersecurity role, and I am

programming, cybersecurity fundamentals, digital

honest about that, but it is where I am heading. I am

forensics, and data analysis. Those core concepts

actively building my skills, growing my confidence,

feel important, because even though the tools and

and preparing for entry-level opportunities by doing

threats keep changing, the underlying ideas about

labs, projects, and practice scenarios whenever I can.

how systems and networks work don’t.

I am also focused on developing a stronger technical portfolio so I can show what I can do, not just talk

At the same time, I’m very aware that studying on

about it.

its own is not enough in this field. New attacks, technologies, and tools show up all the time, so I’ve

These academic and project-based experiences have

had to take some ownership of learning beyond

been a valuable starting point for me. They have

the classroom. For me, that looks like keeping up

helped me figure out which areas of cybersecurity I

with security news, doing extra labs, trying out

enjoy most, and where I still need to stretch myself

practical exercises, and paying attention to real-world

and keep learning.

case studies.

SARA HASHI

has given me the foundation I need, and I also know

Are you actively engaged in the broader cybersecurity community? If so, what has been your involvement, and how has it enriched your experience?

that if I want to grow in cybersecurity, I have to keep

Yes, I do make an effort to stay connected with the

learning well beyond my formal studies.

wider cybersecurity community, especially with

I’ve found the best mix is using university for structure and fundamentals, then layering my own learning on top to stay current. I feel like my program

women in the field.

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management?

If yes, why?

On LinkedIn, I follow industry professionals, women in cyber, and security-focused pages. People like Chantelle Ralevska, and platforms such as Cyber Daily and Women in Security Magazine, are really

I definitely see non-cyber skills as a big part of

helpful because they share updates, career stories,

working in cybersecurity, not just a “nice to have.”

events, and different pathways into the industry.

Seeing those posts pop up in my feed makes

The technical side matters, of course, but it only gets

cybersecurity feel much more real and reachable.

you so far if you can’t explain what you’re seeing to other people. A lot of the job is helping non-technical

It has also been encouraging to see women talk

teams understand what a risk actually means for

honestly about their careers in security. It reminds

them: why a vulnerability matters, why a control or

me that there isn’t just one “right” way to enter the

policy is necessary, or what they need to do after an

field, and that people have taken very different routes

incident. If the explanation is buried in jargon, people

to get where they are. I try to keep up with current

either switch off or don’t take the right action.

threats, local and global events, and professional conversations online, so I can link what I’m learning

That is where communication and people skills really

at university to what is actually happening out there.

come in.

All of this has helped cybersecurity feel less like just Cybersecurity work is almost always collaborative.

a degree on paper and more like a community I’m

You are dealing with IT, management, legal, frontline

gradually becoming part of.

staff, and sometimes clients, all looking at the same issue from different angles. Being able to listen, ask good questions, and adapt how you explain

www.linkedin.com/in/sara-hashi-88b6892a8

something helps build trust and makes it easier to get people on board with security decisions.

As you move further in your career, I think leadership and management skills become even more important. It is not just about fixing technical problems anymore. It is about making judgment calls, weighing up risk, and supporting teams through incidents that can be stressful and high-pressure.

That human side of the work is just as real as the technical side.

96

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

Join Us in Empowering

Future Leaders

! d e t n a W y it r u c e S in Students Are you a student passionate about shaping the future of security?

Do you have innovative ideas and insights to share with a global audience? Join us in contributing to the Women in Security Magazine and become a voice for the next generation of security leaders!

Why contribute?

Gain valuable exposure: Reach over 11000 subscribers globally and showcase your expertise to industry professionals.

How to get involved

Make an impact: Share your experiences, challenges, and aspirations to inspire others and shape the future of security.

Let us know you are interested.

We will send you a series of questions of which you can choose which ones you would like to answer.

Submit those back to us in an email.

We will then edit to be a concise and flowing edited Q&A.

Don't miss this opportunity to be part of a vibrant community of students driving change in the security industry.

Contact us today to learn more about how you can contribute to the Women in Security Magazine!

Contact: jane@source2create.com.au

responders, or the many career paths that exist beyond the technical side, including governance, policy, risk management, privacy, and ethics.

LAUREN MAURO

Both my university studies and internship have helped bring those concepts to life. At university,

Lauren Mauro is currently studying a Bachelor of Cybersecurity at the University of Technology Sydney (UTS) Bachelor of Cybersecurity student at the University of Technology Sydney (UTS)

I’ve been learning the theory behind areas such as incident response, ethical hacking, and SIEM technologies. Through my internship, I’ve had the opportunity to apply some of that knowledge in practice by investigating phishing emails, responding to alerts, and analysing real-world security events.

Those experiences have shown me just how analytical and investigative the field can be.

Perhaps the biggest lesson I’ve learned is that

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

cybersecurity is far less about individuals working

When I first thought about cybersecurity as a

organisations. It’s a field that combines technology,

career, my view was shaped largely by movies, TV

problem-solving, communication, and teamwork and

shows, and the stories you see online. I imagined

that’s something I’ve come to appreciate far more

cybersecurity professionals as lone hackers sitting

than the image I had when I first started.

in isolation and far more about people working together. Protecting digital environments requires collaboration across teams, disciplines, and

behind screens, constantly battling cyber criminals and breaking into systems. To me, the industry seemed to revolve almost entirely around offensive security and catching attackers.

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

After graduation, my goal is to start my career in

As I’ve progressed through my studies and gained real-world experience, I’ve realised how different and much broader the

a technical role, ideally as a Security Operations Centre (SOC) Analyst. I’m really interested in understanding cybersecurity at its core how threats

reality is. Ethical hacking

are detected, how incidents are investigated, and

is certainly an important

how organisations defend themselves against

part of cybersecurity,

constantly evolving risks. Working in a SOC would

but it’s only one piece

give me the opportunity to build that strong technical

of a much larger puzzle.

foundation and gain hands-on experience with the

Before starting university, I

tools, processes, and challenges that security teams

had no idea about the scale

face every day.

of the infrastructure and

98

teamwork required to keep

As I continue to grow in my career, I can see myself

organisations secure. I wasn’t

gradually moving towards roles that combine

aware of Security Operations

technical knowledge with communication and

Centres, the role of incident

strategy. One aspect of cybersecurity that I’ve come

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

to enjoy is the human side of the profession. I find

When I decided to pursue a career in cybersecurity,

a lot of satisfaction in taking complex technical

my parents were my biggest supporters. They could

concepts and translating them into something clear

see how much I had always loved computers and

and meaningful for different audiences. Whether

technology, even as a child, and they encouraged

that’s through report writing, policy development,

me to explore a career that aligned with those

or helping others understand security risks, I enjoy

interests. While I wasn’t entirely sure which path

bridging the gap between technical and non-

within technology was right for me, they helped me

technical stakeholders.

recognise that cybersecurity combined my curiosity, problem-solving skills, and passion for technology in

Long term, I would love to move into a leadership

a way that felt like a natural fit.

position, such as a Security Manager or Director.

My ambition is not only to help shape security

Not everyone understood my decision, though.

strategy, but also to support and develop the people

Throughout high school, I was heavily involved in

around me. I believe that having a strong technical

humanities subjects and performed well in them.

background will make me a more effective leader,

At my all-girls school, technology-related subjects

allowing me to understand the challenges my teams

weren’t widely available or encouraged, so pursuing

face while helping organisations make informed

a career in cybersecurity wasn’t a common path.

decisions about their security future.

In fact, out of a graduating class of more than 100 students, only two of us chose to enter the

When you decided to pursue a career in cybersecurity, how did your parents, peers, or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

I S S U E 31

technology industry.

Because of my academic background, many of my peers and even some career advisors were surprised by my choice. They often questioned why I would

WOMEN IN SECURITY MAGAZINE

99

LAUREN MAURO

move into such a technical field when my strengths

always helped me build my confidence and actively

appeared to lie elsewhere. At the time, those

pushed me to attend industry events. She always

reactions made me second-guess myself. I wondered

took the time to listen, offered invaluable advice

whether I truly belonged in cybersecurity and whether

for the challenges I faced and provided much

I was making the right decision.

needed reassurance. Saba also introduced me to a completely different side of the industry I did not

Looking back, I realise much of that confusion

know existed, which is threat intelligence.

stemmed from long-standing perceptions about who “fits” in technology careers. Cybersecurity and

These influences have impacted my career

IT have traditionally been viewed as male-dominated

aspirations exponentially. By introducing me to threat

fields, and there can still be assumptions about the

intelligence, Saba showed me how technical analysis

types of people who succeed in them. Rather than

links to understanding human behaviour and threat

allowing those perceptions to define me, I learned to

actors, which aligns with my desire to transition

trust my own interests and instincts.

into a role more focused on communication.

Furthermore, the immense support from my parents

What I’ve come to appreciate is that my humanities

and the positive experience of having a mentor like

background isn’t separate from cybersecurity it’s

Saba have inspired my long-term goal of moving

one of my strengths. Cybersecurity is ultimately

into leadership. I want to become a manager or

about people as much as technology. Strong

director so I can provide that exact same guidance

communication, critical thinking, understanding

and encouragement to the next generation of women

human behaviour, and the ability to explain complex

in cybersecurity.

ideas clearly are all incredibly valuable skills. The further I progress in my journey, the more I realise that the qualities that once made others question my path are actually some of the reasons I belong in this field.

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

I have actively sought out experience so I can build

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

a strong foundation in both IT and cybersecurity. My

My parents have been incredibly influential in

through a Jira ticketing system, and shadowed senior

shaping my early journey. Specifically, my dad has

technicians. This experience was instrumental in

encouraged me to take risks, get involved and apply

developing my networking and troubleshooting skills.

first exposure to the industry was as an IT Helpdesk Intern at Navitas. In this role, provided technical support, resolved hardware and connectivity issues

for every opportunity, even if I doubt my abilities. He has always been willing to speak to people on my

Following that, I completed a Corporate Security

behalf to help me network and always lets me know

Internship at Mastercard, where I gained significant

if there are any industry events I may be interested

hands-on cybersecurity experience. I worked directly

in. My mum has also been supportive, consistently

on incident response projects, analysing malware

pushing me to step out of my comfort zone and

behaviour, network traffic, and browser artefacts to

tackle new challenges.

identify indicators of compromise. I used industrystandard tools like Wireshark, VirusTotal, and

100

Professionally, my mentors have played a massive

CyberChef to conduct this analysis. Additionally, I

role, especially my mentor Saba Bagheri. Saba

investigated sophisticated phishing campaigns and

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

conducted data analysis on flagged communications

attacker methods helps you think more effectively

to identify false positives. This data was delivered

about security. However, many entry-level roles in

to Microsoft to help significantly improve their

cybersecurity are in Security Operations Centres

detection accuracy.

and other defensive environments, so I think degrees would benefit from more teaching around

My time at Mastercard also allowed me to

SIEMs, monitoring, alert triage and how to respond

explore the strategic side of security. I developed

effectively in a defensive role.

a comprehensive security framework and risk

me develop strong cross-team communication and

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management?

If yes, why?

report writing skills, and sparked my interest into

Absolutely! Technical skills are the foundation of

moving to a non-technical role.

cybersecurity, but I genuinely believe that non-

mitigation strategy for a major corporate event, successfully securing stakeholder approval. I also produced security insight reports analysing major Australian breach case studies. These tasks helped

technical skills are just as critical for long-term

Do you believe there are areas in cybersecurity that deserve more emphasis in your coursework or areas that could receive less focus?

career success. The ability to communicate clearly,

When I reflect on my coursework, there are definitely

further you progress.

collaborate across teams, present findings to nontechnical stakeholders are all skills that are vital at the beginning of the career, but instrumental the

a few areas that deserve greater emphasis. One of the main gaps, in my experience, is a stronger focus

A piece of feedback I received from a recruiter

on IT fundamentals within my specific degree. In my

has stuck with me, where they mentioned that the

first year, I only had limited exposure to areas such

managers of my team said that “you can teach

as networking and operating system fundamentals,

cybersecurity, but you can’t teach soft skills and

and because they were not fully revisited enough in

passion.” Technical knowledge can be trained and

depth later in the degree, it has been difficult to retain

developed over time, but communication, curiosity

and build on that knowledge. As cybersecurity relies

and the ability to work well with others are qualities

so heavily on understanding how systems, networks

that are much harder to build.

and infrastructure works, a stronger and more sustained foundation in those areas would be valuable.

This is why I believe universities should put more emphasis on developing soft skills as part of any cybersecurity degree. At the moment, at my

From a cybersecurity perspective, I also think there could be

university, many opportunities to build these skills, such as networking events and presentations,

more focus on defensive

are optional. They should be embedded into the

and operational security.

curriculum and should be mandatory. Cybersecurity

Most of my subjects

professionals regularly need to brief leadership, write

have leaned more

reports for non-technical audiences and work cross-

towards the offensive

functionally with other teams, so preparing students

side, which is

for this reality is just as important as teaching

definitely important

them technicalities.

as understanding

I S S U E 31

WOMEN IN SECURITY MAGAZINE

101

LAUREN MAURO

Reflecting on your journey thus far, would you, with the benefit of hindsight, make any changes to your career trajectory? If yes, what adjustments would you consider?

an informal interview. However, my more recent roles,

There are a few things I would approach differently

Typically, the process began with a resume

with the benefit of hindsight. The most significant

screening, sometime followed by a psychometric

change I would make is starting my job search and

test. From there, it would move into the interview

opportunity hunting much earlier. I would encourage

stage, which could take several forms. This included

myself to begin looking for internships, cadetships

phone screenings, recorded online interviews where

and industry programs at the end of first year, so that

you are given questions and asked to record your

applications and experience could be lined up for

responses, and in some cases group interviews and

second year onwards. This would allow me to learn

assessment centres. After that initial round, there

content from university more tangibly and learn from

were usually one or two further interviews with

successes and rejections.

managers or senior stakeholders. Across multiple

including a cadetship and internship, involved a much more lengthy process.

applications, I found this process regularly stretched I would also push myself to be far more proactive in

over several months, which can feel discouraging.

general. Applying for things feels daunting early on, especially when you feel like you do not have enough

The most important lessons I took from this

experience yet, but this mindset can hold you back.

experience are patience, preparation and confidence.

Most opportunities are designed with students in

It is easy to feel deflated when a process drags on

mind, and the only way to find out if you are a good

or when you do not hear back for weeks at a time,

fit is to just apply.

but persistence is essential. Preparing thoroughly in advance, researching the company and practicing

Finally, I would have invested more time and energy

your responses makes a huge difference. My biggest

into networking from the beginning. Attending

piece of advice, especially to other students just

industry events, connecting with professionals and

starting out, is to be yourself throughout the process,

building relationships early in your degree, even just

fake the confidence until it becomes real and present

with your university professors, opens doors that

yourself professionally in your tone and demeanour.

applications cannot. Some of the most valuable

Hiring managers respond to authenticity and

things I have gained in my career so far have come

enthusiasm, and those qualities are just as important

through people, so if I could go back, I would have

as your technical knowledge!

prioritised building connections from day one.

Have you actively sought employment opportunities in the cybersecurity field, and if so, what has been your experience with the application and interview process?

www.linkedin.com/in/lauren-mauro-325853269

I have actively sought out opportunities in IT and cybersecurity, and the application process has taught me a lot about patience and persistence. One of my internships came from referral, which meant the process was relatively straightforward and involved

102

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

When I first looked at cybersecurity, I saw it as a very technical space—hands-on, tool-driven, quite narrow SHAFIA HUSNA

in scope. That’s what I expected going in.

But the more time I’ve spent on it, the more that initial

Shafia Husna is currently undertaking her Doctor of Philosophy at Adelaide University Doctor of Philosophy student at Adelaide University

view has shifted. It’s not just about tools or systems.

It’s about how everything connects networks, people, data, trust. You start to see the bigger picture pretty quickly, especially when you’re working in areas like AI-driven threat detection. There’s a lot of thinking involved. You test things, question assumptions, try again. It’s less about knowing all the answers and more about staying curious and being willing to

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

adapt as things change.

the stuff people rely on every day. Banking,

When you decided to pursue a career in cybersecurity, how did your parents, peers, or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

healthcare, and even how we get around; all of it runs

I was pretty lucky, to be honest. I’ve got a really

on digital infrastructure, and cybersecurity is what

supportive circle around me, so when I decided I

keeps that from being exploited or falling apart.

wanted to move into cybersecurity, the response was

I usually describe cybersecurity as the point where tech meets real life. It’s not just code and systems it’s

overwhelmingly positive. My family and friends were What makes it interesting is that it never sits still.

just glad I’d found something I genuinely cared about

The threats change constantly, so you’re always

and wanted to pursue properly.

thinking on your feet. Some days it does feel like solving a puzzle, but it’s not abstract there’s a real

It also helped that I already knew a few people

consequence if you get it right (or wrong).

building careers in this field. Seeing what they were doing made it all feel a bit more real and more

It’s also more varied than people expect. There’s the

achievable. They’ve been generous with advice too,

technical side, of course, but also forensics, policy,

which makes a difference when you’re still finding

risk, even understanding human behaviour, such as

your feet.

people clicking, trusting, or making mistakes. So

104

you don’t have to fit a single mould to belong in the

I didn’t run into any real pushback. If anything, the

field. There’s room for different ways of thinking,

encouragement made it easier to commit and keep

which is part of what makes it such a good career to

going, especially in those early stages where you’re

grow into.

figuring things out as you go.

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

A big turning point for me was getting involved in

apply concepts through practical exercises and

research-focused cybersecurity projects. Working

experimentation has helped me develop a much

on things like intrusion detection, network security,

deeper understanding of how cybersecurity works in

even bits of malware analysis and cryptography, it

real-world environments.

shifted how I saw the field. It stopped feeling like just a career path and started to feel like a space where I

At the same time, I believe some of the most

could ask better questions and actually contribute to

valuable learning happens outside the classroom.

solving problems that are still evolving.

Cybersecurity is a field that rewards curiosity, and I have found it important to explore personal projects,

I’ve also had strong guidance along the way.

participate in online learning opportunities, and

My academic mentors have been incredibly

engage with the wider security community. Keeping

supportive not just in a formal sense, but in how

up to date with industry news, emerging threats, new

they’ve encouraged my curiosity and pushed me

technologies, and current research has helped me

to think more broadly about where cybersecurity

better understand how quickly the field changes and

is heading, especially with AI in the mix. That has

has reinforced the importance of continuous learning

certainly played a big role in shaping what I want to

throughout a cybersecurity career.

do next.

At this point, continuing into advanced research feels

What aspect of your cybersecurity studies excites you the most, and why?

like a natural step. I’m hoping to take that further

What excites me most about cybersecurity is its

through my PhD focused on cybersecurity, privacy,

growing connection with artificial intelligence.

and AI.

I am particularly interested in understanding how cybersecurity principles can be applied to

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape?

machine learning and deep learning systems, and

My academic studies have given me a strong

I find it fascinating that many traditional

how these technologies can be developed and secured responsibly.

foundation in key areas such as network

cybersecurity concepts and techniques remain

security, programming, cryptography,

highly relevant, even as AI and machine learning

system security, and research methods.

introduce new challenges and opportunities. Seeing

These fundamentals

how established security practices can be adapted

have been incredibly

to protect modern AI-driven systems highlights the

valuable because, while

importance of strong cybersecurity foundations.

cybersecurity is constantly evolving, the core principles

Working on projects that sit at the intersection of

remain the backbone of

cybersecurity and AI is especially rewarding because

the profession.

it feels like being part of a field that is still rapidly evolving. There is so much innovation happening, and

I S S U E 31

What I have appreciated

the opportunity to contribute to securing emerging

most about my studies is the

technologies makes the work both meaningful and

balance between theory and

exciting. It is an area that constantly pushes me to

hands-on learning. Being able to

learn, adapt, and think about the future of technology.

WOMEN IN SECURITY MAGAZINE

105

SHAFIA HUSNA

Conversely, which aspect of your studies do you find least interesting or useful, and how do you navigate through it?

is senior management, clients, policymakers, or the

As someone who genuinely enjoys learning, I would

effective technical solution has limited value if people

not say there is any part of my studies that I find

do not understand it or know how to act on it.

general public. Being able to communicate clearly can make a huge difference because even the most

completely uninteresting or without value. That said, there are certain topics that do not capture my

The field also requires a great deal of collaboration.

attention as much as others, particularly when they

Whether responding to incidents, working on

are less connected to the areas of cybersecurity that

projects, writing reports, presenting findings, or

I am most passionate about or when they are taught

making difficult ethical decisions, cybersecurity

in a highly theoretical way.

is rarely a solo effort. Success often depends on how well you can work with others, adapt to

When I come across subjects that feel less engaging,

different situations, and make informed decisions

I try to focus on the bigger picture. Cybersecurity

under pressure.

is such a broad field that having knowledge across a wide range of topics is just as important as

For my own career goals, particularly in research

developing expertise in a specific area. Even the

and academia, these skills are especially important.

modules that are not my favourites often provide

I’ve always wanted to be able to communicate

valuable context and help strengthen my overall

complex ideas in a way that is accessible to different

understanding of technology, security, and risk.

audiences, collaborate with researchers and industry professionals, and contribute meaningfully

I also make an effort to connect what I am learning

to discussions that go beyond purely technical

back to real-world applications. Understanding how

considerations. While my academic studies have

different concepts contribute to protecting systems,

helped me develop many of these skills through

responding to threats, or building stronger security

group work, presentations, and research projects,

practices helps me stay motivated and appreciate

I believe that additional training and experience in

the role each subject plays. In the end, I see every

these areas can be incredibly valuable. Developing

learning opportunity as another piece of the puzzle

both technical expertise and professional

that helps me grow into a more capable and well-

skills is what helps create a well-rounded

rounded cybersecurity professional.

cybersecurity professional.

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management?

If yes, why?

www.linkedin.com/in/shafia-husna-805539246

Absolutely. While technical knowledge is essential in cybersecurity, I believe that strong communication, teamwork, leadership, and decision-making skills are just as important for long-term success.

Cybersecurity professionals often need to explain complex risks and security concepts to people who do not have a technical background, whether that

106

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

How We Got Cyber Smart addresses cyber safety, cyber bullying and online safety for elementary school-aged children.

Lisa has partnered with Cool.Org, and her content is found on the Department of Education website.

READ NOW

LISA ROTHFIELD-KIRSCHNER Author of How We Got Cyber Smart | Amazon Bestseller

Staying safe from cybercrime – more than not clicking links It was a quiet Tuesday evening, and Jack’s parents assumed he was in bed reading.

He and his twin sister, Olivia, had only recently been allowed to use their devices in their rooms at night strictly for reading.

From the hallway, the soft glow under Jack’s door looked exactly as it should.

Inside, though, Jack wasn’t reading.

Curled up in bed, he was scrolling through Chit Chat. A few funny videos turned into more, and then the algorithm shifted.

Before long, he’d landed on a stream of “Top 10 Scariest Things Caught on Camera.” Each clip led to another. He told himself he’d stop after the next one, then the next.

Eventually, he put the device down. But the room didn’t feel the same.

The shadows seemed heavier. Ordinary house noises, a tap, a creak felt sharper, closer. He pulled the blanket up and tried to settle, but his mind kept replaying what he’d seen. Sleep came late, and when he woke in the night, it didn’t come back easily.

By morning, it showed.

“You look exhausted,” his mum said over breakfast. “I thought you were reading last night?”

Jack hesitated. “I wasn’t really reading.

I was watching videos.”

108

W O M E N I N S E C U R I T Y M A G A Z I N E

His dad looked up. “Scary ones?”

Jack nodded. “Yeah… kind of.”

Olivia glanced over. “That explains why you jumped when the toaster went off.”

Jack gave a small, embarrassed smile.

“I thought something had exploded.”

His mum sighed, but gently. “We trusted you with the device in your room. It’s not just the content, it's the screen itself.

That bright light tells your brain it’s still daytime.”

“And once your brain’s switched on like that,” his dad added, “it’s hard to settle back down.”

Jack looked at his toast. “I didn’t think it would affect me that much.”

There was a pause.

“We’re going to make a few changes,” his mum said. “Not as a punishment just to help you get proper rest.”

His dad continued, “We’ll adjust the parental settings. At night, your tablet will only open your e-book app.”

“And we’re adding a wind-down period,” his mum said. “No devices at all for two hours before bed.”

Jack expected to feel annoyed. Mostly, he just felt tired.

J U LY • A U G U S T 2026

“Okay,” he said. “That’s fair.”

His mum smiled. “And since you’re getting older, we can move your bedtime back slightly but that extra time stays screen‑free.”

That evening, Jack left his device at the charging station after dinner. He and Olivia played chess for a while. Then a shower, and an actual book.

He switched off the lamp and fell asleep quickly, the kind of sleep that doesn’t need effort.

By morning, the difference was obvious.

No yawning through breakfast. No jumping at small sounds.

“Better night?” his mum asked.

Jack nodded. “Way better.”

When he got into bed, the room felt different again but this time, in a good way. No lingering images. No edge to the silence. Just quiet.

From then on, he was more aware of what he watched and when. The device stayed part of his routine, but with clearer boundaries.

Olivia poked her head in. “You alright?”

The scary videos could wait for daylight.

“Yeah,” Jack said. “I think so.”

www.linkedin.com/in/lisarothfield-kirschner

howwegotcybersmart.com

I S S U E 31

WOMEN IN SECURITY MAGAZINE

109

WOMEN IN SECURITY MAGAZINE CONTRIBUTORS 01

02

1. AMANDA-JANE TURNER

Author of the Demystifying Cybercrime series and Women in Tech books. Conference Speaker and Cybercrime specialist

2. RACHEL CHOONG

Cyber Security Senior Project Manager

03

04

3. WENDY NGCONGO

Cybersecurity Architect | Data | Cloud | AI

4. SAMANTHA FINAN

Independent CISO

5. NAGAMMAI SHANMUGHAM

05

06

CISO Standard Chartered

6. STEPHANIE UZAMA

GRC Analyst and Consultant

7. SANDRA ESTOK

Founder & CEO, Way2Protect | Author | Speaker | Podcast Host

07

08

8. ISABELLA SCHULZ

Graduate Consultant

9. CRAIG FORD

09

10

Head Unicorn – Cofounder and Executive Director, Cyber Unicorns.

Australian Best Selling Author of A Hacker I Am, Foresight and The Shadow World book series. vCISO – Hungry Jacks, Wesley Mission, PCYC and Baidam Solutions

10. JO STEWART-RATTRAY

Oceania Ambassador, ISACA

11. LISA VENTURA MBE FCIIS

11

12

Chief Executive and Founder, Unity Group Solutions Limited/AI and Cyber Security Association

12. SIMON CARABETTA

Cyber Security Workforce Skills and Education | Podcaster | DEI advocate

110

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

13

14

13. JAY HIRA

Cyber Director – Financial Services, KPMG

14. POUPAK ENBOM

Chief Market and Business Development Officer, Yubico

15. KAREN STEPHENS

15

16

CEO and co-founder of BCyber

16. MARINA AZAR TOAILOA

Founder of the Mummy Safety Security Project

17. NICOLA JOHNSON

National Events Manager – Australia, Gallagher Security

17

18

18. TESSA WILLIAMS

National Marketing Manager – Australia, Gallagher Security

19. MADHURI NANDI

Madhuri Nandi, Head of security at Nuvei, AWSN Board Chair, author of Cyber Smart

19

20

20. SARA HASHI

Bachelor of Cybersecurity student at Deakin University

21. LAUREN MAURO

Bachelor of Cybersecurity student at the University of Technology Sydney (UTS)

21

22

22. SHAFIA HUSNA

Doctor of Philosophy student at Adelaide University

23. LISA ROTHFIELD-KIRSCHNER

Author of How We Got Cyber Smart | Amazon Bestseller

23

I S S U E 31

WOMEN IN SECURITY MAGAZINE

111

SURFING THE NET

INTELLIGENCE-DRIVEN THREAT HUNTING: HOW SOCS FIND WHAT ALERTS MISS

By ANY.RUN Talk to any threat hunter long enough, and beneath the polished case studies and conference talks, the same frustrations surface. Hunting is supposed to be proactive. In practice, it often feels reactive. You are chasing whispers of activity through log noise, querying SIEM fields that barely reflect real attacker behavior and writing detections against technique descriptions that were never meant to be operationalized directly.

By Tanishka Gupta It's not just about hackers in hoodies on movie screens. It covers everything from protecting your Instagram account to securing hospital patient records to defending a country's power grid from foreign attackers. The scope is enormous and that's exactly what makes it one of the most exciting fields to be in right now.

WHY WORLD QUANTUM DAY 2026 IS A WAKE-UP CALL FOR CYBER DEFENDERS

By Immersive Labs Blog For years, "Q-Day", or the moment a quantum computer becomes capable of shattering our current public-key encryption, was treated like a Y2K ghost story. It was always a "someday" problem. But as we sit here in 2026, the data tells a different story. The inflection point has arrived, and the window for proactive defense is closing faster than many anticipated.

READ BLOG

READ BLOG

READ BLOG

SHADOW AI: WHY YOUR BIGGEST AI THREAT MAY COME FROM WITHIN

THE PSYCHOLOGY OF BAD CODE PART 5 – SHINY NEW TECH

COMMON API SECURITY PITFALLS AND BAD PRACTICES

By CyberCX Blog

By SheHacksPurple

By Confidence Staveley

Organisations are adopting AI tools and systems at breakneck speed.

But without proper governance policies, staff education and authorised AI tools, organisations invite the emerging risk of shadow AI into their environments

Using a brand-new technology, language, and/or framework, even when it’s not necessarily the best thing to use. Especially if it’s untested, and there’s little guidance or tools available for it. An obsession with using what’s new, over what’s best for the situation.

APIs Are The Second Top Entry Point For Cloud Compromise, At 16.5%.Nearly Half Of Organizations

READ BLOG 112

CYBERSECURITY EXPLAINED: WHAT IT IS AND HOW TO START FROM ZERO

W O M E N I N S E C U R I T Y M A G A Z I N E

READ BLOG

Identify Managing API Sprawl As Their Top Concern, Followed By Maintaining Accurate Inventory.

READ BLOG J U LY • A U G U S T 2026

SECURITY AWARENESS TRAINING: BEYOND COMPLIANCE CHECKBOXES

By Dr. Magda Lilia Chelly This analysis examines security awareness training beyond compliance through technical, strategic, and governance lenses.

It synthesizes current research, regulatory developments, and practitioner insights to deliver actionable guidance for security leaders, enterprise architects, and board-level decision-makers navigating this domain.

READ BLOG

AI IMAGE-TO-VIDEO GENERATION FOR UK CREATIVE WORKFLOWS

By Cyber Geek Girl (Lisa Ventura) AI image-to-video systems rely on motion inference. The model analyses a source image, identifies visual elements such as edges, depth and subject placement, then predicts how these elements might move across multiple frames.

Frame interpolation fills the gaps between predicted positions, producing smooth transitions that simulate camera movement or object motion.

READ BLOG

PUTTING CLIMATE INTO PRACTICE: BUILDING AN INVENTORY MANAGEMENT PLAN

By Akamai (Katie Robinson) In corporate sustainability, it is common practice to outsource GHG data management to third-party software platforms or consultants. For many organizations, this is a highly practical way to establish a baseline. But outsourcing execution should never mean distancing yourself from the underlying data and methodology.

READ BLOG

Reach out to Aby today to find out how your company can help support the Women in Security Magazine.

ABY@SOURCE2CREATE.COM.AU

I S S U E 31

WOMEN IN SECURITY MAGAZINE

113

TURN IT UP FROM THE SOC TO THE BOARDROOM: REDEFINING CISO LEADERSHIP

I LOVE CHALLENGING OTHERS TO GO FURTHER IN THEIR CAREER'

With Women in Cybersecurity Podcast In this episode, we sit down with Renata Vincoletto, Chief Information Security Officer at Civica, to explore what it truly means to lead with impact in today’s high-stakes cyber landscape. Renata shares her journey leading enterprise-wide cybersecurity and risk strategies that protect critical services and sensitive data, while navigating the realities of complex, missioncritical environments.

With Women in IT podcast As a General Manager, Margrith’s goal is to grow the market share for Kaspersky across Australia and New Zealand and ensure the regional office runs like clockwork.

However, her role stretches far beyond this remit and covers every aspect of the business. Margrith jokes that she could be an HR professional, a real estate manager or even a facilities manager because her colleagues often ask for help and advice on a wide range of issues

CLICK TO LISTEN

With LufSec Cyber Security In this episode, we dive into: • Why combining AI/ML and blockchain is a game-changer for financial transaction security • How smart contracts, anomaly detection, KYC/AML, and crossborder payments are evolving under this convergence • Engineering lessons from scaling secure enterprise systems to shaping next-gen fintech security architectures • The challenges ahead: explainability, privacy, quantumresistance, and governance in financial cyber-defense

CLICK TO LISTEN

INSPIRING LADIES OF CYBER PODCAST

HERE COME THE AI BROWSERS

SECURITY YOU SHOULD KNOW

With Woman in Red Jenee is a cybersecurity pioneer, entrepreneur, and woman of incredible determination. Her journey is a testament to the power of hard work, resilience, and passion. From navigating her way into the tech industry as a young girl, to building a successful business that's revolutionizing the way we approach cybersecurity, Jenee's story is one for the ages.

With Security Now With a new episode every Tuesday, Security Now tackles the latest in cyber crime and hacking, plus tips on how to protect yourself and your business. Frequently discussed topics include passwords and authentication, malware, ransomware, digital identity, data privacy, zero-day exploits and much more

With Cisoseries Security You Should Know is a focused 15-minute podcast that connects security solutions with security leaders. Hosted by Rich Stroffolino, each episode presents a cybersecurity vendor trying to solve a specific problem, with two security expert panelists asking questions to learn more about the solution.

CLICK TO LISTEN 114

CLICK TO LISTEN

INSIDE CYBER MINDS

W O M E N I N S E C U R I T Y M A G A Z I N E

CLICK TO LISTEN

CLICK TO LISTEN J U LY • A U G U S T 2026

WHEN “OPPORTUNITY” KNOCKS, DON’T ANSWER. With Hacking Humans Another popular podcast from CyberWire, Hacking Human focuses on the social engineering schemes, phishing scams and similar criminal exploits making big impacts around the world.

Recent topics have included how AI-generated scams have infiltrated the world of fiber crafts and how AI-generated images and videos are used to promote fake product endorsements by celebrities and medical professionals.

ILLUMINATE ADVERSARIES WITH CYBER THREAT INTELLIGENCE With Blueprint Podcast Blueprint Podcast comes from the SysAdmin, Audit, Network, and Security (SANS) Institute, a private company in the U.S. that specializes in information security and cybersecurity training.

Previous topics have included the current and future state of security operations, privacy laws and what it takes to write a cybersecurity book. The podcast also features interviews with global cybersecurity experts.

LLM RESEARCH AND CISO LIABILITY With The Security Detail In episode two of The Security Detail, Audra interviews Liz Wharton, founder of Silver Key Strategies, about her research on using large language models (LLMs) to analyze SEC 8-K filings and other public reporting to gain cybersecurity insights. Liz is an attorney who has two decades of legal, public policy, and business experience, including in cybersecurity. The interview also covers the heightened liability security executives face when reporting material incidents to the US Securities and Exchange Commission (SEC).

CLICK TO LISTEN

CLICK TO LISTEN

CLICK TO LISTEN

TALKS DATA PRIVACY, MENTORS/SPONSORS

HOW AI AGENTS WILL NEGOTIATE YOUR VENDOR CONTRACTS

MINUTES TO MELTDOWN: CYBER RECOVERY WHEN IT COUNTS

With Cloud Security Podcast The Cloud Security Podcast is a weekly video and audio show that explores the ever-evolving world of cloud security. Through in-depth conversations with top cloud security experts, industry leaders, and frontline practitioners, the podcast delivers valuable insights, practical strategies, and real-world stories that help listeners stay ahead of emerging threats and best practices.

With Hacker Valley Studio This weekly podcast from Hacker Valley Media, a cybersecurity creative media agency, touches on the latest cybersecurity news, AI in cybersecurity, zero trust tactics, hacker culture and how to accelerate your cybersecurity career, just to name a few topics.

From current events and the latest cybersecurity technology to job advice and interviews with top security experts, this podcast covers it all

With CISOs in Cars Kunal Agarwal drives Kelly Haydu, VP, Information Security, Technology & Enterprise Applications, in a Tesla Cybertruck around SF at the RSA Conference as they discuss building rapport with engineers, building a data privacy practice, and moving from QA to head of cybersecurity. They talk about data breach reporting and how public companies can approach cybersecurity

CLICK TO LISTEN I S S U E 31

CLICK TO LISTEN

CLICK TO LISTEN WOMEN IN SECURITY MAGAZINE

115

OFF THE SHELF

ZERO TRUST NETWORKS Authors // Razi Rais and Christina Morillo This practical book provides a detailed explanation of the zero trust security model.

Zero trust is a security paradigm shift that eliminates the concept of traditional perimeter-based security and requires you to "always assume breach" and "never trust but always verify.

BUY THE BOOK

CYBERSECURITY CAREER GUIDE Authors //Alyssa Miller Self-analysis exercises to find your unique capabilities and help you excel in cybersecurity How to adapt your existing skills to fit a cybersecurity role Succeed at job searches, applications, and interviews to receive valuable offers Ways to leverage professional networking and mentoring for success and career growth

BUY THE BOOK

GREENER DATA Author // Jaymie Scotto Cutaia Empowering other industries' digital transformation, our innovators from around the globe share their timely insights to inspire positive and ever-lasting change and sustainability.Building upon the insights and success stories shared in the first book, “Greener Data – Volume Two”

BUY THE BOOK

SWITCHING TO CYBER Authors // Josiah Dykstra and Helen E. Patton Is your job changing? Or are you considering a career switch, and the exciting yet daunting world of cybersecurity is calling your name? You’re not alone. Switching to Cyber is your roadmap to navigating this dynamic field, proving that age is just a number when it comes to building a fulfilling and impactful career in cybersecurity.

BUY THE BOOK

116

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

HUMAN FACTORS IN CYBERSECURITY Author // Nikki Robinson Cybersecurity isn’t just a technical problem; it’s a human one. Human Factors in Cybersecurity equips you to tackle today’s digital threats by designing systems that respect how cybersecurity professionals actually think, behave, and make decisions.

BUY THE BOOK

DEEP DIVE: EXPLORING THE REAL-WORLD VALUE OF OPEN SOURCE INTELLIGENCE Author // Rae L. Baker In Deep Dive: Exploring the Real-world Value of Open Source Intelligence, veteran opensource intelligence analyst Rae Baker explains how to use publicly available data to advance your investigative OSINT skills and how your adversaries are most likely to use publicly accessible data against you.

BUY THE BOOK

CYBER-SMART PARENTING: PROTECTING YOUR CHILD IN THE DIGITAL AGE Author // Cybersecurity Parents LLC Cyber-Smart Parenting: Protecting Your Child in the Digital Age gives you the tools, strategies, and confidence you need to safeguard your child's digital life. Whether you're worried about social media, gaming, screen time, or online predators, this easyto-follow manual shows you how to take control - even if you're not tech-savvy.

BUY THE BOOK

TOBI & BYTEY – MISSION: FIREWALL KNIGHTS Authors // Smart Kids Academy and Catarine Zadieka Tobi is a curious boy who loves computers, and his best friend Bytey is no ordinary robot – he’s a living data byte from the digital world! When Clara, guardian of the Cloud Kingdom, sends out an urgent message, the two friends are pulled into a dangerous mission: stop the evil Virena and her army of cyber villains from taking over the magical Cloud Castle.

BUY THE BOOK I S S U E 31

WOMEN IN SECURITY MAGAZINE

117

OFF THE SHELF

DIGITAL WORLD: HOW TO CONNECT, SHARE, PLAY, AND KEEP YOURSELF SAFE Author // Carrie Anton Digital devices put a whole world at your fingertips. Play a game, listen to music, do research for school, read a story, or make a video -- anywhere, anytime. Connect with friends and family in fast and easy ways. Post photos and share ideas and inspiration.

And that's only a small part of it.

BUY THE BOOK

ELLE GETS A MOBILE PHONE: CYBER SAFETY CAN BE FUN [INTERNET SAFETY FOR KIDS] (DIARY OF ELLE: CYBER-SAFETY CAN BE FUN!) Authors // Nina Du Thaler and Helena Newton Ten-year-old Elle is bursting with excitement — she's finally getting a mobile phone for her birthday! But before her big day arrives, her friends start sharing stories she wasn't expecting to hear. Maya received horrible anonymous messages and didn't know who to turn to. Lucy racked up a phone bill so enormous her parents nearly fell off their chairs. And when a mobile phone goes missing on the bus, Elle learns that even losing a device can lead to a whole new set of worries.

BUY THE BOOK

ROHAN AND THE MAGIC SCREEN (CYBER SMART KIDS ADVENTURES) Author // Sonali Sinha When Rohan’s tablet suddenly glows with a bright, sparkly light, he never expects a tiny robot named Byte to pop out of the screen!

Byte has an important mission — to teach Rohan and his friends how to stay safe online.

BUY THE BOOK

DIGITAL DAN AND CYBER CITY Authors // Lemi-Ola Erinkitola and Ruchi Sharma Cyber City is a high-tech town featured in our new, upcoming children’s book on cybersecurity. Filled with fun, curious characters, an adventure in this city will help your child understand how to remain safe online. The first character introduced in the Cyber City books is Digital Dan, the leader of the city, who takes the form of a cloud.

BUY THE BOOK

118

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

THE LEARNING HUB CYBERSECURITY FUNDAMENTALS In this introduction to the field of computing security, you will be given an extensive overview of the various branches of computing security.

You will learn cybersecurity concepts, issues, and tools that are critical in solving problems in the computing security domain.

VISIT HERE

CS50'S INTRODUCTION TO CYBERSECURITY This is CS50's introduction to cybersecurity for technical and nontechnical audiences alike. Learn how to protect your own data, devices, and systems from today's threats and how to recognize and evaluate tomorrow's as well, both at home and at work.

VISIT HERE

CYBERSECURITY CAPSTONE AND CASE STUDIES Hands-on experience analyzing cybersecurity incidents to identify threat tactics and assess vulnerabilities you can talk about in interviews

VISIT HERE

CYBERSECURITY ESSENTIALS The course discusses the cybersecurity TRIAD, social engineering, identity and access management (IAM), cryptography, common network attacks, and secure network design. It provides students with a foundation for getting started in the cybersecurity field.

VISIT HERE

I S S U E 31

WOMEN IN SECURITY MAGAZINE

119

THE LEARNING HUB DIGITAL SHIELD: CYBERSECURITY FOR DATA AND SYSTEM PROTECTION This course empowers you with the knowledge to protect systems, networks, and data, develop skills to adequately respond to cyberattacks, understand the risks of cybersecurity, and identify vulnerabilities while managing information security.

VISIT HERE

MODERN SECURITY OPERATIONS Learn to modernize security operations with Google’s Autonomic Security Operations (ASO) framework and Continuous Detection, Continuous Response (CD/CR) methodology. Gain insights into detection, response strategies, and adaptive threat management.

VISIT HERE

UNDERSTANDING THE DIGITAL SUPPLY CHAIN AND ITS STAKES FOR HUMANITARIAN ACTORS Understand the hardware, software and connectivity supply chains, their actors, vulnerabilities, and associated cybersecurity risks.

VISIT HERE

QUANTUM-SAFE DIGITAL INFRASTRUCTURES: CHALLENGES AND SOLUTIONS FOR GOVERNANCE This course will help you to specify quantum threats and take appropriate governance actions. Learners will be able to take a leading role in effecting the migration to quantum-safe digital infrastructures.

VISIT HERE

120

W O M E N I N S E C U R I T Y M A G A Z I N E

J U LY • A U G U S T 2026

FEATURING FREE SECURITY TRAINING RESOURCES THAT ARE AIMED AT INCREASING SECURITY AWARENESS AND HELPING PEOPLE BUILD AND UPSKILL THEIR SECURITY SKILLS.

TRY IT: ETHICAL HACKING Want to know more about ethical hacking? Sign up for our free course and learn about ethical hacking and offensive security. The course is conveniently self-paced, and will also introduce you to the legal boundaries that distinguish “ethical” from “unethical” hacking, and the careers ethical hackers can pursue.

VISIT HERE

FINDING YOUR CYBER SECURITY ANALYST ROLE In this course, you'll transform the overwhelming cybersecurity landscape into a personalized career roadmap designed for your success. We guide you in exploring the industry's key roles while simultaneously uncovering your own distinct hard and soft skills. This culminates in empowering you to confidently select and plan for a bestfit role that aligns your personal strengths with real-world demand.

VISIT HERE

QUANTUM MANAGEMENT Check Point's Quantum is the best Threat Prevention solution on the Market! It offers uncompromising Security, consistently preventing both known and unknown Zero-day attacks.

VISIT HERE

HOW IS AI USED IN CYBER SECURITY? Discover the transformative role of artificial intelligence in safeguarding digital landscapes with our free course, how is AI Used in Cyber Security. This comprehensive program explores the integration of AI technologies in modern cybersecurity practices, providing insights into how AI-powered tools identify and neutralize threats in real time.

VISIT HERE

I S S U E 31

WOMEN IN SECURITY MAGAZINE

121

J O B B OA R D CLOUD SOLUTION ARCHITECT - CLOUD & AI INFRASTRUCTURE | MICROSOFT FULL TIME

INDONESIA

RESPONSIBILITIES • Create business value by translating customer challenges into actionable solutions aligned to high ROI customer outcomes. Ensure a seamless, connected experience that fosters satisfaction, loyalty, and long-term value.

• Lead architectural design sessions and deliver secure, scalable, and resilient infrastructure solutions aligned to customer business goals using frameworks like CAF and WAF.

• Partner with technical and sales teams to identify opportunities and develop tailored solutions to drive expansion and business value realization.

APPLY HERE

CYBER SECURITY OFFICER - MEA | ENVISION ENERGY FULL TIME

UNITED ARAB EMIRATES

KEY RESPONSIBILITIES HQ–Region Bridging & Strategy Alignment • Act as the primary interface between HQ cybersecurity teams and MEA markets.

• Translate global policies into localized, implementable solutions and requirements.

• Provide structured feedback to HQ on regional regulations, customer needs, and competitive gaps

APPLY HERE

CLOUD ARCHITECT | WOMEN IN TECH FULL TIME

RUSSIA

ABOUT THE ROLE In this role, you will design, configure, and implement cloud-based solutions that meet client requirements, ensuring delivery is on time, within scope, and aligned to high-quality standards. You will take ownership of technical delivery across Azure environments, working

from detailed designs to build, patch, and configure systems while ensuring adherence to security and change control processes.

APPLY HERE

SECURITY OPERATIONS LEAD / GOVERNANCE OWNER | ABB FULL TIME

INDIA

YOUR ROLE AND RESPONSIBILITIES In this role, we are looking for a Security Operations Lead – Governance & Risk Management to join our Industrial Automation Digital Organization. The role requires an experienced security professional with strong expertise in Security Operations (SecOps) governance, risk management, vulnerability management, incident response oversight, and security posture management across hybrid environments.

122

W O M E N I N S E C U R I T Y M A G A Z I N E

The candidate will be responsible for establishing and governing the Security Operations framework for Azure-primary SaaS environments spanning cloud, on-premises, edge infrastructure, Kubernetes platforms, databases, and customer deployments.

APPLY HERE

J U LY • A U G U S T 2026

CYBER DEFENSE ASSOCIATE | ACCENTURE MIDDLE EAST FULL TIME

SAUDI ARABIA

RESPONSIBILITIES: • Monitor security alerts from tools such as SIEM, antivirus, endpoint protection, firewall, and email security systems.

• Review and escalate suspicious activities, phishing emails, malware alerts, and unauthorized access attempts.

• Assist in basic incident response activities, including collecting evidence, documenting findings, and supporting remediation steps.

• Perform daily security checks and prepare operational security reports.

• Support user access reviews and help ensure access rights follow company policies.

APPLY HERE

PRINCIPAL ENGINEER, PLATFORM & SECURITY | STUFF FULL TIME

NEW ZEALAND

WHAT YOU’LL BRING • Extensive experience in senior platform engineering, DevOps, cloud infrastructure or security leadership roles.

• Hands-on experience designing and implementing zero-trust network architecture, service mesh, and application security controls at scale.

• Deep expertise in cloud platforms, Infrastructure as Code, CI/CD and modern software delivery practices.

APPLY HERE

SECURITY ENGINEER | MIND DETECT FULL TIME

SOUTH AFRICA

RESPONSIBILITIES • Secure our data, endpoints and networks • Ongoing preparation, monitoring, and response to security incidents • Build, maintain, enhance and oversee SIEM solutions.

• Risk management:

• Conduct pen-testing and threat hunting to find weaknesses in defence systems to improve overall security

APPLY HERE

SENIOR INFORMATION SECURITY CONSULTANT | EY FULL TIME

ITALY

KEY RESPONSIBILITIES This position is a leading role in designing, developing, and accessing all aspects of security for market leading regional and global systems based primarily on Cloud technologies. As a security consultant for EY Regional Technology Hub you will be an individual contributor capable of supporting multiple project

I S S U E 31

teams operating in the latest technologies of Cloudbased, Agile developed systems, using automated deployment from CI/CD pipelines.

APPLY HERE

WOMEN IN SECURITY MAGAZINE

123

J O B B OA R D SENIOR ANALYST, CYBERSECURITY OPERATIONS & RESPONSE | FOX ROTHSCHILD FULL TIME

USA

ESSENTIAL FUNCTIONS • Support the day-to-day operation and execution of the Firm’s Cybersecurity Operations & Response program.

• Assist with the administration and continuous improvement of the Firm’s threat and vulnerability management program.

• Develop, maintain, and update associated playbooks, policies, standards, and procedural documentation.

• Participate in cyber event response activities, including investigation, containment, remediation, and recovery efforts.

• Serve as a primary resource for security operations monitoring and incident triage activities.

APPLY HERE

STRATEGIC CYBER SECURITY CONSULTANT | GOOGLE FULL TIME

FRANCE

RESPONSIBILITIES Learn more about benefits at Google .

• Manage a small team of Consultants.

• Build a trusted advisor to clients, cultivating and maintaining strong relationships with key client stakeholders.

• Design, position, and co-deliver security consulting projects that leverage the complete breadth of

Mandiant's security services portfolio to provide a unified and cohesive experience for clients, while developing proposals, presentations and other documents for projects.

APPLY HERE

INTERNAL CYBER DEFENCE CONSULTANT | RICOH EUROPE FULL TIME

UNITED KINGDOM

BLUE TEAM LEADERSHIP & OPERATIONS • Leading and coordinating the virtual Blue Team, including SOC analysts, incident responders, threat hunters and defensive engineers • Setting strategic direction, improving processes, and supporting skill development across the defensive capability

• Acting as a senior escalation point during investigations and major incidents

APPLY HERE

SENIOR CYBER INTELLIGENCE CENTER SECURITY ANALYST | DELOITTE FULL TIME

GREECE

YOUR ROLE Be part of Deloitte’s Cyber Intelligence Center and conduct advanced cyber security analysis/ threat hunting activities using known adversary tactics, techniques, and procedures as well as indicators of

124

W O M E N I N S E C U R I T Y M A G A Z I N E

attack, to detect adversaries that may have bypassed conventional controls remaining undetected in our clients’ networks and systems.

APPLY HERE

J U LY • A U G U S T 2026

Support the Future of the

AUSTRALIAN WOMEN IN SECURITY AWARDS

®

We need your support to continue this important initiative into its 8th year.

The 2026 Awards will be hosted in Melbourne. To ensure this initiative continues, we invite you to partner with us as a sponsor.

NSORSH

I

Packages ava ilable from $6,000 to $50,000 Custom pack ages tailored to your organisa tion’s needs

PP

O

Your sponsorship will help us continue to celebrate and elevate the achievements of women in security across Australia.

O SP

P

JOIN US IN MELBOURNE FOR 2026

ORT

IE U NIT

S

To discuss how you can support and sponsor next year’s awards, please reach out to Aby at Aby@source2create.com.au.

We look forward to partnering with you to make the 2026 Australian Women in Security Awards our best yet.