Issuu

NOVEMBER • DECEMBER 2026

W W W. W O M E N I N S E C U R I T Y M A G A Z I N E . C O M

FROM THE PUBLISHER

his issue’s theme, Unleashed, came to

Nobody gets there alone. We say it often. Fewer

me before I could properly explain it.

people mean something specific by it.

That happens more than I would like to admit. Sometimes an idea just lands,

What I mean is that somebody forwarded a job

and the reasoning catches up later.

advertisement. Somebody mentioned a name in a meeting when that person was not there to advocate

I have had a year to think about this one. Unleashed is

for themselves. Somebody took a phone call at 9pm

not simply about the woman who finally receives the

because a first-time speaker was quietly falling apart

title she should have had four years earlier, although

before a keynote the next morning. Somebody made

that matters, and it is worth celebrating when it

an introduction and never brought it up again.

happens. It is about what occurs when capability that has been quietly building for years finally has

None of that appears on a CV. Much of it is the reason

somewhere to go. When the room opens up enough

the CV exists.

to let it move. We see this every year through the nominations I think that is the shift happening across security right

received for the Women in Security Awards.

now, and not only in Australia. I hear it from women

Hundreds of nominations arrive from every part of

in Singapore, New Zealand, Nairobi, the Netherlands,

the industry, each telling a different story of expertise,

and across parts of the industry I would never

persistence, leadership and impact. Yet the strongest

pretend to fully understand. The circumstances differ

submissions almost always include a sentence about

enormously. The pattern does not.

someone else.

Voices that once sat at the edge of the conversation

A mentor. A manager. A peer. A team member.

are now leading it. Perspectives that may have been

Someone who saw potential early and made room

politely recorded in meeting minutes, then left behind,

for it. That is not coincidence, and it is not simply

are shaping strategy and influencing decisions.

modesty. It speaks to what many of the people doing

Leadership in this industry is beginning to look less

meaningful work in security actually value. It also

uniform, a little less predictable, and frankly, better

says something hopeful about where this industry

for it.

could be heading, if we allow it to.

This year, I have sat in briefings where the most useful

GOING BEFORE YOU FEEL READY

question in the room came from the person with the

There is another side to being unleashed that is less

least seniority and the most nerve. What stayed with

comfortable. Sometimes, it does not feel empowering

me was not only the question. It was that the room

at all.

stopped, listened and considered it. It can feel like the promotion you are not sure you are That is what I mean by unleashed. Not permission

ready for. The board presentation where you can hear

granted. Permission stopped being the mechanism.

your own voice shaking. The incident at 2am when you are the most senior person awake and there is

THE PEOPLE BEHIND THE PROGRESS

genuinely nobody left to escalate to.

There is a part of this conversation I want to

approach carefully, because it can become a platitude

Growth is often just being out of your depth in a way

very quickly.

that turns out to be survivable. I have spoken with

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Abigail Swabey

many women in this industry about the moment

FIND YOUR PEOPLE

their career changed. Almost none described it

If you are reading this from somewhere I may never

as empowering at the time. They described it as

visit, working in a part of security I could not describe

frightening. Isolating, occasionally. A decision they

properly, or sitting in a team where you are the only

were not entirely sure they could carry.

person who looks like you, I do not have a neat piece of advice.

The empowerment came later, looking back. In the moment, it was often just a decision not to go

I would only say this: the thing you are waiting to feel

back.So, when I talk about being unleashed, I am

ready for may be the very thing that makes you ready.

not talking about confidence. I am talking about

It tends to work in that order. Annoyingly. And find

going anyway.

your people.

CELEBRATION WITHOUT PRETENDING

Not a network in the LinkedIn sense. Not another

It is also important to be honest about what has not

collection of business cards or a room full of people

shifted. A magazine full of celebration that ignores the

making polite promises to stay in touch. Find two or

numbers is not much use to anyone. Pay gaps persist.

three people whose phone numbers you have. People

Career progression still stalls at familiar points.

whose honest opinion you would accept, even when it

There remains a noticeable gap in the middle of this

is not what you wanted to hear.

industry, where women who entered security in their twenties leave in their early thirties and do not return.

Find a community where you can be yourself, ask the question you think you should already know the

We have a reasonable understanding of why that

answer to, and be surrounded by people with strength,

happens. We have done comparatively little to

perspective and resilience. Find mentors who make

change it.

room for you, then become the person who does the same for someone else.

Across the world, representation is moving forward, but too slowly. At a pace that should concern an

That has been worth more to me than anything with a

industry built around identifying risk, responding to

lanyard. This issue is full of women who went anyway.

change and protecting what matters.

Read it that way.

Celebrating progress does not mean pretending the

Abigail Swabey

work is finished. If anything, the more time I spend in this space, the more visible the absences become.

PUBLISHER, and CEO of Source2Create You notice who is not in the photograph. Still, something has changed in the past few years. Something has come off the chain, and I do not believe it is going back on. Too many women have seen what is possible. Too many organisations have

www.linkedin.com/in/abigail-swabey-95145312

aby@source2create.com.au

seen what changes when different experiences, instincts and leadership styles are properly heard. That is difficult to un-see.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

CONTENTS

COLUMN

FROM THE PUBLISHER

CAREER PERSPECTIVES

Would You Trust Your Own Eyes and Ears in the era of sophisticated AI-Powered Cybercrime

Own Your Place

Choose Your Own Cyber Adventure: Charting a Non‑Traditional Career

Unleashed: When Security Steps Beyond Its Boundaries 98

UNLEASHED: WHO GETS TO DECIDE WHAT YOU’RE READY FOR?

The Times She Cried, Too Frail to Wake This Time

From reselling two securing: The channel’s evolving role in cybersecurity 86 Mummy Safety forges new alliances to strengthen child safety across early learning communities

Beyond the Code: She Sharp, Xero and Secure Code Warrior equip women to secure software in the age of AI

WHAT’S HER JOURNEY? Michelle Bower

Maryam Abedi

Emily Wanczura

INDUSTRY PERSPECTIVES The most dangerous minutes are at your own gate: protecting principals and their families at home 44

Asimina Basdani

Esther Wafula

Malak Youssef

Renee Noble

Why leadership is about more than finding your own voice: My definition of ‘Unleashed’

135 THE LEARNING HUB 138 JOB BOARD

Do We Know How to Lead in an AI World? 52 When the Map Does Not Exist Yet: Governing AI Before the Rules Arrive

When Security Awareness Ends, the Real Test Begins

Unleashed: The Parts of Ourselves We Finally Give Permission to Grow

The AI Governance Gap

How to Become a Bridge Builder in the Security Industry

NOVEMBER • DECEMBER 2026

2026 AUSTRALIAN WOMEN IN SECURITY AWARDS COVERAGE 143

FOUNDER & EDITOR Abigail Swabey

ADVERTISING Abigail Swabey Jane Saafi

M A G A Z I N E C O O R D I N ATO R Jane Saafi

JOURNALISTS

120

SURFING THE NET 128

Stuart Corner

SUB-EDITOR Stuart Corner

DESIGNER Rachel Lee

STUDENT IN SECURITY SPOTLIGHT

TURN IT UP 130

Zeseya Sharmin

102

Kiran Illyass

106

Ushna Zubair

110

Harkirat Kaur

118

Source2Create Pty Ltd is the publisher of this magazine and its website (www.womeninsecuritymagazine.com).

OFF THE SHELF 132

ASSOCIATIONS & GROUPS SUPPORTING THE WOMEN IN SECURITY MAGAZINE

Thank You

TO OUR SUPPORTING ASSOCIATIONS

ABIGAIL SWABEY

UNLEASHED: WHO GETS TO DECIDE WHAT YOU’RE READY FOR? by Abigail Swabey, Publisher of Women in Security Magazine

For women in security, the next chapter isn’t only about finding the confidence to step forward. It’s about questioning who keeps drawing the line.

here’s a particular kind of career

And somehow, she is still being told to get ready.

conversation that sounds encouraging

For this issue, Unleashed is an invitation to look

until you think about it on the way home.

more closely at that gap: the distance between

“You’re doing great work. Just keep

being capable and being given room to use that

building your confidence.” Perhaps that is

capability. Not because every woman wants the top

useful feedback. Perhaps there really is something to

job Not because ambition has to be loud. Because

work on.

deciding what comes next should not always belong to somebody else.

But sometimes confidence becomes a convenient

explanation for a problem that sits somewhere else.

BEYOND THE INVITATION

A woman has put her hand up. She has delivered

The language of opportunity is often generous.

the work. She has made it clear she wants the

Women are encouraged to join the conversation and

next opportunity.

bring their perspectives.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

F E A T U R E

happens once you are in the room? Can you disagree

YOU DO NOT HAVE TO BECOME SOMEONE ELSE

with the direction being taken? Do you have the

There is an exhausting version of career advice that

authority to act, or only the responsibility to deliver?

asks women to perform a different personality.

Good. But an invitation is only the beginning. What

When you suggest a different approach, does it receive proper consideration? There is a difference

Speak more forcefully. Be more visible. Don’t soften

between being included and being influential.

your language. Then comes the opposite feedback. Be more approachable. Watch your tone.

In security, that distinction deserves attention. Think of the person who notices a weakness in a familiar

It is worth asking how much energy goes into

process, or asks the uncomfortable question before

navigating those instructions, and what might be

a decision becomes expensive. Their contribution

possible if some of that energy went back into

depends partly on expertise. It also depends on

the work.

whether anyone is prepared to listen. There is room in security for the leader who thinks Being unleashed, in that setting, isn’t about speaking

before speaking. For the specialist who would rather

without restraint. Security requires judgement.

solve a difficult problem than command a stage. For

It means having enough trust and authority to

someone whose strength is asking a careful question

use that judgement, including when the answer

that changes the direction of a meeting.

is inconvenient.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

None of that rules out learning new skills. We can

Before celebrating, it is worth looking at what comes

practise presenting, become better negotiators

with it. Is there a budget? Who makes the decisions?

or learn to hold our ground during a difficult

What happens when another team refuses to

conversation without treating our existing personality

cooperate? A bigger workload is not necessarily a

as a defect.

bigger opportunity.

Growth is useful. Constant self-correction to satisfy

If someone is accountable for an outcome but

an audience that keeps changing its expectations is

cannot make the decisions required to achieve it,

something else. The question is not, “How do I look

the title offers little protection. They may be visible

more like a leader?” It might be, “What does good

when things go wrong and largely invisible when the

leadership look like when I do it?”

work goes well. This is where Unleashed becomes a practical challenge for employers.

RESPONSIBILITY NEEDS AUTHORITY Consider an opportunity that looks impressive on

Give people a clear remit. Let them know which

paper: leading a major project, taking on a difficult

decisions are theirs. Back them when they make a

client or stepping into a newly created role.

reasonable call, rather than withdrawing support at the first sign of discomfort. And when someone is ready for more, be specific about the path. “Keep doing what you’re doing” is pleasant to hear. It is not a development plan.

AMBITION CAN CHANGE ITS SHAPE There is another kind of permission worth examining: the permission we wait to give ourselves. To apply before every requirement feels comfortably within reach. To say that the role we once wanted no longer fits. Or to admit that being good at something does not mean we want to keep doing it indefinitely.

" Growth is useful. Constant self-correction to satisfy an audience that keeps changing its expectations is something else. The question is not, “How do I look more like a leader?” It might be, “What does good leadership look like when I do it?”

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

F E A T U R E

For one woman, being unleashed might mean pursuing an executive position. For another, it could mean staying close to the technical work she loves rather than moving into management because it appears to be the only route forward. It might mean starting a business. It might mean leaving a workplace where every modest opportunity has become a negotiation. These choices do not need to look alike to be ambitious. Nor does ambition need to consume everything around it. A career can matter enormously without

" For one woman, being unleashed might mean pursuing an executive position. For another, it could mean staying close to the technical work she loves rather than moving into management because it appears to be the only route forward."

being entitled to every available hour. Wanting work that leaves room for a life is not an apology. There may be a woman reading this who already

WHAT HAPPENS AFTER THE THEME?

knows what she wants to do next. She does not need

A magazine theme can give a conversation a name.

another reminder to believe in herself. She needs

The more interesting part is what happens when the

a decision, a fair opportunity or someone willing to

magazine is put down.

put their support on the record. And there may be someone reading who can provide exactly that.

Perhaps it prompts a conversation with a manager that has been postponed for months. Perhaps a

Unleashed need not mean a dramatic reinvention.

leader looks again at who receives the high-profile

Sometimes it is the moment an unnecessary

assignments, and who is repeatedly trusted to do the

restriction is finally removed. The work was already

quiet work behind them.

there. So was the ability. Now there is room to use it.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

AMANDA-JANE TURNER Adjunct Lecturer School of Social Science (Cyber-Criminology) Cybercrime is big business, thanks to technical advancement and interconnectivity creating more opportunities. This regular column will explore various aspects of cybercrime in an easy-to-understand manner to help everyone become more cyber safe.

C O L U M N

Would You Trust Your Own Eyes and Ears in the era of sophisticated AI-Powered Cybercrime A video call from your manager. An urgent request

An urgent appeal can add pressure to act before we

to transfer company funds. Or perhaps it’s your

stop to question it. When the person making that

child, their familiar voice pleading for money in

appeal looks or sounds familiar, taking a moment to

an emergency.

verify their identity may feel unnecessary.

You recognise the face. You know the voice. But what

That is precisely the moment to pause.

if neither is proof that you’re speaking to the person you know?

MAKE IMPERSONATION HARDER Be mindful of what you share publicly. Voice

Advances in artificial intelligence have brought

recordings, family details and travel plans whether

benefits, but they have also given cybercriminals new

personal or work-related can give criminals material

ways to deceive. AI tools can help offenders work

to make an impersonation more convincing.

faster and at greater scale, creating sophisticated

Consider what your posts reveal, not just individually,

impersonation scams that make it increasingly

but together.

difficult to distinguish genuine interactions from fake ones.

Verify requests through a separate, trusted method. Rather than relying on how convincing someone

These scams exploit something deeply human: our

looks or sounds, independently confirm their identity

instinct to trust the people we know, particularly when

before acting on a request for money or a transfer of

they appear to need our help.

company funds.

The question is no longer simply whether we can spot

As AI-powered impersonation becomes more

a scam. It is whether we can independently verify who

sophisticated, the most useful question is not, “Does

is on the other end of a call.

this person look or sound real?”

WHEN SEEING IS NO LONGER BELIEVING

It is, “Have I independently verified that they are who

Deepfake video and AI-generated voices challenge

they claim to be?”

the idea that seeing someone’s face or hearing their voice is enough to confirm their identity. Criminals can use these tools to impersonate family members,

www.linkedin.com/in/amandajane1

colleagues or company executives, making a fraudulent request feel personal and credible.

W O M E N I N S E C U R I T Y M A G A Z I N E

www.empressbat.com

N O V E M B E R • D E C E M B E R 2026

WHAT’S HER JOURNEY?

Michelle Bower CEO, GNGB

ichelle Bower never set out to build a

“We are responsible for the Superannuation

career in cyber security. It found her,

Transaction Network (STN), which is the ‘pipes and

slowly, over two decades in financial

plumbing’ of the Australian superannuation system

services operations, where security

and our pension fund assets,” Michelle explains.

and risk sat quietly in the background

"Worth over AUD4.4 trillion (over USD3 trillion), this

of the day job until they didn’t.

asset pool is obviously both very important and a very appealing target for cyber criminals. I saw an

“My cyber security career grew from 20 years working

opportunity to build on a great asset – the STN – to

in operations in the financial services sector,” she

enable collaboration and uplift protection for the

says. “Security and risk management was always part

entire superannuation sector."

of the job, but it became increasingly clear over time that this was an area that organisations needed to

That word, collaboration, comes up again and again

focus on much more, and it took on a life of its own.”

when she talks about her work. Superannuation is a hard environment to secure because so many parties

In 2019 she joined the Gateway Network Governance

touch it. The funds are only one part.

Body (GNGB), which she now leads as CEO. GNGB

is responsible for the Superannuation Transaction

“Super is a fascinating place to work in security

Network, or STN. Most Australians have never heard

because it’s such a complex environment,” she

of it, yet their retirement savings depend on it.

says. “You have the super funds themselves, but

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

J O U R N E Y ?

the ecosystem also encompasses a myriad of other providers as well as every employer in the country, as employers are responsible for sending individuals’ superannuation payments (at least 12% of every Australian worker’s salary) to their superannuation fund every time they get paid. As we know, our security posture depends on everyone in the value chain, so this means collaboration is particularly vital in the superannuation industry.” When she started, that kind of collaboration mostly wasn’t happening.

“ For anyone setting out in this field, I think it’s important to look at opportunities as they arise and not pressure yourself to have a clear plan. Roles will be different this time next year, let alone in ten years’ time."

“Seven years ago there appeared to be a very low culture of collaboration; financial services companies generally have not been encouraged to share information, so educating the industry about

For someone who has done well in a field she never

collaboration as a mitigation strategy has been a big

planned to enter, Michelle is fairly relaxed about

challenge. Thankfully we have seen the needle move,

career roadmaps. She thinks people who are just

particularly over the past 2-3 years.”

starting out should be too.

Operation Honeybee is the clearest sign of that shift.

“My career in cyber security has been an evolving

It’s GNGB’s annual cyber incident response exercise,

journey and it’s all changing so quickly,” she says. “For

and it’s named for the role bees play in keeping a

anyone setting out in this field, I think it’s important to

natural ecosystem alive. The first one, in 2022, drew

look at opportunities as they arise and not pressure

a modest crowd. The numbers have grown a lot

yourself to have a clear plan. Roles will be different

since then.

this time next year, let alone in ten years’ time. I remember at uni I had to do an assignment about the

“When we first ran this in 2022 interest was quite

internet and half our class didn’t even know what that

low, but it has grown substantially and this year we

was! So I’m proof that you can have a great career in

have 39 organisations who participated including

security without having planned it that way.”

regulators, Government agencies and many of the biggest superannuation funds,” she says. “Seeing this

Credentials and technical depth matter, but Michelle

collaboration build and helping educate participants

keeps returning to a couple of skills that get less

on the power of cyber hygiene has been one of the

attention. The first is curiosity, and being willing to ask

most satisfying elements of my career so far.”

when you don’t know something.

She’s quick to say where the resistance has come

“Things I do think are important for security

from, and it isn’t the technical people.

professionals at any stage of their career are listening, and asking good questions. Cyber is such

“Another fantastic thing about working in cyber

a broad church, with so much to know, that there

security is the practitioners themselves. Any

are absolutely no stupid questions, no one of us can

reluctance we’ve seen to come to the table and

know everything, but collectively we are a force to be

collaborate has been from other parts of the

reckoned with! So being able to find the right person,

organisation – cyber experts are really open to

ask them the right questions and incorporate that

sharing and very keen to work together.”

information is a really important skillset.”

I S S U E 32

WOMEN IN SECURITY MAGAZINE

“ One thing I would say to those who are earlier in their career is that balance is important. Cyber professionals in particular are often expected to be on call around the clock, which isn’t sustainable and will lead to burnout. Our sector needs to get better at cross-training and bringing people in from outside the sector, who can collaborate and amplify our impact.”

The second is translation. Explaining risk to the

Looking ahead, she doesn’t expect things to slow

people who hold the budget is part of the job, and she

down. AI is already changing the threat landscape,

doesn’t treat it as optional.

and she sees it cutting both ways.

“It’s also really important to be able to communicate

“Looking ahead, cyber security is going to be ever

to people without expertise in cyber and explain

more critical as a field of expertise across all

what we do in layman’s terms. Many people who

industries. AI, for example, is already throwing up

are ultimately responsible for funding and decision

risks that just didn’t exist even a couple of years

making won’t be experts, so being able to put yourself

ago. The ability for AI tools to identify vulnerabilities

in those peoples’ shoes and explain cyber issues

we didn’t know we had will be both a huge threat

clearly is critical.”

and a great defence mechanism. AI agents will be vital in the ongoing war against bad actors and

She also has a warning for people earlier in their

there will be huge demand for people who can

careers. The always-on culture in cyber is a problem.

navigate that environment and keep abreast of fastmoving developments.”

“One thing I would say to those who are earlier in their career is that balance is important. Cyber

She also thinks Australia may have been luckier so far

professionals in particular are often expected to be

than it realises.

on call around the clock, which isn’t sustainable and will lead to burnout. Our sector needs to get better at

“Australia has been largely sheltered from the biggest

cross-training and bringing people in from outside the

geopolitical impacts so far, but we can’t count on that

sector, who can collaborate and amplify our impact.”

continuing and need to be prepared to respond as the environment evolves.” For Michelle, being prepared mostly comes back to the thing she has spent seven years building: getting people into the same room before something goes wrong. Thirty-nine organisations turned up to Operation Honeybee this year. In 2022 it was a much smaller group. www.linkedin.com/in/michelle-bower-gaicd-1b65425

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

SOURCE2CREATE.COM.AU

AISA.ORG.AU

IS NOW AISA'S NEW PUBLISHING PARTNER Click here to read the newest edition of CyberConnect

Maryam Abedi Manager at KPMG

aryam Abedi, cybersecurity did not

It is a familiar entry point for many people now

begin with a neatly mapped-out

working in the profession: a moment where

career plan. It started with a hacked

technology becomes personal. A strange email, a

social media account when she

compromised account, an unexpected system failure.

was 16.

For Maryam, it became the beginning of a much bigger journey that has taken her through university,

At the time, cybersecurity was not a field she knew

across countries and into her current role as a

much about. Like many people, she understood the

Manager at KPMG in Australia.

more familiar word: hacking. But rather than simply trying to regain access and move on, Maryam found

Her academic pathway gave that early curiosity

herself wanting to understand what had happened,

structure. Maryam completed both her bachelor’s

why it had happened and how someone had been

and master’s degrees in computer engineering and

able to get in.

architecture, building a technical grounding in how systems work, communicate and connect.

That curiosity stayed with her. “My academic background also played an important “My initial interest in cybersecurity started when I was

role in developing that interest,” she says. “I

around 16 years old, after one of my social media

completed both my bachelor’s and master’s degrees

accounts was hacked,” Maryam says. “At that age,

in computer engineering and architecture, which gave

I wasn’t really familiar with cybersecurity. The word

me a strong technical foundation, particularly in areas

I knew was hacking. I became curious about how it

such as networking and understanding how computer

happened and rather than simply trying to recover the

systems communicate.”

account, I started researching and digging into what

had happened. That curiosity was really the starting

As her career developed, so did her view of

point of my interest in cybersecurity.”

cybersecurity. What began as an interest in how

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

J O U R N E Y ?

attacks happen gradually became a broader understanding of the work required to protect systems, businesses and people. “Over time, as I started my career, my initial curiosity evolved into a professional interest in understanding how systems can be attacked and protected, and eventually how cybersecurity can be approached from both a technical and organisational perspective,” she says. That ability to see cybersecurity through both lenses matters. Strong technical knowledge remains

“ What always pushed me forward was the belief that if someone else can do something, I can learn to do it too. Maybe I just need to put in more time, study more and work harder. That mindset has helped me a lot throughout my career.”

essential, but the field also relies on people who can understand risk, organisational priorities, human behaviour and the practical realities of implementing

Maryam’s experience is a reminder that confidence

security in busy workplaces. It is rarely just

often follows action, not the other way around.

about technology. Over the past seven years, she has worked with Like many professionals entering a fast-moving

colleagues across KPMG’s global network, moving

technical field, Maryam has also experienced

from Malaysia to Canada and now Australia. The

periods of doubt. Early in a career, particularly when

experience has reinforced the value of supportive

surrounded by highly capable people or dealing with

teams, different perspectives and an environment

unfamiliar work, it can be easy to assume everyone

where learning is part of the culture.

else knows more. “Over the past seven years, I’ve been very fortunate to “Absolutely,” she says, when asked whether she

work with so many amazing people across KPMG’s

ever felt uncertain about pursuing cybersecurity.

global firm,” she says. “They have always been

“Especially early in my career, there were many times

supportive and given me opportunities to explore

when I felt like everyone else knew more than I did

different areas of cybersecurity. My journey from

or the things I had to work on were completely new

Malaysia to Canada and now Australia has also

to me.”

shown me that at KPMG, we support each other and never stop learning and improving.”

Her response was not to wait until she felt entirely ready. Instead, she focused on what could be learned.

For Maryam, the people around her have had a substantial influence on the direction of her career.

“What always pushed me forward was the belief that

She speaks openly about the importance of being

if someone else can do something, I can learn to do it

given opportunities to step into new areas, take on

too,” Maryam says. “Maybe I just need to put in more

challenges and, at times, make mistakes.

time, study more and work harder. That mindset has helped me a lot throughout my career.”

“One thing that really stood out to me is the idea that we respect each other and draw strength

It is a simple idea, but a useful one. Cybersecurity

from our differences,” she says. “I’ve experienced

can sometimes look intimidating from the outside,

that throughout my journey, working with people

particularly because it has its own language, tools,

from different countries, backgrounds and with

specialisations and constant stream of new threats.

different perspectives.”

I S S U E 32

WOMEN IN SECURITY MAGAZINE

“The people I’ve worked with have given me the

technical side of cybersecurity, then having a stronger

opportunity to explore different areas, take on new

understanding of networking, operating systems,

challenges and sometimes make mistakes and learn

programming and scripting becomes important.”

from them. I think having people around you who are willing to support you, challenge you and give you

She also believes a commitment to continuous

opportunities to grow can make a big difference in

learning is non-negotiable.

your career.” “Technology is constantly developing and changing,” That perspective is particularly relevant for women

she says. “In cybersecurity, we need to keep learning

considering the field. Representation matters, but

and stay up to date with these changes so that we

so does culture. A workplace where questions are

can continue to provide value and effectively protect

welcomed, knowledge is shared and people are

the organisations we work with.”

trusted to grow can shape whether someone stays in cybersecurity and thrives there.

Looking ahead, Maryam is interested in certifications that align with the direction of the market and

Maryam believes students considering cybersecurity

the role she wants to continue building. She sees

should recognise just how broad the profession is

certifications as valuable when they serve a genuine

before deciding where they want to specialise.

purpose, rather than simply being collected.

“I think cybersecurity is a very broad field, with areas

“I think certifications are valuable when they help you

such as offensive and defensive security, incident

build knowledge in an area that is relevant to your

response, governance, risk and compliance and

current role or where you want to take your career,”

many others,” she says. “Students should take the

she says. “For me, I would consider something like

opportunity to explore these different areas and get a

CISM, but I’m also interested in qualifications around

better understanding of what each one involves.”

AI security. It’s becoming a growing area in the market, and I think it’s an area that will continue to

That exploration can help students make more

grow very quickly.”

informed choices about subjects, qualifications and career opportunities. The technical pathway is one

Away from the technical work and professional

option, but it is not the only one.

development, Maryam is deliberate about making room for life outside work. In a field where new

“Once they have an idea of which area they are

incidents, emerging vulnerabilities and competing

interested in, they can then start building the right

priorities can quickly fill the day, balance requires

knowledge and skills for that particular area,” Maryam

more than good intentions.

says. “For example, if they want to move into a more “I think work/life balance is something you have to be intentional about, especially in cybersecurity, because there can always be something happening or something else that needs your attention,” she says. “For me, it’s mainly about understanding what is important, knowing what my deadlines are and prioritising my workload. Outside of work, I try to make sure I have time for things that help me switch off, whether that’s spending time with family and friends, exercising or simply taking some time for myself.”

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

J O U R N E Y ?

She also adds an important point. Work can be demanding, but enjoying the work itself changes the experience. “There will always be times when the job requires us to work longer hours than usual, but when you enjoy what you do and find meaning in it, those moments don’t necessarily feel like a burden,” Maryam says. “For me, that’s also an important part of having a good balance.”

"Do not assume your previous career has left you starting from zero. Different backgrounds can offer a genuine advantage, depending on the area of cybersecurity someone chooses."

Maryam values professional networks for much the same reason she values a supportive workplace: people learn faster when they share what they know.

or risk could move into GRC, governance, risk and

Within KPMG, she participates in internal groups

compliance, or cyber risk.”

connecting professionals from different countries and teams. She is also involved with cybersecurity and

She has met cybersecurity professionals who began

professional communities including ISACA.

in agriculture, civil engineering and philosophy. Their paths may have looked unconventional, but their

“Within KPMG, we have internal groups where

curiosity led them into the field.

people from different countries and teams connect and share their experiences,” she says. “I really

“I would recommend spending some time exploring

value these groups because people openly share

the different areas of cybersecurity before deciding

their approaches, challenges and the way they

exactly where you want to specialise,” Maryam

solve problems.”

says. “Most importantly, stay curious and be willing to learn.”

“They also share new techniques and methods they have been using, which can be really useful.

Then comes the line she regularly shares with junior

Sometimes, you can learn a lot from someone who

team members.

has faced a similar challenge.” “I still believe the biggest university in the world is For those considering a move into cybersecurity from

Google,” she says. “There is so much information

another profession, Maryam’s advice is encouraging:

available, and we can always learn something new. I

do not assume your previous career has left you

always tell the juniors in our team that sometimes you

starting from zero. Different backgrounds can offer

just need to know what the first step is and then we

a genuine advantage, depending on the area of

can walk the rest of the way together.”

cybersecurity someone chooses. For Maryam Abedi, that first step was a hacked “I think when someone is coming from another

account and a question she could not quite let go

professional background, they probably already

of. Years later, that same instinct remains at the

have skills and experience that can be valuable in

centre of her work: keep asking, keep learning and do

cybersecurity,” she says.

not let uncertainty stop you from finding your place in cybersecurity.

“A developer could move into application security, and their deep knowledge of programming can help them develop more advanced scripts for penetration testing

www.linkedin.com/in/maryam4466

or be better at code reviews. Someone from audit

I S S U E 32

WOMEN IN SECURITY MAGAZINE

Emily Wanczura Consultant – Technology Risk & Cyber Security at KPMG

mily Wanczura’s first spark of interest

existed in cybersecurity and soon saw a path that felt

in cybersecurity did not come from a

both challenging and meaningful. She enrolled in a

classroom, a coding project or a news

Bachelor of Cyber Security with a clear goal in mind:

headline about a major data breach. It

she wanted to become a penetration tester.

came from the world of James Bond. At that stage, the technical side of the profession

Like many people drawn to the field, Emily was

was the drawcard. Penetration testing offered the

fascinated by the role technology played behind the

opportunity to understand systems deeply, identify

scenes. In particular, it was the character of Q, the

weaknesses and think like an attacker before a real

inventive, composed and technically brilliant figure

attacker had the chance. It felt like the natural real-

supporting high-stakes missions who caught her

world extension of the problem-solving she admired

attention early on.

in Q.

“My passion for cybersecurity sparked from the

But as Emily progressed through university, her view

James Bond movies, as the character ‘Q’ captured

of the industry began to shift.

my curiosity,” Emily says. “The character’s approach to high-stress environments and passion for his

“After researching, I entered a Bachelor of Cyber

role aligned well with my interests, leading me to

Security, with hopes of becoming a penetration tester

investigate roles similar to this fictional character.”

within the field,” she says. “However, as I completed my studies, I found myself more interested in a

That curiosity became something more practical.

consulting role, where I can deliver engagements from

Emily began researching the kinds of careers that

beginning to finish and see a true impact for clients.”

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

Today, Emily is a Consultant in Technology Risk and Cyber Security at KPMG. It is a role that lets her bring together her interest in cybersecurity with her desire to understand businesses, work with people and contribute to tangible outcomes. “I have now begun a Cyber Consulting role with KPMG and am excited to contribute meaningfully to the business and clients through engagements in this area,” she says. Emily’s journey is a reminder that a career in cybersecurity does not always follow the path

J O U R N E Y ?

" In an industry that moves quickly, personal connections and curiosity can be just as important as technical capability. A conversation after a class may lead to advice, a project, an internship or an introduction to someone working in an area you had not considered."

you first imagine. The industry is broad, and often the most suitable role only becomes clear through exposure, experience and a willingness to change direction.

In an industry that moves quickly, personal connections and curiosity can be just as important

For Emily, one of the most important parts of that

as technical capability. A conversation after a class

process was saying yes to opportunities while

may lead to advice, a project, an internship or an

studying. University was not just about lectures,

introduction to someone working in an area you had

assessments and exams. It became a place to build

not considered. Conferences offer the chance to

confidence, connections and a professional identity.

see how broad the sector really is. What begins as a general interest in cybersecurity may evolve into a

“The most pivotal step in transforming cybersecurity

passion for governance, risk and compliance, threat

from an interest to a profession was in networking

intelligence, digital forensics, privacy, cloud security

and never saying no,” she says. “University

or consulting.

studies present a significant number of external opportunities, through conferences, external projects

That was the case for Emily.

and employment opportunities, all of which assist in building a professional reputation and greater skillset.”

When she first began her degree, she had a clear picture of where she thought she was heading.

That advice is straightforward, but it can be difficult

Penetration testing was the plan. Yet exposure to

to put into practice. Turning up to an event where

different ideas and people helped her recognise that

you know no one, introducing yourself to an industry

her strengths and interests were better suited to a

professional or volunteering for a project outside

different side of the profession.

your usual workload can feel intimidating. Especially early on.

“Keeping an open mind when first entering a new career path is highly important,” Emily says.

Emily believes those moments matter.

“Beginning my university studies, I was convinced a technical career in penetration testing would suit

“Turning up in person to events and classes,

me best. However, as I experienced more of what

conversing with lecturers, tutors and university staff,

cybersecurity has to offer, through conferences,

and putting in the effort to step out of your comfort

networking and studies, I felt my interest shift

zone, never goes unnoticed,” she says.

towards GRC and consulting.”

I S S U E 32

WOMEN IN SECURITY MAGAZINE

GRC governance, risk and compliance is often

however after having completed my studies, I now

less visible to people outside the industry, but it

am confident that the university builds the required

is central to helping organisations make informed

knowledge from a basic level.”

decisions about their technology, risk posture and security obligations. Consulting adds another layer

For those wanting to build further confidence, she

again: working alongside clients to understand their

recommends supplementing formal education with

environment, identify priorities and help them take

hands-on learning.

practical action. “It is also a great idea to complement this knowledge “Although I entered my degree with a clear vision of

with additional online courses, and volunteer for

my future role, keeping an open mind allowed me to

additional projects and experiences to increase your

find my true passion within cybersecurity,” Emily says.

understanding of technical concepts,” she says.

That flexibility also informs the advice she would

The pace of change is one reason cybersecurity

offer to students considering their own cybersecurity

remains such an engaging career. The landscape is

journey. For people coming into the field without prior

continually reshaped by new technologies, changing

programming experience or technical study, the sheer

business models and growing digital reliance. Over

scale of the industry can seem daunting. There is

the next few years, Emily believes the expansion

always another platform, certification, programming

of the Internet of Things will create a significant

language or emerging threat to learn about.

new challenge.

Emily understands that feeling, but she encourages

“The expansion of IoT adoption in modern society

aspiring professionals not to let it stop them before

is introducing a new, significant threat in the

they begin.

cybersecurity landscape in the next several years,” she says.

“My most important advice to both my own highschool self, and others in a similar position, is

As connected devices become more embedded in

not to feel overwhelmed,” she says. “It is easy to

workplaces, homes, infrastructure and daily life,

stress about falling behind after not beginning any

organisations will need to reconsider how they

programming or technical studies prior to university,

manage security. Unlike traditional IT devices, IoT systems can bring different risks around visibility, data processing, resource constraints and third-party supply chains. “IoT has multiple fundamental differences to traditional IT devices, and as such cannot be secured using the same approaches,” Emily explains. “Supply chain risk management, resource management and data processing are all significant differences to be addressed. Resultantly, cybersecurity professionals must continue to monitor the IoT development and adoption in the coming years.” While Emily is committed to developing her career in cybersecurity consulting, she is also thinking broadly about where her professional journey may lead.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

J O U R N E Y ?

“ My most important advice to both my own high-school self, and others in a similar position, is not to feel overwhelmed,” she says. “It is easy to stress about falling behind after not beginning any programming or technical studies prior to university, however after having completed my studies, I now am confident that the university builds the required knowledge from a basic level.”

Career advancement is not just about salary. For her,

Outside work, Emily is conscious that a sustainable

it is about the opportunity to keep learning, gain new

career needs room for life beyond the office.

perspectives and experience life in different places.

Cybersecurity can be demanding, and maintaining energy over the long term means finding routines that

“One large motivating factor in my career path

keep work in proportion.

is the opportunity to move overseas, while also building a strong foundation to continue advancing

“A healthy work/life balance is an important

professionally,” she says.

consideration for me,” she says. “As a morning person, I attend gym classes, where I catch up with friends,

The ability to relocate interstate in the short term, and

before coming into the office.”

internationally later on, is an important consideration. So too is the chance to explore related disciplines.

Running also forms part of her week, whether alone

Emily’s curiosity reaches beyond cybersecurity into

or with friends. On weekends, she makes time for

fields such as accounting, finance and auditing.

the things that help her switch off: social catch-ups, Formula 1, reading and baking.

“I am greatly interested in pivoting opportunities in my future career, to learn more and work for a business in

“Ensuring my weekends are filled with social

accounting, finance and auditing teams,” she says.

interactions and enjoying my hobbies, including watching Formula 1, reading and baking, further allow

That openness has been supported by an influential

me to maintain this balance between work and my

university professor who had experience in both

daily life,” she says.

industry and academia. As Emily considered whether to continue studying after her bachelor’s degree

Emily’s story begins with a fictional inventor in a Bond

or move into professional practice, those honest

film, but it is being built through very real choices:

conversations helped clarify what she wanted.

showing up, learning from others, staying open to unexpected opportunities and trusting that a career

“A university professor, who has transitioned from

path can change as you grow. In cybersecurity, as in

working in industry to pursuing academia, has been

life, the first plan is not always the final destination.

the most influential in assisting me in choosing my professional career path,” Emily says. “His description of industry work, where he helped businesses and

www.linkedin.com/in/emily-wanczura-9ba09b275

saw the impact of the work he was completing, inspired me to pursue my professional career in cybersecurity consulting.”

I S S U E 32

WOMEN IN SECURITY MAGAZINE

Asimina Basdani Chief Information Security Officer (CISO), Head of Information Security Office

or Asimina Basdani, cybersecurity

Over time, that interest moved beyond securing

has never been only about protecting

individual systems or networks. It became a broader

technology. As Chief Information Security

commitment to helping organisations prepare for

Officer and Head of the Information

disruption, make better decisions and build security

Security Office at I.D.I.K.A. S.M.S.A.,

into the way they operate.

her work sits at the intersection of national digital healthcare services, public trust and resilience.

“As my career evolved, I realised that cybersecurity is much more than protecting networks and

It is a responsibility with real weight behind it.

systems,” Asimina explains. “It is about protecting

The systems her organisation supports are used

people, services, organisations and, increasingly,

by millions of citizens, and when those systems

society itself.”

are reliable and secure, people can access the healthcare services they need. When they are

Working in digital healthcare has sharpened that

not, the consequences extend well beyond the

perspective. “When the systems you protect

technology itself.

support healthcare services used by millions of citizens, cybersecurity becomes a matter of trust

Asimina’s interest in cybersecurity began with a

and resilience,” she says. “Today, my interest has

natural curiosity about how technology works,

evolved from understanding how to secure individual

particularly what can happen when systems are

technologies to understanding how an entire

exposed to risk. “I was drawn to the combination

organisation can become more resilient, prepared and

of technology, problem-solving and responsibility,”

secure by design.”

she says.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

J O U R N E Y ?

Her path into cybersecurity was grounded in technical experience, although communication has also been a defining part of her professional development. In the early stages of her career, Asimina worked in technical roles while also teaching as an Informatics Lecturer. The combination proved valuable. “That experience was particularly important in developing my communication skills and my ability to explain complex technical concepts in a clear and

“ A CISO cannot operate in isolation. Cybersecurity becomes truly effective when management, technical teams, suppliers and users understand that resilience is a shared responsibility.”

accessible way,” she says. In 2020, Asimina joined I.D.I.K.A. S.M.S.A. as a Network Security Engineer within the Information Systems & Network Security Management

“The most complex part is balancing security,

Department. The position brought hands-on exposure

availability, innovation and business needs in an

to infrastructure, networks and security technologies,

environment where the services are nationally critical,”

and helped turn a growing interest into a clear

she says.

professional direction. Her approach is risk-based and anchored in context. “It was during this period that I realised how much I

Rather than applying security controls in isolation,

enjoyed cybersecurity and how strongly I wanted to

she begins by understanding the business and

develop further in this field,” she says.

technical environment, identifying the actual risk and translating it into business impact. From there, the

Rather than limiting her development to technical

work becomes collaborative.

skills, Asimina invested in understanding the wider governance and operational context of cybersecurity.

“I work with the relevant teams to find a practical

She developed knowledge across cybersecurity

and sustainable control,” she says. “A CISO cannot

governance, risk management, incident management

operate in isolation. Cybersecurity becomes truly

and business continuity. That expanded view has

effective when management, technical teams,

underpinned her move into leadership.

suppliers and users understand that resilience is a shared responsibility.”

“I believe that combining a strong technical foundation with a strategic understanding of

That belief shapes how she sees the leadership role.

cybersecurity has been fundamental to my

It is not simply about defining security strategy or

professional evolution,” she says. “It provided the

monitoring threats. It is also about creating alignment

foundation for taking on greater responsibility and

across the organisation, bringing the right voices

ultimately moving towards cybersecurity leadership.”

together and making security part of everyday decision-making.

Asimina now leads cybersecurity in an environment where balancing priorities is not straightforward.

“My role is not only to define the cybersecurity

Critical services need to remain available. Users

strategy across the organisation, but also to create

must be able to access them. At the same time,

alignment, foster collaboration and ensure that

organisations need to move forward with innovation,

security becomes part of the organisation’s overall

including cloud adoption and artificial intelligence.

decision-making and culture,” she says.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

Like many professionals in the field, Asimina has

will increasingly support threat detection, vulnerability

experienced moments of uncertainty. Cybersecurity

analysis, monitoring, incident response and security

changes quickly. New technologies emerge, threat

operations. Yet it will also introduce new security

actors adapt and expectations of security leaders

considerations for the systems, data and supply

continue to rise. The idea that anyone can know

chains organisations rely on.

everything is, she says, not realistic. “AI will increasingly support threat detection, “There are moments when you question whether you

vulnerability analysis, security monitoring, incident

know enough, particularly when technology, threats

response and security operations,” she says. “At the

and expectations are changing so rapidly,” she says.

same time, organisations will need to secure the AI

“Over time, I have learned that cybersecurity is not a

systems they deploy, the data they use and the supply

profession in which you ever reach a point where you

chains behind them.”

know everything.” She also expects a shift in focus from traditional She has learned to treat uncertainty differently: not

cybersecurity towards organisational cyber resilience.

as a weakness, but as a prompt to ask stronger

The question is no longer limited to preventing an

questions, seek the right expertise and ensure

attack. It is whether an organisation can detect,

decisions are informed by the bigger picture.

respond, recover and continue delivering vital services when something goes wrong.

“As a CISO, what matters is understanding the broader picture, recognising what I need to know, knowing

“For critical sectors such as healthcare, this

where to find the right expertise, and bringing the

distinction is fundamental,” Asimina says.

right people together to make informed decisions,” she says.

The threats she anticipates are interconnected. AIenabled phishing, impersonation, social engineering

For Asimina, effective leadership is about “creating

and fraud are likely to become more convincing and

clarity in complexity”, particularly when decisions

scalable. Supply-chain vulnerabilities and third-party

must be made before every answer is available. It is

dependencies will remain an ongoing concern as

also about creating an environment where people

organisations become more reliant on complex

can share knowledge and continue learning from

technology ecosystems. Ransomware continues to

one another.

pose a serious risk wherever availability is critical, while geopolitical developments are expected

Looking ahead, she sees artificial intelligence as a

to keep influencing activity against public and

major force shaping the cybersecurity landscape. AI

critical infrastructure. “What concerns me most is not one individual threat, but the combination of automation, interconnectedness and speed,” she says. “An attacker may exploit one weak dependency and create consequences far beyond the original target.” When asked about the greatest influences on her career, Asimina does not point to one person or one moment. Instead, she reflects on the cumulative impact of people, responsibilities and lived experience.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

J O U R N E Y ?

“ There are moments when you question whether you know enough, particularly when technology, threats and expectations are changing so rapidly,” she says. “Over time, I have learned that cybersecurity is not a profession in which you ever reach a point where you know everything.”

“Working as a CISO at IDIKA, an organisation that

“For me, resilience is not only something we

supports critical national digital services, has

build for organisations,” she says. “Leaders need

profoundly shaped the way I see cybersecurity,”

resilience too.”

she says. “It reminds me every day that behind every information system are people, citizens and

A typical day in Asimina’s role varies, which is one

professionals alike, who rely on the confidentiality,

of the things she enjoys most. It might begin with

integrity and availability of these services.”

reviewing the organisation’s cybersecurity posture, security reports and key indicators. It may move into

That is the thread running through her work: an

discussions around cyber risks and incidents, security

understanding that systems and data are not

architecture, or critical projects and services. Board

abstract assets. They support people, decisions and

briefings are also part of the role, translating complex

essential services.

risk and strategic priorities into discussions that enable informed decisions at the highest level.

“This perspective has strengthened my sense of responsibility and reinforced my belief that leadership

“As a CISO, there is not really a typical day, and

in cybersecurity is ultimately about protecting not only

that is something I enjoy very much,” she says.

systems and data, but also the people and services

“Every day brings different challenges, priorities

that depend on them,” she says.

and perspectives.”

Maintaining balance in a role responsible for critical

What remains consistent is the purpose behind the

services requires a realistic approach. Cybersecurity

work. “I do not see each day as a series of routine

does not always observe standard working hours,

tasks, but as an opportunity to understand a new

particularly when an incident occurs or a significant

challenge, bring the right people together, make

risk needs attention. For Asimina, work-life balance

informed decisions and contribute to strengthening

is less about achieving a perfect daily split and more

the organisation’s security and resilience,” she says.

about setting sustainable boundaries over time. It is a career built on curiosity, technical knowledge “I try to prioritise rather than react to everything with

and an evolving understanding of what cybersecurity

the same urgency,” she says. “Delegation and trust in

is really there to protect. For Asimina Basdani, that

the team are also essential.”

answer is clear: people come first.

Time away from work is not separate from professional effectiveness; it supports it. Family,

www.linkedin.com/in/asimina-basdani-5341765

friends, physical activity, travel, stepping back from technology and having room to think all help her return with perspective.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

It was especially important at the beginning. Entering an unfamiliar field meant accepting that she would not always have an answer. Esther chose to be honest about that rather than pretend otherwise. “I also didn’t shy away from saying when I didn’t know

Esther Wafula Senior Information Security Consultant

something and needed time to understand.” That honesty came with effort. She worked through the materials her colleagues recommended, spent time researching and studying, and pursued certifications. Conferences and online webinars offered opportunities to hear from experienced

professionals and understand the work beyond her immediate surroundings. sther Wafula did not begin her career with a plan to work in cybersecurity. She was

She was not following a carefully plotted career path.

a Data Analytics intern when a team of

Because penetration testers had introduced her to the

colleagues caught her attention. They were

field, she initially assumed she would follow in their

working in penetration testing, and she

footsteps. What mattered most at that stage was

found herself drawn to what they were discovering

getting exposure and finding out what was possible.

and how far ahead they seemed to be. As her knowledge developed, so did the subjects Rather than admire their work from a distance,

drawing her attention. Cloud, the Internet of Things,

she asked questions. How could she get into

Zero Trust and, more recently, artificial intelligence

cybersecurity? Could she shadow them?

became part of the changing landscape she was learning to navigate. Rather than decide her entire

They shared study materials and gave her somewhere

future at once, she concentrated on becoming better

to start. She took it from there.

at the work in front of her.

“From then on, I never looked back.”

“I would also remind myself to be more confident and not wait until I felt completely ready before

Now a Senior Information Security Consultant,

pursuing opportunities.”

Esther’s interests have grown beyond the hands-on

testing that first drew her in. Consulting has given

There were doubts along the way. Cybersecurity’s

her a different way to contribute, and she is looking

pace sometimes left Esther questioning whether

towards leadership. But the willingness to ask for

her expertise was enough. It was not a feeling she

help to admit there is something she does not yet

could resolve simply by studying harder for a week or

understand has stayed with her.

completing another course.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

J O U R N E Y ?

Instead, confidence developed through experience.

She would also encourage herself to act before

She sought guidance from more experienced

feeling completely ready. Confidence, in her

professionals and took on challenging projects.

experience, is not necessarily something that arrives

Gradually, she changed the standard against which

before a challenge. Sometimes it develops because

she was measuring herself.

of it.

“Over time, I then realised that success in

Relationships matter too. Esther encourages seeking

cybersecurity is not about knowing everything, but

out mentors or coaches where possible, and paying

about staying adaptable, curious, and committed to

attention to the people nearby. Much of her own

ongoing growth.”

learning has happened through those exchanges, not only through formal study.

That shift gave her room to develop without expecting herself to arrive fully formed. It also helped her

“I have made continuous learning a habit rather than

recognise something more personal: she genuinely

treating it as a separate activity.”

enjoyed cybersecurity. The uncertainty did not mean she was in the wrong profession.

That habit remains part of her working life. Professional reading, webinars and training courses

Her challenges have changed as her career has

help her stay informed, while conversations

progressed. Early on, the gap was experience. Later, it

with colleagues, stakeholders and peers in other

was deciding which area of cybersecurity she wanted

organisations bring different perspectives to her work.

to focus on. Today, she is increasingly concerned with how she can influence the industry to empower more

But continued development does not mean being

women to enter it.

permanently available.

For Esther, that ambition has a practical expression in

Esther is deliberate about the boundary between her

community involvement. While supporting teams and

professional and personal life. At work, she aims to be

helping protect customers gives her satisfaction in

fully present. When she clocks out, she wants to give

her role, she finds particular fulfilment in giving back.

her personal life the same attention.

Through events such as ShadowTech NZ, she meets

The gym is part of her downtime, alongside running or

high school girls who are considering a future in

walking. She recognises that balance looks different

technology. These conversations offer space for

in different seasons, so she pays attention to her

questions and a chance to challenge assumptions

own thresholds rather than expecting one routine to

that might otherwise discourage someone from

work indefinitely.

taking the first step. As she looks towards leadership, Esther is carrying She knows what an opening can mean. Her own

forward a lesson that began during her internship:

career began when colleagues responded to her

curiosity is worth acting on. She did not know where

curiosity and shared what they knew. Now she has

that first conversation with the penetration testing

opportunities to offer encouragement from the other

team would lead. She asked anyway.

side of that conversation. Her advice to her younger self reflects this experience.

www.linkedin.com/in/esther-wafula-cisa-cism-cissp-cehccsp-94bb7b99

She would tell her not to feel pressured to have the whole future mapped out. Some opportunities only become visible after trying something unfamiliar.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

Malak Youssef Cybersecurity Engineer – Automation & AI

alak Youssef’s cybersecurity career

made me curious about what was happening behind

has been shaped by curiosity about

the systems we relied on every day, how data moved,

the systems people rely on, the

how processes could be automated, and ultimately

information organisations hold,

how those systems and information could be kept

and how technology can make

secure and resilient.”

security work better. Now a Cybersecurity Engineer specialising in Automation and AI, she works at the

Financial services gave Malak a strong understanding

point where security operations, engineering and

of the responsibility involved in handling customer

emerging technologies meet.

information. She became increasingly interested in the protections that sat behind everyday systems, and

Her path did not begin with a set job title in mind. It

in the trust customers place in organisations when

developed through an early interest in technology,

they share their data.

automation and the way organisations function behind the scenes.

“I found myself thinking more about the responsibility organisations have when customers entrust

“My interest in cybersecurity really grew out of an

them with their information,” she says. “I wanted

earlier interest in technology, automation and how

to understand how we ensure that data remains

organisations operate,” Malak says. “I started my

confidential, that its integrity is protected from

career in financial services, where I was exposed to

unauthorised or unintended change, and that the

process automation and worked with technologies

systems and information people depend on remain

such as robotic process automation. That experience

available when they are needed.”

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

J O U R N E Y ?

“ My path has definitely unfolded organically... My initial goal was much simpler: I wanted to understand cybersecurity from the ground up and become a capable security professional.”

That interest became a career decision. Malak chose

says. “Given my earlier background in automation,

to study cybersecurity so she could develop the

I naturally started asking: how much of this can we

technical knowledge to move from relying on security

automate, and where can technology help the analyst

controls to helping build and strengthen them.

make a better decision?”

“I made a conscious decision to study cybersecurity

Today, that question guides her work. Malak’s focus

and build the technical knowledge that would allow

sits at the intersection of cybersecurity, automation

me to move from being someone who relied on those

and AI, with an emphasis on improving investigations

protections to someone who could actively contribute

without losing the controls, evidence and human

to them,” she says.

oversight that security environments require.

Seeking real-world experience, Malak deliberately

“My path has definitely unfolded organically,” she

began in a Security Operations Centre. A SOC

says. “When I first entered cybersecurity, I didn’t have

provided exposure to a broad mix of customers,

a specific job title in mind or imagine that I would

industries, technologies and security challenges.

eventually be working at the intersection of security,

It was also where she discovered how much she

automation and AI. My initial goal was much simpler:

enjoyed investigation work.

I wanted to understand cybersecurity from the ground up and become a capable security professional.”

“I deliberately wanted to start in a SOC because I saw it as an opportunity to be exposed to different

Security automation became the natural next step.

customers, industries, technologies and security

It enabled repeatable investigation tasks to become

problems,” Malak says. “Once I was there, I found that

structured, consistent workflows, allowing analysts

I really enjoyed the investigative side of cybersecurity

to devote more time to the areas that require

taking an alert, understanding what had happened in

professional judgement and deeper expertise.

an environment, piecing together the evidence and determining whether there was a genuine threat.”

“From a cybersecurity perspective, that meant asking which parts of an investigation genuinely required

Over time, she began to notice a pattern.

an analyst’s expertise and judgement, and which

Investigations often involved repeated enrichment

parts could be streamlined or automated,” she says.

steps, switching between tools, and collecting the

“Automation and AI have simply given me increasingly

same contextual information before an analyst could

powerful ways to pursue that.”

make an informed decision. Her earlier experience in automation led her to question how that friction could

AI has expanded the possibilities further, particularly

be reduced.

for complex investigations that cannot be reduced to predictable rules. But Malak is careful not to see AI

“I started noticing how much of an analyst’s time

as a shortcut or a standalone answer. In live security

is spent gathering context, moving between tools

environments, data is often incomplete, systems can

and repeating the same investigative steps,” she

fail, permissions vary, and evidence can conflict.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

“One of the most challenging aspects of my role

“The next evolution is agentic systems that can

is bridging the gap between what AI is capable of

participate more actively in an investigation —

demonstrating and what we can responsibly rely

gathering evidence from security tools, reasoning

on in a real security environment,” she says. “It’s

over what they find, determining what information

relatively easy to show an AI model successfully

they need next and dynamically progressing an

analysing a well-structured security scenario. The

investigation,” she says.

complexity comes when you introduce the reality of security operations.”

However, the greatest advancements may depend less on the AI models themselves than on the

For Malak, trust needs to be engineered into AI

surrounding ecosystem. The quality of data, the tools

systems. It comes from grounding models in

an AI system can access, the permissions it is given,

evidence, setting clear limits on the actions they

the controls around it, and the places where human

can take, testing them against realistic scenarios,

intervention is required will determine whether the

ensuring their decisions are auditable and designing

technology can be used safely and meaningfully.

points where people remain responsible for consequential choices.

“The biggest advancement may not necessarily come from the AI models themselves,” Malak says. “It will

“My approach has been to treat trust as something

come from everything we build around them: how

that needs to be engineered rather than assumed,”

we connect them to security tools, what context we

she says. “The question is no longer simply, ‘Can AI

provide, what actions they’re permitted to take, how

do this?’ It’s increasingly, ‘Under what conditions can

we validate their reasoning and where we deliberately

we trust it to do this, how do we prove what it did,

require human judgement.”

and where should a person remain accountable for the decision?’”

There is no truly typical day in her role, which is part of what she enjoys. Her work can move

She believes cybersecurity is moving beyond AI

between cybersecurity operations, engineering,

tools that simply assist with isolated tasks such

coding, workflow design, APIs, data, testing and

as summarising information or generating queries.

conversations with security teams about the

The next phase will see AI become more embedded

challenges they encounter.

in security operations, with agentic systems able to gather evidence, use tools and help dynamically

“A lot of my work starts with a security problem rather

progress investigations.

than a technology,” Malak says. “I might be looking at how an investigation occurs, where time is most spent, what information is needed to make a decision and where unnecessary friction exists.” The people closest to the work are a major part of that process. Understanding where analysts lose time, where context is missing and where professional judgement is essential helps Malak design technology that genuinely supports, rather than complicates, the investigation. “What brings me the most satisfaction is seeing how automation and AI can fundamentally change the way a team works,” she says. “When we remove the

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

“ Being effective in cybersecurity isn’t about having every answer immediately. It’s about knowing how to investigate, ask the right questions, find the evidence you need and continue learning.”

J O U R N E Y ?

you’ve built in another industry can become one of your strengths.” Her own background in financial services, customer data and automation continues to influence her work. She believes cybersecurity needs people who understand how organisations function, how people work and where processes can fail. “Cybersecurity doesn’t exist separately from the business — ultimately, we’re protecting the people, information and operations that allow that business

repetitive tasks and friction that consume people’s

to function,” she says.

time, the immediate benefit is usually efficiency. But I think the more exciting outcome is what

The strongest influence on Malak’s career has been

happens next.”

her family. Her parents encouraged her to believe her ambitions were possible, while continuing to

That next step, she believes, is increased capability.

offer meaningful support as she became a mother.

Teams can move beyond simply doing the same

Her husband shares her values and commitment to

work faster. They gain more capacity for complex

showing their children that fear and expectations

investigations, threat hunting, detection engineering

should not determine the limits of what they pursue.

and work that may previously have been out of reach. “I’ve realised that if that is what I want to teach my “We aren’t simply doing the same work faster; we’re

children, I also have a responsibility to demonstrate it

able to do things we previously didn’t have the

through the way I live my own life,” she says.

capacity to do,” she says. Her message to her younger self is simple: do not Malak is open about the uncertainty that can come

focus so heavily on fitting in.

with a career in cybersecurity. The industry is broad, fast-moving and layered, with countless directions for

“Some of the greatest value you can bring comes

professionals to explore. Early on, she did not always

from being willing to see things differently,” Malak

know where she would fit.

says. “Ask the question that everyone else has stopped asking. If something doesn’t make sense,

“Over time, I became more comfortable with saying,

don’t accept it simply because ‘that’s how we’ve

‘I don’t know yet, but I can work it out,’” she says.

always done it.’”

“Being effective in cybersecurity isn’t about having every answer immediately. It’s about knowing how to

For Malak Youssef, that willingness to question, test

investigate, ask the right questions, find the evidence

and keep learning has shaped a career at the leading

you need and continue learning.”

edge of cybersecurity. As AI becomes more deeply embedded in security operations, her work is focused

For people considering a transition into cybersecurity,

on making that future not only more efficient, but

her advice is not to disregard what they have already

more trustworthy.

built in another career. “Don’t assume you’re starting from zero,” Malak says.

www.linkedin.com/in/malak-y-704a65137

“Cybersecurity is incredibly broad, and the experience

I S S U E 32

WOMEN IN SECURITY MAGAZINE

surprisingly my many roles at Girls Programming Network over the years is how I have come to know, care about, and really enjoy the cyber field.” When Renee first became involved with GPN around 13 years ago, it was still a small organisation. Cryptography was already part of its activities, and the opportunity to teach it drew her in. “The puzzle-like nature of crypto was so fun, I wanted to solve all the challenges myself.”

Renee Noble CEO, Girls Programming Network

Learning about women’s involvement in cryptography, including their work at Bletchley Park, added another dimension. This was not simply a technical subject she enjoyed. It connected her to a history in which women had helped shape both technology and the world around them.

That sense of possibility stayed with her. enee Noble loved maths, logic and

GPN has continued teaching cryptography and

puzzles long before she knew where

now reaches more than 2,000 students a year. As

those interests could take her. At school,

students’ abilities and interests have developed,

coding and cybersecurity were not part

the organisation has expanded the algorithms it

of her world. It was only at university,

teaches. Their growing enthusiasm for cybersecurity

partway through her degree, that she picked up

also prompted a more contemporary, hands-on

programming and discovered something that felt

experience: GPN’s Password Cracker content.

unexpectedly familiar. The aim was to help students understand what There were problems to unravel. Questions to chase.

happens beneath the surface, while giving them

And the satisfaction of working out why something

an opportunity to experience the role of a white-

did or didn’t work.

hat hacker.

Today, as CEO of Girls Programming Network

For Renee, the response is a powerful reason to

(GPN), Renee helps girls and gender-diverse young

keep going.

people experience that discovery for themselves.

Her connection to cybersecurity has grown through

“Seeing just how much excitement both the students

the organisation, rather than through a conventional

and volunteers get out of running our cybersecurity

security career. Teaching others has given her

aligned workshops just makes me want to keep

reasons to keep learning, while leading an expanding

creating more opportunities for girls and gender-

program has brought the responsibility of protecting

diverse kids to see themselves in those roles that are

its community into sharper focus.

so important for the future.”

“While my day job (and jobs over the years)

“I just had no exposure to coding or cyber before I

haven’t really put me in the depth of cybersecurity,

accidentally came across it at university.”

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

W H A T ’ S

H E R

J O U R N E Y ?

Creating those opportunities takes more than choosing

Some of the young adults contributing to that

an interesting technical challenge. Renee and her

software are working in a development team for

team have to think carefully about how students will

the first time. Their involvement offers valuable

respond to an activity—and what they might do next.

experience, but it also means the leadership team must provide appropriate guidance while ensuring the

A workshop asking “How secure is your password?”

resulting systems are secure and fit for purpose.

sounds useful. But Renee can immediately see the complication: teach children to write code that

“It is a lot to juggle for a volunteer led organisation,

assesses a password, and some may enter their real

but something in which you can’t drop any of

passwords in plain text for others to see.

the balls!”

The lesson has to be designed around that possibility,

For someone considering a future in cybersecurity,

not just the intended learning outcome.

Renee’s starting point is not a particular qualification. It is a curiosity.

There is also the challenge of keeping content current. Renee does not want students to leave with a false

“This is such a fast moving field, so I think the

sense of security, or with the impression that meeting

key thing for aspiring security professionals is

a website’s password requirements means they have

ultimately curiosity.”

nothing else to consider. She values the habit of asking “why” and “how”, Instead, she wants them to understand the threats

and the willingness to follow a question beyond

and recognise that they could have a role in

the obvious answer. The problems people pose for

addressing them.

themselves, she believes, are often the ones they feel most compelled to solve.

“So we really enjoy being able to create a space where students see the other side of the coin, opening their

That outlook also shapes how she considers artificial

eyes to the growing landscape of threats, but also a

intelligence. Renee sees the growing scale of AI-

growing number of opportunities for them to make

enabled activity as a significant challenge for security

a difference.”

professionals. Her concern is not only how capable an individual agent might be, but what becomes

Those responsibilities extend beyond the classroom.

possible when large numbers of systems can rapidly

As GPN has grown, so has the work involved in

try different approaches.

keeping its own systems and community safe. In her view, reducing the effort involved in Through Tech Inclusion, the charity that supports

attempting attacks could make smaller targets

GPN, Renee and the leadership team have delved

more attractive. It also creates important work

further into data and risk management. Protecting

for people who understand security: addressing

students’ privacy and wellbeing is a priority that runs

existing vulnerabilities, scrutinising AI-generated

through decisions about the program’s expansion.

code and contributing where cybersecurity, AI and legislation meet.

Younger primary school students are joining, bringing different support needs. Junior volunteers are gaining

Yet her interest in emerging technology keeps

leadership opportunities while still at high school.

returning to a more human question. What is it

Behind the scenes, the organisation is building

actually doing for people?

platforms to support more students, locations and events.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

“By this I mean – technology is something that is

Letting go was not immediate or effortless. Building a

supposed to help people – do you feel like you know

team initially meant more work: explaining processes,

when and where it is doing that?”

supporting people and helping them learn tasks she could already do almost without thinking.

Renee sees value in further education around Responsible AI, defensive coding and human-

But that familiarity was part of the reason to hand

centric technology design. These areas offer

them over. Work that no longer challenged her could

a way to look beyond technical possibility and

help someone else build confidence or develop a skill.

consider consequences.

A chore for one person could become a worthwhile opportunity for another.

“Seeking further qualifications in Responsible AI, defensive coding, and human-centric tech design

“But at some point you need to say goodbye to every

are opportunities not to just ask ‘can we do this’ and

task, and the thing that is a burden to you can soon

instead ‘should we do this’.”

become a gift to someone else.”

It is a perspective that fits her work at GPN, where

Delegating has helped Renee improve her work–life

creating something exciting cannot be separated

balance. It has also helped GPN grow, giving others

from caring for the people who will use it.

room to bring their own ideas and energy to work she no longer had the time to develop.

Her leadership journey has involved another kind of learning, too. Alongside working full time and running

The change challenged something more personal: the

GPN and its supporting charity, Renee has spent

connection she had made between her worth and the

years reconsidering what it means to contribute—and

amount she could carry.

whether doing more herself is always the answer. “Reducing my pile of chores didn’t diminish how Early in her career, taking on everything felt like proof

highly anyone thought of me.”

of her capability. Tasks became badges of effort. Saying yes demonstrated that she could handle

Instead, it made space for new challenges and a

the work.

team whose members could rely on one another. It meant that taking a holiday could become a genuine

Eventually, she began to question what that

break, rather than a search for Wi-Fi to keep familiar

was achieving.

tasks moving.

“But it turns out doing any given thing doesn’t matter,

Renee’s journey began with an unexpected

there are no prizes for the number of tasks juggled.”

introduction to coding. Through GPN, that discovery has become an opportunity she can pass on not just to students trying cryptography for the first time, but to volunteers learning to lead and build. She no longer has to do every task herself to make that happen. Sometimes, the most useful thing she can do is give someone else the chance.

www.linkedin.com/in/noblerenee

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

CRAIG FORD Craig is an experienced cyber security professional with various qualifications including two master’s degrees. He is the Head Unicorn (co-founder and director) of Cyber Unicorns, in which he acts as a vCISO to clients such as Baidam Solutions, Wesley Mission, PCYC, Hungry Jacks and Ipswich City Council. He was CTO (Chief Technology Officer) for Baidam Solutions between January 2022 to June 2023, where he led the technical services team, helping to build out the internal services capability for Baidam. Craig was QLD chair for AISA for two years until he was appointed to the national board of directors in December 2022.

Own Your Place

Work out what you want and what you need to get there. And if what you want today isn’t what you want tomorrow, that’s okay too.

Lately, I’ve been thinking about my career, who I am and what I stand for. It’s an odd moment of self-

An oversimplification? Probably. But that lesson has

reflection, and I keep coming back to one question: is

stayed with me.

what I’m doing helping?

MAKING A PLACE For those who know me, I’ve spent more than 20

I’ve reached this point through hard work, a little luck

years working across ICT and security. Before

and a fair amount of stubbornness.

security was recognised as a distinct part of my role, it was already woven into the work: setting up

I wasn’t simply given a place at the table. I worked to

networks and firewalls, building servers and putting

create one. I earned it.

together complete client systems from scratch. I also dabbled in ethical hacking and penetration testing.

That doesn’t mean everyone starts from the same

Neither was ever my strongest skill, but I loved giving

position. Nor does it mean the barriers people face

it a go.

are the same. But your gender, age or background shouldn’t decide whether your ambitions deserve

I started in a small IT shop in regional NSW. My

a chance.

parents divorced when I was under five, and I grew up with my father, a mechanic. I was one of six children,

They do.

fourth in line and the eldest boy. We didn’t have much, but I have no complaints about my childhood. It

Take a step towards them. Then another. Even if you

helped make me the man I am today.

never reach the exact goal you set out to achieve, you can hold your head high knowing you did more

My father taught me that we’re going to

than talk about it or watch from the sidelines.

fall. Sometimes it will hurt more than others. That’s life.

You did the work. Give yourself credit for that. You should be bloody proud of what

What matters is how we get back up and

you’ve achieved.

what we do next. Brush off the dirt, take a moment to clear your head, then

I’m learning to give myself that same credit.

take a step forward. It doesn’t have to be perfect.

I created Cyber Unicorns because I wanted to make a difference, and I believe it is doing that. I’m also Deputy Chairman of the Board of the Australian Information Security Association (AISA), the peak body for information and cyber

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Craig is a published author with three different book series – ‘A Hacker I Am’ cyber education series, ‘Foresight’ is his Cyberpunk/hacker fantasy novel series and then there is ‘The Shadow World’, a co-authored kids cyber education book. He is a freelance cyber security journalist and is a regular columnist with the Women in Security Magazine, as well as a freelance contributor for Cyber Today, Top Cyber News, SecureGov, Careers with STEM and Cyber Australia magazines.

C O L U M N

security in Australia. It’s an association that hasn’t

There’s still plenty I want to do. Mountains to climb

always got everything right, but one that genuinely

figuratively, although you never know and problems

strives to make a difference for our industry.

I want to help solve. I don’t have every step mapped out. I’ll keep taking them anyway.

In the past 18 months, I’ve won seven international book awards, six of them in New York. Five

WHAT DO YOU WANT TO WORK TOWARDS?

recognised my hacker fantasy novel series, Foresight,

Now I’d like you to take a moment.

which I created to encourage more young women to explore cyber security and perhaps see a future for

Think about who you want to be, rather than the job

themselves in the industry.

title you want to hold. A title on its own won’t give you fulfilment. What do you want to achieve? What

Last year, my children’s book, The Shadow World,

matters enough to you that you’re willing to work

also received an award. I’ve helped donate more

for it?

than 8,000 copies to schools and other organisations across Australia.

Then ask yourself what’s standing in the way.

These are things I’m proud of. They’re also things I

If you need education or experience, look for a way

never imagined I would do.

to build it. That might mean asking for help, finding someone who will give you an opportunity or starting

A PATH THAT LOOKS MORE LIKE A SCRIBBLE

smaller than you hoped.

Am I perfect? Definitely not. It may not be easy. At times, it might be brutal. Has my career been a smooth, direct journey? It looks

A setback doesn’t have to be the final word, though.

more like a toddler’s scribble on a piece of paper. I’m

Sometimes you need a different route.

happy with that, though. You don’t need to solve your entire future today. I never dreamed I would become an award-winning

Just work out the next step. Something real,

author or sit on AISA’s board, let alone own a

something you can act on.

company like Cyber Unicorns with a mission I care so much about.

Then take it.

Some days, I feel as though I’ve been around long enough to become part of the furniture. On others, I

www.cyberunicorns.com.au

wonder whether I’m getting anywhere at all. www.linkedin.com/in/craig-ford-cybersecurity

And sometimes I fall. www.facebook.com/CyberUnicorns

When that happens, I come back to what my father taught me. Get up. Brush off my knees. Work out the

www.instagram.com/cyberunicorns.com.au

next step, however small, and take it.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

INDUSTRY PERSPECTIVES

MICHAEL BRAUN

THE MOST DANGEROUS MINUTES ARE AT YOUR OWN GATE: PROTECTING PRINCIPALS AND THEIR FAMILIES AT HOME by Michael Braun, Founder & CEO of MSB Protection

On the morning of 18 July 1989, actress Rebecca

studio to try to reach her, only to be turned away

Schaeffer answered the door of her Los Angeles

by security. De Becker explains that Bardo did not

apartment building. She was 21. The man outside

interpret that encounter as a boundary. He saw it as

was Robert John Bardo, a fan who had been fixated

meaningful contact.

on her for years. He shot her at her own front door. Bardo had also studied an earlier attack: Arthur Gavin de Becker recounts her story in The Gift of Fear.

Jackson’s stabbing of actress Theresa Saldana.

Every time I reread it, what strikes me is how ordinary

Learning that Jackson had located Saldana through

that final moment was. According to de Becker, the

a private investigator, Bardo followed a similar path.

building’s intercom was not working, so Schaeffer had

A detective agency obtained Schaeffer’s home

to come downstairs to answer the door herself. There

address through California’s Department of Motor

was no barrier between her and the person outside.

Vehicles records.

Public accounts describe Bardo visiting earlier that morning, then returning about an hour later.

Her death helped spur California’s 1990 anti-stalking law, the first in the United States, and the federal

The lead-up was anything but ordinary. Bardo had

Driver’s Privacy Protection Act of 1994.

written to Schaeffer repeatedly and travelled to the

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

The laws changed. The residential protection lesson remains: her address gave him a destination. The doorway gave him access.

WHY HOME CAN BE A WEAK POINT I began my career as a police officer in Bavaria, including service with the USK, and later moved into executive protection, including work with Gavin de Becker & Associates. Today, my team protects some of the world’s wealthiest people, their families and their homes and estates in California. One pattern keeps emerging: people can be highly exposed at home while feeling completely secure. “Nobody knows me,” they say. Or, “I’m not famous enough to be a target.” For those moments, the family’s movements are But public recognition is not a prerequisite for

predictable and attention is divided.

unwanted attention. Wealth itself can attract it. You do not need to be a household name to be

My teams treat this transition as a security operation,

researched, followed or targeted.

not a formality.

Home is also where routines become visible. Children

• Monitor the approach before arrival. Check the

leave for school at familiar times. Staff arrive for regular shifts. The same vehicles move through the same gate each morning.

street, parked vehicles and the area around the entrance before the principal’s vehicle turns in. • Coordinate the gate. Where it is safe to do so, have it open for the vehicle’s arrival rather than

Someone watching those movements may not need

leaving the family waiting on the street. Close

inside information. A parked car and a few mornings

it promptly once the vehicle has cleared the

of patience can reveal a great deal.

entrance, with security monitoring for anyone attempting to follow.

And home is where people relax. That is how it should be. The security arrangements need to account for it.

• Have an alternative. If something looks wrong, the driver should know not to stop—and where to go instead.

THE FINAL APPROACH

• Keep watch during the transfer. Someone needs

In protection, we talk about “red zones”: places where

to cover the movement from vehicle to front door,

a principal, the person being protected, must pass

rather than becoming occupied with bags.

through and has limited scope to avoid. You can vary a route across town. The final approach to your

The aim is straightforward: reduce unnecessary

driveway offers fewer options.

waiting and maintain attention until everyone is inside.

Arrivals and departures deserve particular attention. A vehicle slows, then stops while a gate opens. Doors

KNOW WHAT NORMAL LOOKS LIKE

open. Children climb out. Someone reaches for a

You cannot recognise something out of place without

phone while someone else unloads the boot.

first understanding what belongs.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

That is why one of the most useful tasks a residential

Household staff need equally clear guidance. A

team performs is also one of the least glamorous:

housekeeper, nanny or gardener may be the first

checking the area around the property and its

person an unexpected visitor approaches. They

approach routes.

should know how to respond, whom to contact and what information must never be shared including the

Each protector checks the red zone before arriving for

family’s schedule or whereabouts.

a shift, rather than relying on repeated patrol drives throughout the day. During the day, the team monitors

The instructions need to be practical enough to use

the approach street, logging suspicious activity and

on a busy day. People should not have to improvise at

relevant vehicle details.

the gate.

Over time, this builds a picture of the neighbourhood. Which vehicles belong to neighbours? When do

NOBODY OPENS THE DOOR WITHOUT CHECKING

people walk their dogs? Which contractors are

Schaeffer was reportedly expecting a script that

working nearby?

morning. A knock at the door would not necessarily have seemed unusual.

With that context, changes become easier to recognise: an unfamiliar car returning several days

For every household we protect, my rule is simple:

in a row, someone lingering near the gate around

security manages the door and verifies visitors,

school-run time, or a person repeatedly photographing

usually through an intercom. Family members and

the entrance.

household staff do not open it to someone whose identity has not been confirmed.

None of these observations, on its own, proves hostile intent. The value lies in recording and assessing

Deliveries go to a controlled receiving point, rather

them together, rather than dismissing each as an

than being handed directly to a family member at the

isolated event.

front door. An unexpected visitor waits outside while their identity and reason for attending are checked.

Bardo’s actions involved repeated efforts to reach Schaeffer. That persistence is an important part of the

Familiarity with deliveries should never become

story. A team that understands its surroundings has a

automatic permission to open the entrance.

better chance of noticing a developing pattern.

THE SYSTEMS THAT FAIL QUIETLY THE WHOLE HOUSEHOLD NEEDS A PLAN

Residential security gaps are often mundane. A

A principal can follow every agreed procedure

camera disconnects. An intercom stops working. A

and still be exposed through a gap elsewhere in

contractor leaves the gate open.

the household. They are easy to treat as household inconveniences. School runs warrant their own planning. They

They deserve more attention than that.

combine regular times with familiar locations

and may be among a family’s most predictable

CAMERAS AND CONNECTIVITY

movements. In the households we protect, a security-

Wireless cameras are convenient, but interference

trained driver handles pick-ups and drop-offs,

or connectivity failures can leave gaps in coverage.

supported by communication with the residential

A system that goes offline without notifying

team. The school must also know who is authorised

anyone may create reassurance without providing

to collect the children.

reliable protection.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

For critical views, particularly gates and entrances, my preference is hard-wired cameras with alerts for a loss of signal. Installation is only part of the job; someone must receive and respond to those alerts.

with clear collection authorisations and reliable communication. • Check critical camera coverage and make sure loss-of-signal alerts reach someone who can act. • Take repeated unwanted contact seriously,

BROKEN INTERCOMS

including letters and attempts to reach

In de Becker’s account, Schaeffer’s broken intercom

family members.

brought her downstairs to the doorway.

• Never leave an open gate unmonitored.

A failed intercom or video doorbell should trigger an immediate response, including an alternative way to

PROTECTING THE PLACE PEOPLE SHOULD FEEL SAFE

verify visitors until it is repaired. It should not quietly

Rebecca Schaeffer was not attacked on a red carpet

become a reason to answer the door in person.

or at a premiere. She was attacked at home, after answering her door.

OPEN GATES Gates are regularly left open for contractors, deliveries

We cannot know whether any single measure would

or convenience. It is one of the most common gaps

have changed the outcome. Her case nevertheless

I see.

puts residential security into sharp focus: how an address is found, how unwanted contact

If a gate must remain open, responsibility for

develops and what happens when a visitor reaches

monitoring it needs to be explicit. “Someone will keep

the entrance.

an eye on it” is not a security arrangement. For the families we protect, home should be

A PRACTICAL RESIDENTIAL SECURITY CHECKLIST

somewhere they can relax. They should not have to carry the security operation themselves.

For families and their protection teams, these are the measures I return to:

That responsibility sits with us especially during the short, easily overlooked journey from the street to the

• Reduce unnecessary exposure of the home

front door.

address. Review where it appears publicly and how it is shared through deliveries, social media

www.linkedin.com/in/michael-braun-336437333

and household communications. • Test intercoms and gate controls. Repair faults promptly and put an interim procedure in place. • Verify visitors before opening an entrance. Security should manage access where a

ABOUT THE AUTHOR

residential protection team is in place.

Michael Braun is the Founder & CEO of MSB

• Plan arrivals and departures. Monitor the

Protection, a California licensed private patrol

approach, coordinate gate access and maintain

operator. He protects not only residences and

coverage until the family is inside.

estates but some of the ultra-wealthy and most

• Build a picture of normal activity around the

influential people in the world, and many regard

property. Record concerns and review them

him as a leading figure in residential security and

together for patterns.

executive protection. He is a former Bavarian

• Brief household staff on unexpected visitors, deliveries and requests for family information.

police officer and former member of the USK, and has worked with Gavin de Becker & Associates.

• Include school runs in the protection plan,

I S S U E 32

WOMEN IN SECURITY MAGAZINE

JO STEWART-RATTRAY

WHY LEADERSHIP IS ABOUT MORE THAN FINDING YOUR OWN VOICE: MY DEFINITION OF ‘UNLEASHED’ by Jo Stewart-Rattray, Oceania Ambassador, ISACA

For many years, the conversation about women in

I have spent more than three decades working in

security has centred on finding our voice, earning a

technology, information security and risk. During

seat at the table and breaking through barriers.

that time, I have seen enormous change. Women are more visible across our profession. We are leading

Those things still matter. But I believe we have

organisations, sitting on boards, shaping policy and

reached a point where we need to ask a different

contributing to some of the biggest conversations

question: once you have a voice, what are you doing

about technology and security.

with it? But greater visibility does not mean the barriers To me, that is what being unleashed should mean.

have disappeared.

It is not simply about individual success or having the

There are still rooms where women are

confidence to speak more loudly. It is about turning

underrepresented. There are still voices that are heard

the influence we have gained into opportunities for

more readily than others. And there are still talented

others, particularly those whose voices are still too

people who remain outside influential professional

easily overlooked.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

networks simply because nobody has opened the

Importantly, we need to look beyond people who

door. That is where established leaders have an

remind us of ourselves.

important role to play. If we continue opening doors only for people already

FROM MENTORSHIP TO SPONSORSHIP

connected to established networks, we reproduce the

We often talk about the importance of mentoring

very structures we say we want to change.

women entering or progressing through security careers. Mentoring absolutely matters. I have

MAKE THE TABLE BIGGER

benefited enormously from people who have

One challenge for today’s leaders is to ask who is

shared their knowledge, challenged my thinking and

missing from the table, why they are not there and

encouraged me throughout my career.

what we can do about it.

But we also need sponsorship.

Cybersecurity needs diversity not simply because it is the right thing to pursue, but because our profession

A mentor might give someone advice about an

depends on different perspectives.

opportunity. A sponsor puts their name forward for it. The challenges confronting us are becoming more That might mean recommending an emerging

complex. Artificial intelligence is transforming

professional for a speaking opportunity or introducing

both attack and defence. Cyber risk increasingly

someone to an influential network. It could be

intersects with geopolitics, privacy, regulation, critical

encouraging them to apply for a leadership position,

infrastructure and national security.

or simply saying their name when they are not in the room.

We cannot address challenges of that scale through narrow thinking or by repeatedly drawing expertise

These actions can seem small to the person making

from the same circles.

them. For the person receiving the opportunity, they can alter the trajectory of a career.

Different backgrounds and experiences lead people to ask different questions and identify different risks.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

That is why I believe those of us with established networks and influence have a responsibility to extend them to others.

WHAT WILL WE UNLEASH NEXT? There is much to celebrate about how far women in security have come. But I do not want the next generation simply to become better at navigating the barriers previous generations encountered. I want us to remove as many of those barriers as we can. Being unleashed should mean more than claiming our own voices, power and opportunities. It should mean using them. Use your voice to challenge an assumption. Make an introduction that could open a door for someone. They also help people challenge assumptions that

If your position allows you to create an opportunity,

others may not even realise they are making.

consider whose expertise deserves to be recognised but has not yet been given the chance.

That is an enormous asset in security. Breaking through a barrier is an achievement we

INFLUENCE SHOULD HAVE A RIPPLE EFFECT

should be proud of. Ensuring others do not have to

There comes a point in a career when success should

face that same barrier is a mark of true leadership.

not be measured only by what you personally achieve. It should also be measured by what your influence makes possible for others.

ABOUT THE AUTHOR That means being prepared to challenge an outdated

Jo has over 30 years’ experience in the security

assumption when you hear one, or drawing attention

sector. She consults in risk and technology issues

to an idea that has been overlooked. Sometimes

with a particular emphasis on governance and

it means encouraging someone who does not yet

cybersecurity as a director with BRM Advisory.

recognise their own leadership potential.

Jo is the Oceania Ambassador for global IT professional association, ISACA, and an ISACA

And sometimes it means giving up space so

Hall of Fame inductee. Jo is the former Vice

somebody else can occupy it.

President, Communities of the Australian Computer Society and Ambassador of the

None of us builds a career entirely alone.

National Rural Women’s Coalition. She regularly provides strategic advice and consulting to the

Throughout mine, professional communities such as

banking and finance, utilities, healthcare, tertiary

ISACA have been incredibly important. They provide

education, retail and government sectors.

knowledge and networks, but at their best they also create something less tangible: a sense that you belong in the profession and have something valuable

www.linkedin.com/in/jo-stewart-rattray-gaicd-4991a12

to contribute.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

GORDANA GINA MIHAJLOVSKA

DO WE KNOW HOW TO LEAD IN AN AI WORLD? by Gordana Gina Mihajlovska, CEO AIGentic Consulting

Are cyber leaders caught between worlds? Many of the people we trust to secure our

That approach helped build a profession. But many of

organisations stand with one foot in a world that no

its assumptions no longer hold.

longer exists. The other hovers over a world they have not yet learned to name.

A perimeter is harder to define when work happens across personal devices, cloud platforms and third-

That is not a criticism of their competence. But

party services. The line between inside and outside

dedication to a model is not the same as fitness

blurs when an employee can paste sensitive data

for the moment. The uncomfortable question is

into a public AI tool in seconds. And a checklist alone

whether we know how to lead in an AI-enabled world,

cannot account for threats that change faster than

or whether we are managing a new reality with the

the governance intended to contain them.

assumptions of an old one. Yet cyber strategy is still too often a technology Too many cyber leaders are caught between

roadmap with a risk register attached. Success

worlds. The gap is where some of our most serious

is measured by controls deployed rather than by

vulnerabilities now live.

how well people understand and manage the risks they encounter.

THE 1990S INHERITANCE clear task: defend the network. The metaphors were

VULNERABILITY IS ALSO A SOCIAL CONDITION

the castle, the moat and the perimeter. Good security

The shift is not simply technological. Vulnerabilities

meant firewalls, patching and access controls,

arise not only from flawed code, but from the

supported by frameworks that helped organisations

conditions in which people live and work.

Much of modern cyber security took shape around a

manage risk.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

Supply chains, data flows and digital infrastructure have become instruments of geopolitical power. Eroding trust in institutions, media and expertise can leave people more susceptible to manipulation. Financial pressure and insecure work can contribute to fatigue, distraction and resentment conditions that attackers may exploit. When people feel uncertain or left behind, they may take shortcuts, overlook warning signs or trust information that confirms their fears. Calling them the weakest link is too easy. It also lets organisations avoid examining the pressures their own systems create. A strategy that ignores those conditions risks defending the wrong thing.

Those tensions need more than reassuring messages. They need to be addressed in the way

WHO DOES AI SERVE?

technology is selected, introduced and governed.

AI enters this unsettled landscape with a tension at its centre.

COMPLIANCE, GOVERNANCE AND THE WORLD WE KNOW

It can expand access to services, support people with

The pull of familiar thinking is particularly strong in

disabilities and help smaller organisations strengthen

compliance and governance.

their defences. It can also concentrate power. The resources needed to develop frontier systems sit

Standards such as ISO/IEC 27001 and the NIST

largely with a small number of firms and states.

Cybersecurity Framework provide valuable structure.

Tools that protect people can also be used to profile,

But following a framework does not remove the need

persuade, surveil or exclude them.

to question whether an organisation’s controls remain appropriate as its risks change. AI-focused standards

This is a security question, not simply an ethical one.

such as ISO/IEC 42001 bring additional structure, not an exemption from that responsibility.

When people believe a technology serves someone else’s interests at their expense, trust can unravel.

Security leaders already recognise the distinction

Workarounds follow. Staff turn to unapproved tools

between compliance and security. Yet the measures

or disengage from controls they do not understand.

that matter to them may differ from those that matter

Meanwhile, adversaries use AI to produce convincing

to their boards: 15% of CISOs rank compliance as

deception at greater speed and scale.

a top performance measure, compared with 45% of boards.

The contradictions are difficult to escape. We ask staff to trust AI-enabled security while warning

There is also a gap between expectation and

them not to trust AI-generated content. We demand

preparation. While 94% of organisations expect AI to

transparency from systems we cannot always

reshape cyber security, only 8% regularly rehearse AI-

fully explain.

specific incidents.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

The issue is not whether governance has value. It is

• Work across disciplines. Cyber leaders need to

whether we use it as a foundation for judgement or a

translate between technical teams, policymakers

substitute for it.

and the people whose behaviour their strategies depend on. They do not need to be experts in

Our ability to challenge and update our own thinking

everything. They do need to know when another

has become a security concern. Governance that

perspective is missing.

cannot respond to changing risk can become a vulnerability in its own right.

STEPPING ACROSS The earlier era of cyber security gave us discipline and

WHERE CYBER STRATEGY NEEDS TO GO

a profession worth having. We should keep what it

If vulnerability lives within these tensions, strategy

taught us. We cannot assume its models are enough.

must address them directly. Leading in an AI-enabled world means recognising • Read the world, not just the network. Geopolitics,

that cyber security is not only about protecting

social trust and economic pressure belong

systems from people. It is also about protecting

in strategic discussions, not in a separate

people within systems they did not design, may not

conversation after the technical decisions have

fully understand and increasingly depend on.

been made. • Treat trust as infrastructure. Ask who an

That requires leaders who can stay with difficult

AI deployment serves, who carries the risk

questions long enough to understand what

and whether the people affected have a

sits beneath them and turn that understanding

meaningful voice.

into decisions. Are we still caught between worlds, or

• Design security around human needs. People

are we ready to step across?

need clarity and a reasonable degree of agency. Controls that disregard how work actually gets

done invite workarounds.

• Make the trade-offs visible. AI’s benefits and burdens will not necessarily be shared equally. Leaders need to name those differences rather

www.linkedin.com/in/ginamihajlo

than hide them behind claims of efficiency.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

LET US HELP YOU OVERCOME YOUR BUSINESS DATA CHALLENGES

Our team understand the importance of time and efficiency when it comes to data projects. Core Services Database creation Database admin cleaning Database appending services Data enrichment Data verification Telemarketing services CONTACT US!

0415 500 580

Aby@source2create.com.au source2create.com.au

LISA VENTURA

WHEN THE MAP DOES NOT EXIST YET: GOVERNING AI BEFORE THE RULES ARRIVE by Lisa Ventura MBE FCIIS, Chief Executive and Founder, AI and Cyber Security Association

Finding our way through AI, cyber security and the rules still taking shape.

There is a strange feeling that comes with working

(AICSA). Every decision seemed to raise the same

in AI and cyber security right now. Almost daily, you

underlying question: if the map does not exist yet,

are asked to make judgements about systems that

who is qualified to draw it, and by what authority?

did not exist a few years ago, using guidance that, in many cases, has not yet been written. The technology

THE GAP BETWEEN PRACTICE AND RULES

has run ahead of the rulebook. The people expected

Regulation is taking shape. The EU AI Act is a

to keep it safe are working on ground no one has

significant development, but translating legislative

properly surveyed.

requirements into practice is not straightforward. Anyone relying on specific compliance dates should

I have felt this acutely over the past year while

check the current position rather than assume the

helping to build a self-regulatory framework for the

timetable is settled.

convergence of AI and cyber security through the newly formed AI and Cyber Security Association

W O M E N I N S E C U R I T Y M A G A Z I N E

Meanwhile, the work does not wait.

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

A security team assessing an AI tool this week cannot

This is uncomfortable in a profession that values

pause until the guidance catches up. It must decide

certainty. It is also freeing.

whether a model can be trusted with sensitive data, how to detect manipulation and what to do when

If expertise is still developing, the map is being drawn

an autonomous system behaves in a way nobody

collectively, in real time, by the people doing the work.

anticipated. These are live questions with real

That includes practitioners, not only regulators and

consequences. The formal rules may still be absent,

vendors. It includes women and newcomers who

incomplete or open to interpretation.

might assume the important decisions were settled before they arrived.

That is the gap. Practice moves at the speed of deployment. Regulation moves at the speed of

They were not.

consensus. When the two diverge as sharply as they have with AI, something has to fill the space

WHY VOLUNTARY FRAMEWORKS MATTER

between them.

Voluntary and self-regulatory frameworks receive a mixed reception. Some of the criticism is deserved.

BEING HONEST ABOUT EXPERTISE

Done badly, self-regulation can become a way to

Here is where we need to be more truthful than the

avoid accountability, a box-ticking exercise or an

industry sometimes allows: no one has complete

attempt to head off legislation. Those concerns

expertise across a field changing this quickly.

should not be waved away.

We have deep expertise in cyber security and in

Done well, however, these frameworks can help a

machine learning. But their convergence, at the scale

community agree on shared expectations while

and speed we are now seeing, presents unfamiliar

formal rules are still being negotiated.

challenges even for experienced specialists. When someone claims complete authority over how AI

The NIST AI Risk Management Framework and the

should be governed and secured, I have learned to

ISO/IEC 42001 management system standard offer

be cautious. Much of our understanding remains

structured approaches to managing AI risk. Neither

provisional. Pretending otherwise does not make

replaces legal obligations or regulatory enforcement.

anyone safer.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

They do, however, give organisations a basis for

It also needs a wider range of voices. The people

action rather than leaving each team to work out its

affected by AI systems are not only those who build

approach alone.

them. When the people writing the guidance share similar backgrounds and experiences, they can

My work with AICSA has reinforced that a voluntary

overlook risks that are obvious to someone outside

framework’s value does not lie in having every answer.

that room.

It lies in creating a place to ask difficult questions honestly, alongside people building and defending

For women working in security, this is a reason to

these systems, and to revise the answers as

contribute, not to wait for permission. Experience of

understanding improves.

where a process breaks down, whose concerns go unheard or how a system behaves in practice belongs

A framework that cannot be revised is not much use

in the discussion.

in a field moving this quickly. There is also a temptation we need to resist:

WHAT GOOD MAP-MAKING LOOKS LIKE

performing certainty. Commercial and reputational

If we accept that we are drawing the map as we go,

pressures can make confident answers more

how we draw it matters.

attractive than honest ones. I would rather see a framework acknowledge where the evidence is thin

Good governance needs humility. It should

than disguise the gaps to appear complete.

acknowledge its limits and include a practical mechanism for review, rather than present today’s

Being open about what we do not yet know is not a

understanding as settled truth.

weakness in governance. It is what allows governance to improve.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

THERE IS STILL ROOM TO SHAPE THE MAP

LISA ON SOCIAL MEDIA

So, who gets to draw it? No single group should, and no single group can.

@cybergeekgirl

Regulators, standards bodies, researchers, vendors and practitioners all have a part to play. The challenge

www.linkedin.com/in/lisasventura/

is to connect their efforts rather than let them pull in different directions.

www.facebook.com/lisasventurauk

If you feel you arrived too late, or lack the right

www.instagram.com/lsventurauk

credentials to contribute, I would gently challenge that assumption. Long experience matters, but it is not the

bsky.app/profile/cybergeekgirl.bsky.social

only useful qualification. Direct experience of these emerging problems matters too.

You can find examples of the talks she has done previously and of interviews, panel discussions and

If you are securing AI systems, questioning their

moderating/chairing events on her YouTube channel:

behaviour or noticing where the guidance fails, you already have something worth bringing to the discussion. Uncharted territory has one honest advantage over

www.youtube.com/@CyberSecurityLisa

AI and Cyber Security Association’s Channels

well-trodden ground. There is still room to decide where the roads go.

x.com/AICyberSecAssoc

www.linkedin.com/company/aicybersecassoc

www.facebook.com/aicybersecassoc

ABOUT THE AUTHOR Lisa Ventura MBE FCIIS is a cyber security awareness and communications specialist with more than sixteen years in the field, which she entered from a background in journalism and broadcasting. She is the Chief Executive and Founder of the AI and Cyber Security Association, a global trade association for the convergence of AI and cyber security, and the founder of the consultancy Unity Group Solutions. She was awarded an MBE for services to cyber security and to diversity, equity, inclusion and belonging, and holds a Fellowship of the Chartered Institute of Information Security. She is the author of Artificial Intelligence in Cybersecurity (Kogan Page). An autistic and ADHD advocate for neuroinclusion, she co-founded Neuro Unity to champion neuroinclusion for all.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

CANDELA RABEC

WHEN SECURITY AWARENESS ENDS, THE REAL TEST BEGINS by Candela Rabec, Cybersecurity Specialist

Why the missing feedback loop between awareness and security operations matters Security awareness is usually tasked with changing

If those observations are not connected, each team is

behaviour. Security operations is tasked with

only seeing half the picture.

detecting and responding to threats. On paper, they are separate functions.

That is the gap we should be paying more attention to. Not whether awareness should sit inside SecOps,

In practice, both generate information the other side

or whether SecOps should own awareness, but

needs and too often, that information stops at the

whether the two functions are set up to learn from

boundary between them.

each other quickly enough.

An awareness team may notice that employees are increasingly reporting unexpected MFA

AWARENESS PRODUCES MORE THAN TRAINING METRICS

prompts, unusual calls, or suspicious messages

Awareness programs generate far more than

in collaboration platforms. At the same time, the

completion rates and phishing simulation results.

security operations team may be seeing identity

They reveal where people hesitate, what kinds of

anomalies, help desk impersonation attempts, or

requests create confusion, which processes are

repeated access requests.

difficult to verify, and what employees are noticing in the course of their work.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

These are not simply training observations. They can

are being targeted, what attackers are asking for, and

be operational signals.

which business processes are being abused. That intelligence should shape awareness activity far more

If a simulation shows that a significant number

directly than a fixed annual training calendar.

of employees struggle to recognise an unusual password-reset process, the response may not just

If the security team sees an increase in help desk

be another training module. It may be worth asking

impersonation, awareness messaging should reflect

whether the process itself is too easy to imitate.

it. If incidents are shifting from email into messaging platforms or voice calls, training needs to move with

If employees are repeatedly reporting unexpected

them. If an investigation reveals that a legitimate-

authentication prompts, that may warrant attention

looking process caused confusion, that is useful

beyond the awareness dashboard. If the same kind

material for the next communication, simulation, or

of suspicious phone call is being reported across

practical exercise.

different teams, the pattern may matter more than any individual report.

The separation between these areas can feel increasingly artificial. One side sees how people

The value comes when we stop treating awareness

respond to risk. The other sees how threats behave

data as a measure of whether people learned

in the environment. Both are trying to reduce the

something, and start asking what it tells us about how

same exposure.

the organisation could be targeted.

THE FEEDBACK LOOP WE ARE MISSING SECOPS KNOWS WHAT PEOPLE NEED TO LEARN NEXT

A mature program should create a continuous loop.

The flow of information needs to move in the other

Awareness teams gather observations. Employees

direction as well.

report what feels unusual. Security operations add technical context. Incidents and investigations

Security operations sees the live environment. It

reveal new patterns. Those patterns then return to

knows which attack paths are emerging, where users

awareness, improving the next intervention.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

That distinction matters because a healthy reporting culture lowers the cost of uncertainty. If people believe they must be certain before reporting something, they will wait. If they think a false alarm will be treated as a mistake, they may stay quiet. Neither helps detection. The goal is not to create thousands of amateur analysts. It is to make human context available when it matters. A staff member may not know whether an email, phone call, MFA prompt, or Team message is malicious. But they often know when it does not match the way work normally happens. It sounds obvious, yet this loop is easily broken.

That instinct can be an early signal.

Awareness may sit within communications, risk, people and culture, or learning teams. Security

FROM AWARENESS PROGRAM TO SECURITY CAPABILITY

operations may be housed elsewhere. Their metrics

This changes how we think about awareness. It is

differ. Their tools differ. Their meetings differ. Even the

still education. It is still communication. It is still a

language used by each group can be quite different.

behaviour change. But when the signals it produces can influence detection, controls, procedures, and

The result is that valuable information remains local.

incident response, awareness becomes part of a broader security capability rather than a separate

A recurring pattern may be dismissed as a training

training activity.

issue when it is also an operational concern. An incident may be treated as a technical lesson when

The same applies to SecOps. Detection does not

it could change how people are prepared for the next

always begin with a technical alert. Sometimes, the

attempt. The connection is often there. It just is not

first useful signal is a person noticing that a request

always designed into the way teams work.

does not sound right, does not follow normal process, or arrives at an odd moment.

For security leaders, the question is not whether awareness and SecOps need to become one team.

The strongest organisations will not be those that

It is whether the organisation has a reliable way for

choose between people and technology. They will be

insight to move between them.

the ones that make information travel between them.

DON’T TURN EMPLOYEES INTO ANALYSTS

So perhaps the question is not where security

There is an important limit to this idea.

awareness ends and SecOps begins.

Employees should not be expected to diagnose

Perhaps the more useful question is whether they are

attacks, classify incidents, or decide whether

learning from each other at all.

something meets a technical threshold. They should be able to say, “This feels unusual,” without having to prove why. Security teams can investigate the rest.

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/candela-rabec

www.instagram.com/rabec.cande

N O V E M B E R • D E C E M B E R 2026

Contact us today to find out how you can become an industry contributor, no matter the level of experience. reach out now www.womeninsecuritymagazine.com

LILY DAY

SHRUTI SHANBHAG

ERIN CARROLL

UNLEASHED: THE PARTS OF OURSELVES WE FINALLY GIVE PERMISSION TO GROW by Lily Day, Business Continuity Management Shruti Shanbhag, Senior Consultant, Consulting Tech Risk & Operational Resilience Erin Carroll, Risk Consultant Lauren Webber, Cyber Consultant Sakshi Kishore, Associate Director, Tech Risk and Cyber, Consulting Emily Wanczura, Consulting – Technology Risk & Cyber Security

We often imagine growth as something that happens

should have set much earlier. Sometimes it was my

in a straight line. Work a little harder, learn a little

health refusing to be ignored, or a sense of purpose

more, stay focused long enough, and success will

that had gone quiet and needed to be heard again.

follow. I believed that for a long time. I thought that if I looked after my career, the rest of my life would

Somewhere along the way, I stopped seeing life as a

quietly look after itself.

ladder and started seeing it as a living system. When one part of us grows, the others tend to benefit. When

Life eventually taught me that growth is rarely

one part is neglected, the effects rarely stay where we

so orderly.

left them.

The moments that have shaped me most have often

The theme for this issue is Unleashed, a word that

come from somewhere else: a conversation that

invites us to picture something bold: a career-

changed how I saw something, a relationship that

changing promotion, a business idea brought to life,

deepened when I finally paid attention, a boundary I

a finish line crossed after months of effort. Those

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

LAUREN WEBBER

P E R S P E C T I V E S

SAKSHI KISHORE

EMILY WANCZURA

moments deserve to be celebrated. But the more I

in many aspects of my life, I am still the first or the

sat with the word, the more I found myself arriving

only. After the panel, people wanted to ask not only

somewhere quieter.

about being a woman in technology, but also about my experiences of being disabled, neurodiverse and

When I think about the people I admire most, very

queer, and coming from a regional background.

few were unleashed in a single moment. Their growth came gradually, often because one part of life had

In that moment, I understood that being open about

finally been given room to move.

my experiences helps other people like me see a future in a world that can feel out of reach. Just as I

Rather than explore that idea alone, I invited

had once looked at women on the other side of the

colleagues I respect and learn from to join me. I asked

glass ceiling and aspired to be one of them, I had now

each to choose an area of life that had mattered

become that person for someone else.

to them recently and reflect on a moment when something began to shift. I chose one myself, too.

Being the “first” or “only” in so many ways means there is often no baseline against which to compare

Our map was a simple Circle of Life: career, learning,

me and no system designed to accommodate me.

family, relationships, health, fun and adventure,

Once I found my passion in operational technology

finance and wealth, and spirituality and soul. We

and critical infrastructure, it gave me the motivation to

separated them on the page because a map needs

keep making a path for myself and, I hope, for others

boundaries. Life, as these stories show, is less tidy.

to follow.

What follows are honest reflections on small

There is a weight in knowing that I am helping to

movements that can change far more than we

create a precedent for others. I am planting seeds

first realise.

that may grow into trees, even if I never sit in their shade.

CAREER: LILY DAY’S REFLECTION Career success is usually measured in titles,

WHAT STAYED WITH ME

promotions and milestones that fit neatly on a CV.

Lily’s reflection reframed progress for me. A path

Lily offers another way to think about it. Her journey

matters not only because of where it takes us, but

has been about making a path where no obvious path

because of who can see it and continue along it after

existed and helping others see that they can move

us. Sometimes the most important part of being first

forward, too.

is making sure we are not the last.

IN LILY’S WORDS

LEARNING: SHRUTI SHANBHAG’S REFLECTION

The first time I was asked to speak on a Women in

We tend to think of learning as something that

Technology panel for people looking to enter the

arrives with a certificate attached. Much of our most

technology sector after university, I realised that,

valuable learning does not. Shruti’s story explores

I S S U E 32

WOMEN IN SECURITY MAGAZINE

what happens when we stop believing we need every

WHAT STAYED WITH ME

answer before we begin.

Shruti’s reflection is a reminder that confidence is not always something we find before taking on a

IN SHRUTI’S WORDS

challenge. Often, it develops because we were willing

Learning is often associated with qualifications,

to begin without having every answer. Learning does

training courses or formal certification. Over the past

more than add to what we know; it changes what we

year, I have started to see it differently.

believe we are capable of.

Throughout my career, I have worked with different

HEALTH: EMILY WANCZURA’S REFLECTION

clients and industries and encountered very different

Health is often the promise we make to ourselves for

challenges. Each experience helped me build skills

later, once work settles down or life becomes less

and knowledge. What surprised me most, though, was

busy. Emily’s experience challenges that bargain.

how much those experiences shaped my confidence

For her, looking after her health became part of what

and outlook.

made balance possible.

New projects, unfamiliar topics and challenging

IN EMILY’S WORDS

conversations pushed me beyond my comfort zone.

Maintaining a healthy lifestyle has always been

Some felt daunting at the time. Looking back, I have

important to me. Growing up, I competed as a

realised that growth rarely comes from knowing

swimmer, which shaped my appreciation for fitness

all the answers. It comes from being willing to ask

and wellbeing. After moving away for my studies

questions and sit with uncertainty.

and career, I found it difficult to balance work and life while maintaining healthy habits. Like many young

What began as professional development became

professionals living independently for the first time, I

a broader lesson in personal growth. Continuous

struggled particularly with preparing nutritious meals.

learning introduced me to new perspectives, challenged my assumptions and helped me

After years of experimenting, the approach that

approach unfamiliar situations with curiosity rather

finally worked for me was joining a gym that offered

than apprehension.

more than fitness classes, with broader support for a healthy lifestyle. With tailored advice, I developed a

Progress is not measured only by what we already

genuine passion for nutrition. I began experimenting

know, but by our willingness to keep learning. It

with recipes and paying closer attention to the

can unlock potential we may not yet recognise in

nutritional value of my meals.

ourselves. Every interaction can teach us something when we are willing to notice.

A more organised approach has made meal planning and grocery shopping far less stressful. More importantly, it has left me feeling healthier, more energised and happier overall, while also improving my performance in the gym.

WHAT STAYED WITH ME What began with food and fitness reached much further. Emily’s experience reminded me that health is not simply another task to fit around life. It affects the energy and presence we bring to everything else. Looking after ourselves is part of what sustains the rest of the circle.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

FAMILY AND RELATIONSHIPS: SAKSHI KISHORE’S REFLECTION

FUN AND ADVENTURE: LAUREN WEBBER’S REFLECTION

The Circle of Life places family and relationships in

Fun may be the part of life we postpone most easily,

separate segments, although in practice they rarely

filed away for when the real work is done. Lauren’s

stay apart. The people who steady us are often the

reflection makes a gentle case for taking it more

same people who cheer us on. Sakshi’s reflection

seriously. Sometimes what looks like a social moment

sits at that meeting point, exploring the courage of

is where belonging begins.

connection and what can be waiting on the other side of hesitation.

IN LAUREN’S WORDS We often think of fun as something that sits outside

IN SAKSHI’S WORDS

the important parts of life, something to enjoy once

Family, for me, is both strength and anchor. They are

the work is done. Over the past year, I have started to

the steady ground I come back to.

see it differently.

What has surprised me recently is what happens

As part of the Sydney Social Club at KPMG Australia,

when I find the courage to be bold. Each time I have

I had the opportunity to organise our Vivid Cruise.

stepped forward, I have looked up to find myself

I expected it to be a fun night out. What surprised

surrounded by cheerleaders, people quietly willing me

me most, though, was not the Sydney Harbour

on, far more of them than I expected.

backdrop. It was seeing more than 300 colleagues come together, many of whom might never have

By nature, I am one of those quiet cheerleaders

met otherwise.

myself. I have always been happier championing someone from the side than standing in the middle

Watching people connect, laugh and enjoy each

of the room. Small talk has never come easily to

other’s company, I realised these moments create

me. The thought of walking up to someone I did not

something much bigger than a social event. New

know and beginning a conversation used to fill me

friendships formed. People from different teams

with apprehension.

found common ground, and existing relationships grew stronger. There was a genuine sense of

On the occasions when I have set that fear aside and

community and pride in being part of something

simply started, the results have amazed me. There

beyond our individual roles. I have always enjoyed

have been conversations, connections and doors that

creating opportunities for people to have fun, but

quietly opened.

this experience shifted my perspective. Fun is not separate from the other areas of life. It creates

Moving from holding back to stepping forward has

connections that carry into our everyday lives.

taught me that the relationships which strengthen us most can sit just beyond a fear we need to move

Community does not happen by accident. It grows

through first.

when people make the effort to bring others together. Sometimes the most meaningful impact comes

WHAT STAYED WITH ME

from creating a space where people feel included

Sakshi’s reflection made me think about how often

and remember they are part of something bigger

belonging waits on the other side of a small act of

than themselves.

courage. We can spend years hoping to feel confident enough to step forward. Sometimes taking the step

WHAT STAYED WITH ME

is what creates that confidence. A conversation does

Lauren’s story reminded me that fun is rarely only

not need to be extraordinary to change a relationship.

fun. It makes room for unplanned conversations and

It needs someone willing to begin it.

unexpected friendships, the kind of connection that

I S S U E 32

WOMEN IN SECURITY MAGAZINE

to absorb uncertainty and the freedom not to need the next thing. The lesson I have carried with me is that personal finance has less to do with intelligence than we often assume. Our behaviour matters. So does knowing what “enough” looks like for us. A life spent measuring itself against someone else’s has no natural finish line. For me, financial confidence is not only about accumulation. It is about buying back a choice. Understanding money a little better allows me to make more decisions from freedom and fewer from fear. That freedom does not stay in the finance segment of the circle. It quietly changes what becomes possible elsewhere.

cannot be scheduled into a formal agenda. Joy may

SPIRITUALITY AND SOUL: ERIN CARROLL’S REFLECTION

look like the least serious part of the circle, but it often

Purpose may be the part of the circle we spend

does some of its most important work.

the longest searching for. We often assume it is something we find once and follow forever. Erin’s

FINANCE AND WEALTH: A PERSONAL REFLECTION

reflection challenges that idea. Her career changed

There was one part of the circle I wanted to sit with

remained.

dramatically, but the thread running through it

myself, partly because my relationship with money began long before I earned any of my own.

IN ERIN’S WORDS After more than 17 years as a teacher and school IT

FROM MY PART OF THE CIRCLE

administrator, I made the decision to change careers

I grew up in a home where money was worked

and move into cybersecurity. At the time, it felt as

hard for. My parents made ends meet through long

though I was leaving behind the profession that had

hours and steady effort. I learned early that financial

shaped much of my identity and purpose.

security is not something everyone is handed. It is built quietly, often over years.

What I eventually realised was that while my career was changing, the values guiding me were not.

That upbringing shaped how I thought about money.

I have never considered myself particularly religious,

For a long time, I treated it as a scoreboard running

but I have always been driven by purpose and a

alongside the rest of life.

desire to help others. Whether I was supporting students through challenges in the classroom or

Morgan Housel’s The Psychology of Money offered an

helping organisations build resilience in the face

idea that reframed this for me: real wealth is largely

of uncertainty, what gives my work meaning is

invisible. It is not the car in the driveway or the watch

the opportunity to make a positive difference in

on the wrist. That is money already spent. Wealth is

people’s lives.

what remains: the options held in reserve, the ability

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

The common thread has never been the role itself. It

whole people moving through different seasons,

has been empathy, service and a genuine desire to

each asking something different of us. At one point,

leave things better than I found them.

a career may need courage. At another, family needs our presence, or joy simply needs a place back in

The shift came when I realised that purpose is not

the diary.

tied to a job title. It lives in how we show up for others and the impact we have on the people around us.

Balance, in that sense, is not an even distribution of

Understanding that gave me a stronger sense of

hours. It is recognising what matters now without

direction and fulfilment.

forgetting that the rest of us still exist. It also means accepting that our attention will shift as life does.

It taught me that success is not simply about achievement. It is about living in alignment with the

Being unleashed is not about maximising everything

values that matter most and using our strengths to

at once or transforming overnight. More often,

help others navigate their own journeys.

something small begins to move. We ask a question we have been holding back. Keep a promise to

WHAT STAYED WITH ME

ourselves. Accept an invitation before we feel ready.

Erin’s reflection offers a reassuring thought for anyone whose career has changed direction. A role

The moment can look ordinary from the outside. Its

can end or an industry become unfamiliar without our

consequences may be anything but.

purpose disappearing. The people who shared these stories did not become Sometimes we do not need to find an entirely new

someone else. They gave more room to a part of

purpose. We need to recognise the thread that has

themselves that was already there. That may be

been running through our choices all along.

the most useful definition of being unleashed: not a dramatic reinvention, but the courage to stop

WHAT THE CIRCLE REVEALS

postponing what matters.

Reading these reflections together, what stayed with me was not how different they were, but how connected

There may be a part of your own circle asking for

they felt.

attention now. It may not need a complete overhaul or a perfect plan. Perhaps it only needs an honest

Lily’s story about career became a story about

first step. What might begin to move if you finally

representation. Shruti’s experience of learning opened

made room for it?

her confidence. Emily’s focus on health gave her energy for the rest of life, while Sakshi’s reflection on relationships revealed the courage it takes to connect. Lauren found belonging through fun. My own reflection on money became a reflection on freedom. For Erin, a change of career brought the continuity of

www.linkedin.com/in/lily-day-080350147

www.linkedin.com/in/shruti-kamath

www.linkedin.com/in/erinlouisecarroll

her purpose into focus.

www.linkedin.com/in/lauren-webber-

The boundaries blurred because life rarely stays

www.linkedin.com/in/sakshikishore

inside the categories we create for it. Perhaps that is the quiet wisdom in the circle. We are

www.linkedin.com/in/emily-wanczura-9ba09b275

not separate parts competing for attention. We are

I S S U E 32

WOMEN IN SECURITY MAGAZINE

BETH TSCHIDA

THE AI GOVERNANCE GAP By Beth Tschida, CEO of Jamf

As organisations pursue the productivity gains

THE ENDPOINT BLIND SPOT

promised by generative and agentic artificial

Traditional cybersecurity approaches rely heavily on

intelligence (AI), technology leaders face a familiar

perimeter defences, including cloud access security

pressure: move quickly, but keep the business secure.

brokers, secure web gateways and network firewalls.

The difficulty is that AI adoption is often moving

These controls can restrict access to known cloud

faster than the controls needed to govern it.

applications. But enterprise AI is evolving, and some of the hardest activity to see now happens directly on

I call this the “AI governance gap”.

employee devices.

Our new global research, which surveyed

Developers, engineers and other power users

687 IT and security leaders across Apple-first

are adopting command-line interfaces, Model

organisations, highlights its scale. While 72.9 per

Context Protocol (MCP) servers and local desktop

cent of organisations have deployed AI in some

integrations. These tools can operate beyond the

form, deeper adoption does not necessarily mean

visibility of conventional network controls, creating

lower risk. Among organisations with deeply

a growing challenge around “shadow AI”: tools and

integrated AI programs, 27.1 per cent reported an

integrations used without organisational approval

AI-related security or cost incident in the past year,

or oversight.

compared with 19.4 per cent of those still exploring the technology.

Network security tools may detect encrypted traffic to cloud services without revealing what a local AI

Overall, 81.7 per cent of enterprise IT leaders have

agent is doing, which files it can access or whether

either experienced an AI-related security or cost

an unmanaged integration has permission to use

incident or expect to face one soon.

sensitive corporate data.

Closing this gap means understanding how AI

That distinction matters. Knowing that an employee

operates on employee devices and moving beyond

has connected to an AI service is not the same as

written policies to controls that can be enforced.

understanding what that service can do.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

Security teams need visibility into activity on the

In Apple environments, this means applying approved

device itself: which AI tools are present, how

AI configurations at the operating-system level,

employees use them and what corporate resources

where supported controls can be harder for users

they can reach. Without it, effective governance

or local processes to override. Connecting endpoint

remains difficult.

management with identity is also important, so AI agents can be assigned appropriate identities,

MAKING GOVERNANCE PRACTICAL

credentials and permissions.

The answer is not simply to block AI. Banning useful tools rarely makes demand disappear. It can

This moves governance from a statement of intent to

push employees towards personal accounts or

something operational. It also gives security teams

unapproved services, leaving security teams with

and executives clearer evidence of AI use, helping

even less oversight.

them demonstrate accountability rather than relying solely on employees to interpret and follow policy.

The more useful question is how to make approved AI use practical, while setting boundaries the

WHO SHAPES THE RESPONSE MATTERS

organisation can enforce.

The AI governance gap is a technical challenge, but addressing it also demands different perspectives and

Our research shows that organisations are

the confidence to question established approaches.

simultaneously working to automate IT operations, deploy AI productivity tools and establish AI

My career has shaped how I think about that

governance. These priorities need to support one

responsibility. I spent two decades leading technology

another rather than compete for attention.

and infrastructure platforms in highly regulated

I S S U E 32

WOMEN IN SECURITY MAGAZINE

financial services environments at MetLife and Voya

Strategic Advisory Board, alongside mentoring

Financial. Those roles taught me the importance

emerging talent.

of resilient foundations, particularly when the consequences of failure are significant.

Diversity belongs in this conversation because the people designing AI governance will influence whose

I joined Jamf in 2018 to lead engineering, became

concerns are heard, which risks are questioned and

Chief Technology Officer in 2022 and stepped

how decisions are made.

into the CEO role in 2026. Along the way, I have led a global technology organisation spanning

A FOUNDATION FOR WHAT COMES NEXT

product, engineering, cloud, security and AI, while

AI is already operating on employee endpoints. As

helping expand Jamf’s security capabilities and

with mobile devices and cloud computing before

supporting customers through major changes in the

it, organisations need to treat it as technology to

Apple ecosystem.

be actively managed, not simply addressed in a policy document.

As one of the relatively few women leading a global enterprise security and management platform, I am

Endpoint visibility, operating-system-level

conscious of the responsibility to create opportunities

management and identity controls provide a practical

for others.

foundation. The aim is not to slow adoption. It is to give organisations a clearer understanding of what

The mentors who supported me throughout my

they are enabling and the means to manage the risks.

career showed me that leadership is not only about the decisions you make. It is also about how you treat

The people building that foundation matter just as

people and who you help move forward.

much. AI security requires technical expertise, but it also calls for judgement and a willingness to listen to

Today, developing the next generation of technical

perspectives beyond our own. Making room for more

leaders is an important part of my work, especially

women to shape those decisions is part of building a

supporting women who will help design tomorrow’s

stronger response.

security architectures. That commitment extends to my board service with the Jamf Nation Global Foundation and the University of Minnesota’s IDSc

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/bethtschida

N O V E M B E R • D E C E M B E R 2026

EXCLUSIVE

ADVERTISING PACKAGE For the past four years, Source2Create has proudly delivered Women in Security Magazine to the industry free of charge, championing diversity, inclusion, and the incredible contributions of women in cybersecurity. As we continue to grow, we now need partners to help us sustain and expand this vital platform. By supporting this package, you’re not just backing us—you’re investing in the magazine, its community, and the future of women in security. To ensure we can keep delivering this high-value publication, we’re introducing a nominal fee for $900 Ex GST, an exceptional package that provides extensive coverage and visibility.

WHAT'S INCLUDED? OFFICIAL PARTNER RECOGNITION Your logo will be prominently displayed at the beginning of the magazine in our “Partner of the Issue” panel.

GLOBAL AUDIENCE REACH Your brand will be seen by 5,000+ global subscribers through our free, bi-monthly digital publication, dedicated to supporting and showcasing women in security.

2 FULL-PAGE ADVERTS Feature your brand in two issues of your choice between March and December.

2 JOB POSTINGS Advertise up to two job opportunities in the magazine and across our social media platforms, reaching a highly engaged cybersecurity audience.

ONLINE BANNER ROTATION on WomenInSecurityMagazine.com

This high-value package ensures maximum visibility for your brand while directly supporting the continuation of Women in Security Magazine.

Join us in making an impact—partner with us today!

EMAIL JANE@SOURCE2CREATE.COM.AU

AMBER RAMSEY

HOW TO BECOME A BRIDGE BUILDER IN THE SECURITY INDUSTRY by Amber Ramsey

The security industry in Australia is broad, and getting

WHY THIS ROLE MATTERS NOW

broader. Traditional IT security, cyber, protective

Security threats don’t respect organisational charts.

services, risk, physical security, now AI layered over

Ransomware doesn’t care whether cyber and physical

the top of all of it. Each area has its own language,

teams report into different divisions. Insider risk

priorities, and pressures.

doesn’t stop at the edge of an IT system. AI projects don’t wait for governance to catch up.

Somewhere in between, there’s a quieter role that keeps things from drifting too far apart.

And yet, inside many organisations, those boundaries still exist.

The bridge builders. Cyber sits over here. Physical security somewhere They are the people who connect disciplines that

else. Risk and compliance in another lane entirely.

don’t always naturally align. The ones who can sit

Decisions get made in parallel, sometimes in conflict,

with engineers, executives, regulators, and frontline

occasionally too late.

teams and make the conversation actually land. They mentor. They translate. They notice where things

That’s where bridge builders make a difference.

might fall through the cracks before they do.

They work across those edges. They ask slightly inconvenient questions. They connect context that

They don’t always have the most visible titles.

would otherwise stay siloed.

But they’re often the reason complex programs hold together.

W O M E N I N S E C U R I T Y M A G A Z I N E

Not to simplify the work, but to make it coherent.

N O V E M B E R • D E C E M B E R 2026

I N D U S T R Y

P E R S P E C T I V E S

You see it in small moments. A security team brought

where you’re not the obvious stakeholder, just to

into a cloud migration early, not after deployment. A

understand how decisions are being made. Building a

coordinated response to an insider issue instead of

relationship with one adjacent team and sticking with

three separate ones. A clearer story going up to the

it long enough that trust forms.

board when something goes wrong. Then asking better questions. It’s less about control, more about alignment. How does this decision land outside our team?

WHAT IT ACTUALLY LOOKS LIKE

Who else carries part of this risk?

Bridge building isn’t a job title. It’s a way of working.

What are we not seeing because of where we sit?

At its core, it comes down to a few things

Mentoring plays a role too. Not in a formal,

done consistently.

programmatic sense necessarily, but in sharing what you know without holding it too tightly. Helping

You start to see systems, not just functions. How

someone else navigate the industry a little faster than

identity links to physical access. How a policy

you did.

decision plays out operationally. Where one control quietly depends on another.

None of this is dramatic. That’s the point.

You get comfortable translating. Taking something

Over time, people start to notice. You become the

deeply technical and making it meaningful for a non-

person pulled into conversations where alignment is

technical audience, without diluting it. Then doing

missing, or where something feels slightly off but no

the reverse.

one has named it yet.

You build enough credibility across different domains

LEADERSHIP VERSUS BRIDGE BUILDING

that people will actually listen when you join the

There’s overlap, but they’re not the same thing.

conversation. Not because you know everything, but

A security leader might be responsible for a function.

because you’ve taken the time to understand how

A bridge builder connects functions. Some people do

their world works.

both. Many don’t.

And there’s a level of curiosity that sits underneath it. A willingness to step just outside your lane, even when it’s not strictly required. The best bridge builders aren’t trying to be the deepest expert in every room. They’re the ones connecting the experts so the whole picture makes sense.

STEPPING INTO THE ROLE You don’t need to wait for a leadership title to do this. In fact, most people don’t. It often starts in small, almost incidental ways. Saying yes to a cross-functional project, even if it feels slightly outside your remit. Sitting in on a meeting

I S S U E 32

WOMEN IN SECURITY MAGAZINE

And that’s fine. The industry needs both.

LOOKING OUTWARD No one builds these connections in isolation. Industry

Depth still matters. You need enough of it to be taken

bodies, events, and professional communities all play

seriously. But it’s the breadth, and what you do with it,

a role in widening perspective.

that creates movement between teams. Engaging beyond your immediate discipline changes Early-career professionals sometimes assume this

how you see problems. It also changes who you can

comes later. It doesn’t have to. Asking thoughtful

call when something unfamiliar lands on your desk.

questions across domains and being generous with knowledge is often more noticeable than technical

In a field that’s shifting as quickly as security is, that

depth alone.

external context becomes part of the job.

THE KIND OF IMPACT THAT STAYS WITH YOU

WHERE THIS IS HEADING

Recognition in this space doesn’t always look like

The complexity isn’t going away. If anything,

a headline. It might be a program that runs more

it’s accelerating. Which makes the connectors more

smoothly because the right people were brought in

important, not less.

early. A crisis that feels more controlled because the messaging is aligned. A colleague who progresses

The people who can move between cyber and

faster because someone took the time to guide them.

physical, between strategy and execution, between experience and emerging talent. The ones who make

Sometimes it is more visible. Awards, milestones,

sure decisions don’t happen in a vacuum.

moments that mark the work. Those matter too. Not for display, but as a reminder that connecting people

They’re not always the loudest voices in the room.

and ideas has tangible outcomes. But when things start to fracture, they’re usually the And then there’s the network that forms around you.

ones holding the line.

Cross-functional, often informal, built over time. learnitforlife.info

That’s where a lot of real progress happens.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

KAREN STEPHENS Karen Stephens is the co-founder and CEO of BCyber. After more than 25 years in financial services, Karen moved into SME cybersecurity risk management. She works with SMEs to protect and grow their businesses by demystifying the technical aspects of cybersecurity and helping them to identify and address cybersecurity and governance risk gaps. She was named inaugural Female Cyber Leader of the Year at the 2023 at the CyberSecurity Connect Awards in Canberra and has been a finalist in 2024 and 2025 in the Australian Cyber Awards for Cyber Security Professional of the Year - Professional and Financial Services.

C O L U M N

Choose Your Own Cyber Adventure: Charting a Non-Traditional Career In the corporate cyber world, career paths can

client’s nodding reflects genuine understanding, rather

seem fairly prescribed: compliance analyst, risk

than a polite hope that the next slide might make

manager, enterprise risk director. Safe. Predictable.

things clearer.

Heavily audited. Take the acronym “ATO”. In cybersecurity, it But what if you approached your career more like a

commonly means account takeover. In financial

Choose Your Own Adventure book?

services, it often means the Australian Taxation Office. Both can cause significant concern for a

The traditional entry point into cybersecurity is

business, but for entirely different reasons.

changing. People with backgrounds in corporate compliance, practice management and governance,

This is why cyber risk professionals need to

risk and compliance (GRC) are moving into cyber risk

know their client’s language as well as they know

roles and bringing something the industry needs: a

cybersecurity terminology. The work is not simply

clear understanding that cyber resilience is not solely

about identifying a risk. It is about explaining what

a technical issue. It is a business risk.

that risk means in the context of the organisation: its people, regulatory obligations, customers, operating

For those of us who have come from these non-

model and reputation.

traditional pathways, the opportunity is to bring a strategic risk lens to cyber. We can help clients

And when in doubt, spell it out.

understand, quantify, communicate and manage cyber risk in a way that makes sense for their

A whole-of-business perspective matters too.

business, not just their IT team.

Technology changes do not just affect technology.

I have said it many times: cyber risk is not an IT

I recently saw an ISO-certified organisation run a

problem. It is a strategic business risk that needs to

project led almost entirely by technical specialists.

be quantified and managed accordingly.

Their recommendations were sound and their technical insight was excellent, but the downstream

THE VALUE OF BEING A TRANSLATOR

implications for the organisation’s ISO certification

To manage cyber risk well, you need to be a translator.

requirements had not been considered. It was not an intentional omission. It was the result of a siloed view

Technical language does not always travel neatly

of the project.

across industries, and it is our job to make sure a

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

This is where professionals with compliance,

that rely on a static model; they are the ones that

governance and practice management experience

can adapt while keeping the business grounded in

can make a real difference. We are trained to see the

sound governance.

connections: the policy implications, the operational impact, the audit trail, the people who will need to

For women entering cyber risk through non-traditional

make it work after the project team has left.

pathways, this is not a disadvantage to explain away. It is an edge.

ADAPTABILITY IS THE ADVANTAGE Coming from practice management, corporate

Many of us have already learned how to translate

compliance or GRC, adaptability is not just a trait. It is

complex requirements, bring stakeholders into

often our greatest professional advantage.

alignment, streamline difficult processes and keep organisations moving when the work gets messy.

Our move into cyber risk is rarely linear, and the work

Those skills are directly relevant to cyber risk. They

itself is rarely predictable. One day, you may be using

help turn technical security concerns into decisions

governance experience to help a board understand a

that boards and executive teams can act on.

cyber risk quantification framework. Next, you may be applying practice management skills to redesign an

Practice management and compliance experience

enterprise risk model, respond to a regulatory change,

build structured communication, operational

explore a new market, or help recruit specialist

governance and stakeholder awareness. They

risk talent.

are precisely the skills needed to make cyber risk meaningful at board level.

That ability to pivot without losing momentum matters.

YOU DO NOT NEED TO DO IT ALONE A move into cyber risk management can feel

Regulation changes. Economic conditions shift.

daunting, particularly when you are stepping away

Threat actors change tactics. Businesses restructure,

from a familiar professional identity. You do not need

acquire, outsource and adopt new technology at

to navigate it alone.

pace. Cyber risk practices that endure are not those

I S S U E 32

WOMEN IN SECURITY MAGAZINE

Build a peer network. Find mentors who can be

You might launch an independent cyber risk

honest about the difficult parts. Participate in

consultancy. You might move into executive risk

professional communities, whether through AWSN,

advisory. You may shape security leadership within a

ISACA, RegTech, Insurtech or the many other

business that needs someone who can connect the

networks bringing together people working across

technical, operational and commercial dots.

risk, governance and technology.

There is no single route into cyber risk management, There will be rocky moments. There will be acronyms

and that is part of what makes the field so compelling.

you have never heard before, rooms where you may initially feel like an outsider, and occasions where

Own the experience you bring. Keep learning the

you need to remind yourself that your experience

language. Ask the questions others are not asking.

is relevant.

Then choose your own adventure. It is. www.linkedin.com/in/karen-stephens-bcyber

When you step from a traditional compliance, governance or practice management role into cyber

www.bcyber.com.au

x.com/bcyber2

karen@bcyber.com.au

youtube.bcyber.com.au/2mux

risk, you are not only creating a new path for yourself. You are making that path more visible for the next woman considering the same move.

CHOOSE YOUR PATH Your background in compliance, GRC or practice management is not a hurdle to overcome before you can work in cybersecurity. It is valuable preparation for the work ahead.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

CAREER PERSPECTIVES

SIMON CARABETTA

THE TIMES SHE CRIED, TOO FRAIL TO WAKE THIS TIME By Simon Carabetta, Cyber Security Workforce Skills and Education | Podcaster | DEI advocate

Those haunting words are sung by New Order’s

They continued together, but not as the same band

Bernard Sumner, with lyrics written by the late

trying to recapture what had been lost. They became

Ian Curtis.

the New Order.

For anyone needing a quick music-history refresher,

Formed in 1980, with keyboardist Gillian Gilbert

Sumner and Curtis are the voices associated with

joining later that year, New Order developed a sound

New Order and Joy Division, respectively. The

that moved beyond Joy Division’s post-punk roots

connection between the bands? Well, that’s where this

towards electronic music and synth-pop. What

story begins.

followed was a career that would outlast their original band’s brief existence and help shape generations

What does any of this have to do with this issue’s

of music.

theme, “Unleashed”? I’m glad you asked. There’s a connection to “Claiming Space” and “Opportunity”,

Yet the New Order track I’ve always found most

too. And it wouldn’t be a Women in Security Magazine

haunting is “Ceremony”, a song that connects the

article written by yours truly if I didn’t take you the

two bands:

long way home. Oh, I’ll break them down, no mercy shown,

OUT OF THE ASHES

Heaven knows, it’s got to be this time,

If, like me, you take The Wombats’ advice and dance

Watching her, these things she said,

to Joy Division, you’ll know that the death of frontman

The times she cried,

Ian Curtis did not mark the end of his bandmates’

Too frail to wake this time.

musical story.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

C A R E E R

P E R S P E C T I V E S

To me, those words evoke the feeling of being

To my mind, Australia’s security industry is at a

overwhelmed. Of watching something unfold and

point where we need to decide what comes next.

feeling too fragile to change its course.

Do we allow the scale of the challenge to leave us permanently on the defensive? Or do we use that

And this, dear reader, is where we arrive at the point.

discomfort to question what needs to change?

A KNIFE-EDGE MOMENT FOR AUSTRALIAN SECURITY

That doesn’t mean dismissing the work of the

When we hear about another cyberattack or the

and communities. It means asking whether we are

exposure of sensitive information, it can be difficult

giving them the authority, resources and support to

not to feel vulnerable. There’s the immediate concern

make a lasting difference.

professionals already defending our organisations

about whose information has been compromised. Then comes the uncomfortable question: could it

It also means being willing to make room for people

happen to me?

whose expertise has too often been overlooked.

We want to trust that the systems holding our

CLAIMING THE SPACE

medical records and personal information are secure.

The transition from Joy Division to New Order was

We want the people responsible for protecting them

not a simple change of name. Nor should a personal

to have what they need to do the job.

tragedy be reduced to a lesson in reinvention.

When that confidence is shaken, frustration

What stays with me, though, is that the musicians

is understandable. So is the feeling of

found a way forward without simply repeating what

being overwhelmed. But neither is a strategy.

had come before.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

That is the part of the story I keep returning to when I

That means investing before an incident forces the

think about Australian security.

issue. It means taking difficult advice seriously, even when acting on it is inconvenient.

We don’t have to accept that our only option is to respond to the next incident, then wait for another. We

No credible vision of our future can promise that

can ask more of our leadership and make better use

attacks will stop. But we should expect a security

of the capability already here.

sector equipped to anticipate threats and respond effectively, with leaders willing to take responsibility

For women in security, claiming space must mean

for the decisions that shape its work.

more than being invited into the room. It must include the authority to influence decisions: which risks

Perhaps that is what “Unleashed” should mean for us:

receive attention, where investment goes and how

giving capable people the room—and the authority to

teams are led.

do what we keep saying we need them to do.

And for those already holding that authority, there is

The music changed when those musicians stopped

a responsibility to listen. Not only to the most familiar

trying to be the band they had been.

voices or the people who have always had a seat at the table.

Our own new order will take more than a change in language. It will take decisions we are prepared to

Opportunity means little if nobody is willing to share

follow through on.

decision-making power.

A NEW ORDER

www.linkedin.com/in/simoncarabetta

Australia needs security leadership that understands the stakes and is prepared to act beyond the immediate news cycle. At a federal level, I want to see decisions grounded in expertise and a genuine commitment to protecting Australians, rather than the appeal of a political announcement. Across industry, I want us to back our people with more than statements about how important security has become.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

BETTINA VAHL

FROM RESELLING TO SECURING: THE CHANNEL’S EVOLVING ROLE IN CYBERSECURITY by Bettina Vahl, Vice President of Global Channels at Yubico

For years, cybersecurity has largely been framed

As attackers focus on stealing credentials and

as the customer’s responsibility. Vendors built the

manipulating users into approving fraudulent

technology, channel partners sold and implemented it,

authentication requests, the decisions made around

and accountability for managing risk ultimately rested

authentication deserve greater scrutiny from

with the CISO, CIO or internal IT team.

customers and their technology partners alike.

That division was never entirely clear-cut. Now, the

FAMILIAR DOES NOT NECESSARILY MEAN SECURE

boundaries are becoming even less distinct.

One challenge for the technology industry is that Across global markets, channel partners including

familiar authentication methods are often the easiest

managed security service providers (MSSPs),

to keep deploying. Passwords, SMS codes, one-time

resellers and technology advisers help determine

passwords and push notifications are well understood

which security technologies organisations adopt.

and widely supported. But ease of deployment should

They recommend platforms, design architectures and

not be confused with adequate protection.

configure systems. Increasingly, they also manage those environments on their customers’ behalf.

Many conventional forms of multi-factor authentication (MFA) remain vulnerable to phishing,

That gives the channel considerable influence over an

social engineering and adversary-in-the-middle

organisation’s security posture, particularly when it

attacks. Cybercriminals have become increasingly

comes to identity and authentication.

skilled at creating convincing login experiences

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

C A R E E R

P E R S P E C T I V E S

Phishing-resistant authentication including security keys such as the YubiKey and modern passkey approaches based on open standards such as FIDO allows partners to deepen their role as trusted security advisers. Customers increasingly expect help reducing complexity and managing risk, alongside guidance on compliance requirements and technology decisions that will stand up as threats evolve. Authentication modernisation fits naturally into that relationship. For partners, the value extends beyond product delivery. Assessment, migration planning and deployment support all create opportunities to help customers throughout the life of their investment.

SECURITY WITHOUT UNNECESSARY COMPLEXITY that capture credentials or manipulate users into

Better security cannot come at the expense of

approving access.

usability. Organisations may hesitate to modernise authentication because they worry it will create

Channel partners need to ask a direct question:

friction for employees, overwhelm help desks or

are we recommending an MFA method because

complicate existing systems.

it provides the strongest practical protection for the customer, or because it is what we have

This is where channel expertise can make

always deployed?

a difference.

The distinction matters. Customers often rely on their

Authentication transformation does not have to

technology partners to understand how threats are

happen across an entire organisation overnight.

changing. Many smaller and mid-sized organisations

Partners can help customers identify priority

do not have large security teams. Their MSSP or

groups, such as administrators, executives, finance

reseller may be their most trusted security adviser.

teams, developers and employees with access to sensitive systems.

PHISHING RESISTANCE AS A CHANNEL DIFFERENTIATOR

From there, they can develop a phased approach

This shift also presents a commercial opportunity. As

that accounts for existing identity infrastructure, the

identity attacks become more prominent, customers

applications and devices in use, and the needs of

are asking harder questions about authentication. Can

different users.

their MFA be phished? Can credentials be stolen and replayed? How should they protect privileged users?

Modern authentication can reduce reliance on remembering passwords, entering codes manually

Partners that can answer these questions have an

or responding to repeated push notifications. When

opportunity to distinguish themselves through their

implemented well, stronger security and a better user

advice, not just their product knowledge.

experience should reinforce each other.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

But successful adoption takes more than technology. It requires thoughtful deployment planning and user education, followed by ongoing lifecycle management. Recovery processes also need attention, including what happens when a security key is lost or needs replacing. Channel partners are often closest to the customer’s day-to-day operations. They understand where users encounter friction and which approaches are likely to work in practice. That knowledge is essential to making stronger authentication sticks.

VENDORS MUST EQUIP PARTNERS TO LEAD The relationship between vendors and partners is evolving from traditional product distribution towards closer collaboration on customer outcomes. into better security outcomes, without adding At Yubico, we work with MSSPs, resellers, systems

unnecessary complexity.

integrators, distributors and technology partners to customer deployments. That includes providing

A LEADERSHIP OPPORTUNITY FOR WOMEN IN SECURITY

technical resources and commercial frameworks to

Women across the channel and the wider

help them incorporate authentication modernisation

cybersecurity sector have an opportunity to shape

into their broader security offerings.

how the next generation of security services is

build on their existing security expertise and support

delivered. This work calls for leaders who can connect Partner education and enablement are critical. When

technical risk with customer needs and guide the

customers are deciding how and when to move away

organisational change that follows.

from legacy authentication, they usually turn first to a technology adviser they already trust.

For women in channel and security leadership roles, that means influencing more than the choice of

The channel is central to how organisations evaluate,

technology. It means helping customers understand

deploy and operate security. Its next opportunity is

why change matters, making deployment practical

to use that influence to accelerate the move towards

and ensuring the people using these systems are

phishing-resistant authentication.

considered from the outset.

Vendors have a responsibility to make this easier. We

Partners already help shape their customers’

need to equip partners to identify where customers

security decisions. As identity attacks become

are most exposed and explain the business case for

more sophisticated, that influence brings greater

change. Just as importantly, we need to help them

responsibility and an opportunity to lead a

design practical migration paths that work across

more practical, customer-focused approach to

different users, applications and environments.

authentication modernisation.

The aim is not simply to introduce stronger technology. It is to help partners turn that technology

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/bettina-vahl-9b1b4088

N O V E M B E R • D E C E M B E R 2026

MAY • JUNE

IN 2022, YOU CAN NO LONG ER TAKE SECU RITY WORK ERS FOR GRAN TED P10-13

20 22 W W W. W O

AS THE SECU RITY THREAT MORP DEFE NSIV E HS, TEAM S MUST CHAN GE TOO P76-79 IF YOU CAN’T YOUR WAY TO SPEND SECURITY THISGOOD TRY FOCU SINGYEAR, ON YOUR PEOP LE P94-97

YEAR OF THE SECURITY WORKER

MENINSE

WHO RUNS

CURITYM

AGAZINE.

COM

WORLD the

W W W. W O

MENINSE

CURITYM

AGAZINE.

COM

TO O U R M A

GAZINE

MARCH • APRIL

Never miss an edition again! Subscribe to the magazine today for exclusive updates on upcoming events and future issues, along with bonus content. SUBSCRIBE NOW

MARINA AZAR TOAILOA

MUMMY SAFETY FORGES NEW ALLIANCES TO STRENGTHEN CHILD SAFETY ACROSS EARLY LEARNING COMMUNITIES by Marina Azar Toailoa, Founder of the Mummy Safety Security Project

Mummy Safety is building a stronger, more connected approach to child safety by partnering with early learning services, educators, families and community leaders to drive inclusion, influence policy and support practical innovation. In early learning environments, child safety is a shared responsibility. It depends not only on written policies, but also on trusted relationships, confident professionals and communities that are prepared to speak up and act. That is why Mummy Safety is forging new alliances across the early learning and child wellbeing sectors; bringing people together to share knowledge, challenge outdated assumptions and create safer environments for every child through specialised security and risk education.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

C A R E E R

P E R S P E C T I V E S

BUILDING ALLIANCES THAT MAKE A DIFFERENCE Mummy Safety works with early learning providers, primary and high schools, educators, families, community organisations and other child-focused stakeholders to strengthen safety from the ground up. These partnerships create opportunities to identify emerging risks, exchange practical ideas and develop responses that reflect the realities of children, families and the people who care for them. The focus is not simply on meeting a minimum requirement. Mummy Safety and its partners continuously work towards best practice by asking important questions: • Are children being heard and taken seriously? • Do families feel welcome, informed and confident to raise concerns? • Are staff equipped to recognise, respond to and report safety issues? • Do policies work in practice, on the ground and every day? • Are the needs of children from diverse backgrounds reflected in safety planning?

These conversations help ensure that child safety becomes part of everyday practice rather than being a once-a-year exercise. They also give educators and families a stronger voice in identifying what is

By working collaboratively, early learning communities

working, what needs to change and where additional

can move from isolated efforts to a coordinated

support is required.

culture of child safety and security. The message is clear: “See something, say

CREATING INFLUENTIAL COMMUNITIES

something.” Speaking up early can help prevent harm,

Strong child safety outcomes are supported by

support timely action and reinforce a culture in which

influential communities—communities where people

concerns are never dismissed.

share responsibility, communicate openly and understand that silence can allow risks to continue.

Every child deserves to feel safe, respected and included. Mummy Safety challenges approaches that

Mummy Safety helps create these communities by

unintentionally leave children or families out of safety

encouraging early learning services and families to

conversations, services or decision-making.

participate in conversations about safety, security, inclusion and wellbeing. These conversations

An inclusive approach recognises that children

may include professional discussions, community

and families have different experiences, abilities,

education, consultation with families, resource

cultures, languages, identities and support needs. It

sharing and practical training. Mummy Safety also

encourages early learning communities to consider

provides the opportunity for children to be active

accessibility, respectful communication and

participants in their own safety.

culturally responsive practice when developing safety procedures and education programs.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

Inclusion also means listening to children in ways

induction processes, more accessible resources,

that are appropriate to their age and development.

the use of real cases to enhance understanding and

Children may communicate concerns through words,

improved family engagement, or new ways to involve

behaviour, drawings, play or changes in routine. Adults

children in conversations about safety. Mummy

have a responsibility to create environments where

Safety opens the world of specialised security

children can express themselves and where their

knowledge to the community.

concerns are responded to with care. Inclusivity also enables Mummy Safety to teach risk knowledge to the

The best innovations are those that make safety

wider community to prevent harm before it happens.

more understandable, more consistent and more achievable in everyday practice. They help people

INFLUENCING POLICY THROUGH PRACTICAL EXPERIENCE

identify risks earlier and make it easier for everyone to know how to respond.

Policies are important, but they are only effective when people understand them, believe in them

A SHARED COMMITMENT TO SAFER FUTURES

and actively apply them. Mummy Safety brings

The alliances Mummy Safety is building are part of a

the experience of early learning communities into

broader commitment to strengthen the child safety

conversations about child safety policy, helping

ecosystem. Early learning services cannot do this

ensure that expectations are practical, relevant and

work alone, and families should not be expected to

focused on real-world outcomes.

navigate safety concerns without support. Progress comes when educators, leaders, families, children

This means looking beyond documents and asking

and community partners work together with a

how procedures operate during busy mornings,

common purpose.

excursions, transitions, staff changes and moments when a child may need additional support. It also

By forging new alliances, building influential

means ensuring that responsibilities are clear and

communities and challenging the status quo,

that staff know what to do when a concern arises.

Mummy Safety is helping make child safety and security a visible, shared and active priority across

Safety and security policies cannot protect children

early learning. Mummy safety is allowing the world

through paperwork alone. Without active enforcement

to access specialised knowledge once held within

and a strong on-the-ground safety culture among

a profession.

personnel, even well-written procedures can fail. Mummy Safety therefore emphasises leadership,

Then, the conversations we have, the policies

accountability, regular communication and proactive

we enforce, the concerns we act on and the

risk management, to give people the confidence to act

communities we build together all come together to

when something does not feel right.

protect children.

SUPPORTING INNOVATION IN CHILD SAFETY

www.instagram.com/mummysafetysecurityproject

Innovation in child safety is not limited to new technology. It also includes new ways of listening,

www.linkedin.com/in/marina-azar-toailoa-66259511a

communicating, training and working together. www.mummysafety.com.au

Mummy Safety supports innovation by encouraging early learning services and primary schools to explore practical tools and approaches that improve awareness, information sharing and response. These may include clearer reporting pathways, stronger

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

FATEMAH BEYDOUN

MEHIKA MANOCHA

BEYOND THE CODE: SHE SHARP, XERO AND SECURE CODE WARRIOR EQUIP WOMEN TO SECURE SOFTWARE IN THE AGE OF AI by Fatemah Beydoun, Founding team member of Secure Code Warrior Mehika Manocha, Lead Engineer at Xero Prasanth Pavithran, Technology and Management Professional Jeanette Gill, Head of Customer Success for Asia-Pacific at Secure Code Warrior Ben Amadi, Cybersecurity

As AI changes how software is built, She Sharp, Xero and Secure Code Warrior are helping women develop the skills to keep it secure. She Sharp and Xero have been bringing women in technology together for the past two years. On 8 October 2026, they teamed up with Secure Code Warrior once again, welcoming 50 attendees to Xero’s Parnell office in Auckland for an evening dedicated to cybersecurity.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

C A R E E R

PRASANTH PAVITHRAN

P E R S P E C T I V E S

JEANETTE GILL

BEN AMADI

Beyond the Code: Women Leading the Future of

Panellists shared their pathways into the industry and

Cybersecurity and AI combined hands-on secure

offered advice for women entering tech, alongside

coding with candid conversation under the banner

their perspectives on how AI is changing software

“Leading the way to a secure Aotearoa”.

development and security.

At its centre was a question reshaping the industry:

For Fatemah Beydoun, co-founder and chief

what happens to security when AI is writing more of

customer officer at Secure Code Warrior, a highlight

the code?

was the advice to make experimentation part of everyday work.

Jeanette Gill, head of customer success APAC at Secure Code Warrior, captured the challenge in a

“It’s really important that people are spending

LinkedIn post ahead of the event.

time every single day experimenting with AI tools, understanding the power, the capability, and that’s

“Code is now written by developers, AI assistants

really going to help them grow in their careers and

and autonomous agents, and increasingly within the

apply it in their jobs,” she said.

same commit. The standard doesn’t change with the author,” she wrote. “Every line that reaches production

Mehika Manocha, lead software engineer at Xero,

needs to be secure, clean and high quality, and

encouraged attendees to approach the technology

someone needs the skills to recognise when it isn’t.

with curiosity rather than fear.

Find the flaw, understand it, fix it.” “If I can give one recommendation to anyone It was a challenge attendees would soon put

watching, it would be: be curious, embrace AI, do not

into practice.

be scared of it,” she said. “Make sure you know the guardrails and risk around it, but embrace it. It’s a very

BUILDING CONFIDENCE AND CAPABILITY

powerful tool.”

The evening opened with a karakia and a welcome from She Sharp, a non-profit organisation working to

Prasanth Pavithran, senior business analyst in

close the gender gap in STEM. By connecting women

the Office of the CTO at Auckland University of

with role models, mentors and opportunities, She

Technology, brought the discussion back to the

Sharp helps participants build technical skills and the

human skills that remain essential.

confidence to pursue careers and leadership roles in technology.

“On AI, don’t try to out-machine the machine. Sharpen what makes you human: judgement, curiosity,

That purpose carried through to a panel discussion,

empathy, connection. Then let AI amplify it.”

The Critical Role of Cybersecurity in AI, moderated by Ben Amadi, senior cybersecurity education analyst

PUTTING SECURE CODING TO THE TEST

at Xero.

Next came the opportunity to turn those ideas into

I S S U E 32

WOMEN IN SECURITY MAGAZINE

The winners deserved their moment, but the evening also recognised everyone willing to step outside their comfort zone, whether they were experienced developers or exploring secure-coding concepts for the first time.

A COMMUNITY LEARNING TOGETHER Food and drinks followed, with time for attendees to meet one another and speak with the Xero and Secure Code Warrior teams. Xero’s support as host helped create a welcoming space for learning and connection. Behind the scenes, the planning team brought together everything from speaker coordination to the tournament itself. The partnership gave women an opportunity not just to hear about changes in cybersecurity, but to try the tools, ask questions and learn alongside others. As AI changes how software is built, the responsibility action. Secure Code Warrior’s learning platform

to recognise insecure code remains. This evening

uses interactive challenges and real-world coding

gave attendees space to practise doing exactly that—

scenarios to help developers make security part of

and a community to keep learning with.

their everyday practice, rather than a final checklist. Follow She Sharp, Xero and Secure Code Warrior Following an onboarding session and live

on social media for future events and learning

demonstration led by Gill, attendees entered a

opportunities. Presentation slides from the evening

45-minute secure-coding tournament. Racing against

are available on the She Sharp website.

the clock and a live leaderboard, they worked through vulnerable code, identifying flaws, understanding what had gone wrong and fixing the problems. Challenges covered Java and Spring, Python, JavaScript and Ruby. A pseudocode track gave noncoders a way to test their understanding of security concepts without needing experience in a particular programming language. As names climbed and fell on the leaderboard, the room buzzed. The competition finished with three participants named this year’s Secure Code Warriors: • First place: Sreelakshmi Chandran • Second place: Sophia Dadardoust • Third place: Rashmi Lokamurthy

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

C A R E E R

P E R S P E C T I V E S

FATEMAH BEYDOUN Fatemah Beydoun is a founding team member of Secure Code Warrior, having been an integral part of the company since 2014. As Chief Customer Officer, Fatemah is responsible for turning Secure Code Warrior’s customers into its biggest advocates, improving Customer Success maturity, and leading the Customer Success teams globally. www.linkedin.com/in/fatemah-beydoun-b6555bb1

MEHIKA MANOCHA Mehika is a Lead Engineer at Xero, where she blends technical leadership with a commitment to building a more inclusive and equitable tech landscape. As co-chair of Xero’s Tech Diversity ERG, she champions fostering a culture of belonging. She is also an active member of Xero’s Security Champions community, promoting stronger security practices. things right was critical to safe, on-time operations. www.linkedin.com/in/mehikamanocha

That discipline of precision, accountability and getting it right the first time has shaped her career, and it is the same principle behind building secure software.

PRASANTH PAVITHRAN Prasanth Pavithran is a technology and management professional with over 25 years of global experience

www.linkedin.com/in/%F0%9F%91%A9%F0%9F%8F%BB%E2% 80%8D%F0%9F%92%BBjeanette-gill-53363458

spanning business transformation, leadership, capability development and digital change. He

BEN AMADI

currently works as a Senior Business Analyst in the

Ben Amadi works in cybersecurity, but his focus has

Office of the Chief Technology Officer at Auckland

always been people. His career centres on helping

University of Technology (AUT), where his interests

organisations take security seriously without turning

include business architecture, emerging technology,

it into fear, noise, or tickbox compliance. He brings

AI and how organisations can use technology to

a practical, experience‑led approach to information

create meaningful outcomes for people.

security, one that recognises that systems fail when people are excluded, confused, or unheard.

www.linkedin.com/in/prasanth-pavithran-mba-a54ab912 www.linkedin.com/in/benamadi

JEANETTE GILL Jeanette Gill is Head of Customer Success for Asia-Pacific at Secure Code Warrior, the AI software governance platform that helps enterprises adopt AI securely and govern every line of AI-generated code at scale. She started her career in aviation, managing aircraft departure control systems, where getting

I S S U E 32

www.linkedin.com/company/shesharpnz

www.linkedin.com/company/secure-code-warrior

nz.linkedin.com/company/xero

WOMEN IN SECURITY MAGAZINE

MADHURI NANDI Global Cyber Security Leader of the Year (2025, 2026) | Head of Security, Nuvei | Chair, AWSN National Board | Author, Cyber Smart Madhuri Nandi is a cybersecurity leader with nearly two decades of experience spanning strategy, governance, risk, compliance, product, and engineering. Recognised as the Global Cyber Security Leader of the Year (2025 and 2026), she is known for building security programmes that balance business outcomes with human-centred leadership.

Unleashed: When Security Steps Beyond Its Boundaries

I have followed a lot of security playbooks in

BEYOND THE TICKET

my career.

In 2007, working as a security operations centre (SOC) analyst, I was expected to raise client tickets

In the early years, I thought that was what good

when an event met certain criteria, within the agreed

security looked like. If an event met the criteria,

service-level timeframes. So I did exactly that.

we raised a ticket. If a vulnerability was critical, we reported it. If a control was required, we

Month after month, I logged tickets according to

implemented it.

the playbook. Through conversations with clients, however, I gradually began to understand what

It was clear and measurable. It was how we were

mattered to them.

taught to work. Not every alert meant the same thing to the person Over time, though, I began to realise that security

receiving it. The technical criteria might be identical,

could follow every step of a process and still miss

but the impact could differ significantly depending on

something important: understanding.

the client’s environment and what their business was trying to achieve.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

She holds a Master’s degree in Cybersecurity Digital Forensics and currently serves as Head of Security at Nuvei and Chair of the AWSN National Board. Madhuri is the author of Cyber Smart and creator of a cybersecurity awareness framework focused on making security more accessible and practical for everyday users. She is a strong advocate for inclusive leadership, mentorship, and community building across the cybersecurity industry.

C O L U M N

The playbook told me when to raise the ticket. The

A report can contain every metric and still leave

conversation taught me why it mattered.

someone unsure what to do next. A control can be in place yet make little sense to the person expected to

A couple of years later, I encountered a similar lesson

operate it.

in vulnerability reporting. I was sharing the metrics we commonly used at the time: how many vulnerabilities

This is where I think security becomes unleashed.

were critical, how many were rated high and how

Not necessarily by doing more, but by becoming

many were exploitable.

more connected to what happens outside the security function.

Then someone from the business asked a simple question. “What does that actually mean?

Some of my most valuable security conversations

Which ones should I focus on? Don’t we have

have happened in planning sessions with engineering,

other controls?”

product, cloud and business teams, rather than in security meetings.

That question changed how I looked at vulnerability reporting.

When a developer explains what they plan to change next quarter, or how they expect their platform to

Hundreds of vulnerabilities did not automatically

evolve over the next few years, the conversation

mean hundreds of equally significant risks. Existing

shifts. You are no longer looking at something already

controls, architectural decisions and business

built and asking how to secure it. You can help shape

priorities all influenced the picture.

the approach from the beginning.

We were reporting vulnerabilities. The business was

Which architectural decisions will matter? Where can

trying to understand exposure.

we introduce guardrails without unnecessarily slowing the team down? What will become difficult to change

The number was not the answer. It was the beginning

later if we overlook it now?

of a conversation. That is a different role for security. We move from

FROM PROCESS TO PURPOSE

reviewing what has happened to helping shape what

That lesson has stayed with me.

comes next.

Security can become very good at measuring itself.

Security is at its most valuable when it is present

Our dashboards, frameworks and assessments

before a decision, not only after it.

give us structure and help us operate consistently. We need them.

UNDERSTANDING BEFORE OWNERSHIP I have also learnt that being involved does not

But sometimes we become so focused on whether a

mean security needs to own every decision. Quite

process is working that we forget to ask whether it is

the opposite.

producing the intended outcome.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

WHAT ‘UNLEASHED’ MEANS TO ME Looking back, I do not see those early SOC tickets or vulnerability reports as wasted effort. They were necessary parts of the job. But they taught me something beyond the process itself. Security knowledge becomes more valuable when it is translated into something another person can use. That might inform a business decision or an engineering design. Sometimes it simply helps someone understand why a particular Sometimes our role is to ask an engineer what they

control matters.

are trying to build, then listen properly to the answer. Or to understand why a team is struggling with a

Perhaps that is what I now understand

control, rather than assume it is being ignored.

by “unleashed”.

It means looking behind a dashboard metric and

It is not security without boundaries. It is security that

recognising when a playbook is helping — and when it

is not confined by them.

has become a substitute for judgement. I see it in the SOC analyst who wants to understand There is a human side to this that we can overlook.

the client behind the ticket, and in the practitioner

People do not always resist security because they

who looks beyond the vulnerability count to ask what

do not care about it. They may be trying to deliver a

it means. It is there when a security leader takes an

product or resolve an operational problem, and the

interest in what engineering is building long before it

security process has arrived without enough context.

reaches production.

Understanding that changes the conversation. It gives

It also requires a willingness to enter conversations

us a chance to design security that works with people,

where security does not have all the answers, and to

rather than leaving them to find ways around it.

listen before speaking.

This is also why I believe security leaders need to be

The value of our work is not measured only by how

part of broader organisational conversations. Not

much risk we identify. It also lies in what we help

because security should have the loudest voice, but

people do with that knowledge.

because we need to hear the other voices. After nearly two decades in cybersecurity, Product teams bring their understanding of

I have come to believe that some of our most

customers. Engineers see the possibilities and

important work happens outside security’s

limitations of the technology, while operations

traditional boundaries. It is where we gain a clearer

teams know the reality of keeping it running.

understanding of the business and the people within

Business leaders bring another view of priorities

it — and often where we first see what is coming next.

and consequences. That is where we have the opportunity to help shape Security contributes its own perspective. When those

the future, rather than simply protect the present.

perspectives come together early, the discussion becomes less about saying no and more about helping the organisation make informed decisions.

www.linkedin.com/in/madhurinandi

STUDENT IN SECURITY SPOTLIGHT

current research looks at using federated learning to ZESEYA SHARMIN

Zeseya Sharmin, who is pursuing a PhD in Information Technology, specialising in cybersecurity research, at Deakin University in Australia. PhD in Information Technology student at Deakin University in Australia

detect cyberattacks on edge devices, and it’s work I’m keen to take further. My goal is to secure a full-time academic role that brings those interests together. I want to keep exploring my own research questions while helping students build the confidence to ask theirs.

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations? My research supervisors have had a big influence on the direction I’ve taken. Their guidance helped me

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

find my focus in federated learning for cyberattack

Cybersecurity touches almost every part of modern

Getting my systematic review accepted in the

life. I tell people it protects the hospitals, banks, and

Computer Science Review was a real confidence

transport systems we all rely on every day. I explain

boost. When later papers were accepted in IEEE

that the field is creative and always changing, which

Transactions on Industrial Informatics, I felt more

is what makes it exciting to work in.

certain that research was something I wanted to

detection and gave me the encouragement to keep developing my work.

pursue long term. Those moments meant a lot to me

Reflecting on your initial perceptions of cybersecurity when you first considered studying

not just as publications, but as reassurance that I

At first I thought cybersecurity was mostly about it is much broader, covering things like how machine

Recount the most memorable or significant event in your cybersecurity journey to date, highlighting why it left a lasting impression.

learning models can detect distributed attacks

One of my most memorable moments was seeing

across networks. The work has turned out more

my paper on federated GANs for cyber-attack

research driven and collaborative than I expected

detection accepted in IEEE Transactions on Industrial

when I started.

Informatics. It confirmed that years of research work

firewalls and passwords. My research has shown me

was finding my place in the field.

were heading in the right direction. That acceptance

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice? I’d love to build a long-term career in academia, where I can continue my research and support students as they find their own interests in IT. My

102

W O M E N I N S E C U R I T Y M A G A Z I N E

motivated me to keep building on this line of research

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

N O V E M B E R • D E C E M B E R 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

also taught cybersecurity related courses, including

Conversely, which aspect of your studies do you find least interesting or useful, and how do you navigate through it?

Computer Network and Cyber Security, at Green

I find heavily theoretical, compliance-focused

University of Bangladesh. This mix of research and

content less engaging than hands-on technical

teaching gave me practical exposure to the field

work. I get through it by connecting it back to how

beyond my own studies.

policy actually shapes security practice inside

I worked as a Graduate Research Assistant at the University of Malaya on Internet-of-Things projects. I

organisations. That framing makes the material feel

The cybersecurity industry offers various certifications from different organisations. Have you pursued, or do you plan to pursue any of these certifications? If so, which ones, and what factors influenced your choice?

more relevant to my research.

I completed the Cisco Certified Network

Do you believe there are areas in cybersecurity that deserve more emphasis in your coursework or areas that could receive less focus?

Academy program during my studies. I chose it

I believe more coursework time could go toward

because networking fundamentals support most

applied machine learning for security, since that is

cybersecurity work. I plan to look into further

where much of the current research activity sits.

certifications as my research moves further into

Some of the more traditional networking theories

applied security.

could be trimmed slightly in comparison.

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape? My PhD research keeps me close to current threats,

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management? If yes, why?

since I work on federated learning based detection

Yes, definitely. Teaching and mentoring have shown

methods for edge and IoT devices. That said, I

me that knowing the technical side is only part of

think academic programs can lag behind fast-

the job. Being able to explain something clearly and

moving industry threats. I try to stay current by

work well with people matters too, especially when

following recent journals and conferences alongside

you’re speaking with someone who doesn’t have

my coursework.

a cybersecurity background.

What aspect of your cybersecurity studies excites you the most, and why?

I’d love to see students

I am most excited by federated learning for cyber-

practise those conversations

attack detection. It allows multiple systems to learn

before they graduate. For

from threats together without sharing raw data,

me, communication and

which addresses a real gap in current defences.

people-management skills

Seeing this work published in journals such as IEEE

shouldn’t be an afterthought

Transactions on Industrial Informatics keeps me

they deserve attention alongside

motivated to keep going.

technical learning.

I S S U E 32

get more opportunities to

WOMEN IN SECURITY MAGAZINE

103

ZESEYA SHARMIN

Are you actively engaged in the broader cybersecurity community? If so, what has been your involvement, and how has it enriched your experience?

Reflecting on your journey thus far, would you, with the benefit of hindsight, make any changes to your career trajectory? If yes, what adjustments would you consider?

I stay involved in the research community by

Looking back, I would have started focusing on

publishing my work and presenting at conferences,

federated learning and edge security earlier in

including the Australasian Information Security

my research career. Otherwise, my path from

Conference and IEEE events. I’ve also written several

Bangladesh, to Malaysia, to Australia for my studies

journal papers and contributed a book chapter in

feels like the right one for me.

cybersecurity and networking.

what others are working on, share ideas and have

Have you actively sought employment opportunities in the cybersecurity field, and if so, what has been your experience with the application and interview process?

the conversations that often lead to a new question

I’m currently building my academic career through

or a different way of looking at my own research. It

casual lecturing and research fellow roles at Deakin

helps me feel part of a wider community, rather than

University and Melbourne Institute of Technology. I’m

working away on my research in isolation.

keen to keep developing both sides of my work: the

What I enjoy most is the connection with other researchers. Conferences give me the chance to hear

teaching as well as the research.

What is your preferred source for staying informed about cybersecurity trends and general information?

As I work towards finishing my PhD, I’m looking

I mostly follow peer-reviewed journals such as IEEE

technology. I’ll keep applying for opportunities that

Transactions and Computer Science Review. I also

would let me build on that experience and settle into

use Google Scholar to track new work in federated

a longer-term role.

for a full-time academic position in information

learning and cyber-attack detection. Conferences give me a more informal way to hear about emerging trends.

104

W O M E N I N S E C U R I T Y M A G A Z I N E

www.linkedin.com/in/zeseyasharmin-54413b173

N O V E M B E R • D E C E M B E R 2026

Join Us in Empowering

Future Leaders

! d e t n a W y it r u c e S in Students Are you a student passionate about shaping the future of security? Do you have innovative ideas and insights to share with a global audience? Join us in contributing to the Women in Security Magazine and become a voice for the next generation of security leaders!

Why contribute?

Gain valuable exposure: Reach over 11000 subscribers globally and showcase your expertise to industry professionals.

How to get involved

Make an impact: Share your experiences, challenges, and aspirations to inspire others and shape the future of security.

Let us know you are interested. We will send you a series of questions of which you can choose which ones you would like to answer. Submit those back to us in an email. We will then edit to be a concise and flowing edited Q&A.

Don't miss this opportunity to be part of a vibrant community of students driving change in the security industry. Contact us today to learn more about how you can contribute to the Women in Security Magazine!

Contact: jane@source2create.com.au

researching vulnerabilities and piecing together digital evidence after an incident. I want them to come away curious and able to picture where they KIRAN ILLYASS

Kiran Illyass, currently pursuing a Doctor of Philosophy in Information Technology (Cybersecurity) at Deakin University in Victoria, Australia. Doctor of Philosophy in Information Technology (Cybersecurity) student at Deakin University in Victoria, Australia

might fit.

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare? When I first got into cybersecurity, I thought it was mostly about hacking and protecting systems from attacks. But the more I studied and worked in the field, the more I realised I’d only seen a small part of it. What’s really interesting to me is how much of cybersecurity comes back to people, how they use

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

technology and the decisions they make every day. There’s also a whole side involving risk, governance and research that I hadn’t really considered at the start.

I usually start with something familiar: “Have you ever received a message that didn’t feel quite right,

Discovering that has made the field more interesting

or an email asking you to click a suspicious link?”

to me. I no longer see it as one particular career

It gives us something to talk about without getting

path. There are different ways to contribute, and

caught up in technical language.

I’ve enjoyed getting a better sense of where my own interests fit.

Then I ask, “What if that same message landed in the inbox of someone working at a hospital or a bank?” That’s often when the questions start. How do these attacks work? What could happen? And how do we stop them?

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice? After I graduate, I’d like to work in cybersecurity governance, risk and compliance. What draws

From there, I describe

me to this area is the chance to use my technical

cybersecurity as a

background while getting a better understanding of

puzzle that keeps

how businesses make decisions about risk.

changing. You’re trying to

106

understand how someone

Through my research and industry experience, I’ve

might get in, spot the weak

come to appreciate that putting security controls

points and work out how

in place is only part of the job. You also need to

to protect them. I also like to

understand the risks an organisation faces and

make the point that it’s not

whether those controls are actually doing what

all about hacking. There are

they’re meant to do. That’s the part I’m keen to

people monitoring for threats,

get more involved in—helping people make sense

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

S T U D E N T

I N

S E C U R I T Y

of security risks so they can make informed decisions, rather than simply giving them a list of technical recommendations.

S P O T L I G H T

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

When you decided to pursue a career in cybersecurity, how did your parents, peers, or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

My passion for making the digital community a safer

My parents were really supportive. They knew

can help protect people, organisations and the

I’d wanted to build a career around protecting

technologies they increasingly depend on. This has

computers and technology for a long time. The

shaped my career aspirations towards work where

harder part was deciding to move to a new country.

I can contribute to practical security solutions and

It meant leaving behind a life and career I’d already

help create a safer digital environment.

place has been the biggest influential factor on my journey in cybersecurity. What motivates me is knowing that the work I do

built and, in many ways, starting again.

my feet in a different academic and professional

Recount the most memorable or significant event in your cybersecurity journey to date, highlighting why it left a lasting impression.

environment. What helped was reminding myself why

One of the most memorable moments in my

I’d made the move in the first place. I started building

cybersecurity journey was being nominated for

connections and gaining local experience through

the Best Security Student Award in 2026. It was

teaching and industry work. Those experiences

particularly meaningful because I had moved to

helped me see the move as more than starting over;

Australia and had to rebuild my academic and

it was also a chance to learn about myself and where

professional journey in a new country. Being

I wanted to take my career.

recognised within the cybersecurity community

There was a lot to think about, especially how I’d find

I S S U E 32

WOMEN IN SECURITY MAGAZINE

107

KIRAN ILLYASS

gave me confidence that the work, persistence and decisions I had made were leading somewhere meaningful.

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape?

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

Yes, I believe my academic program has kept

Alongside my studies, I’ve had the chance to put

systems and AI-based security.

pace with the changing cybersecurity landscape, particularly because my PhD research addresses current challenges in authentication, autonomous

my knowledge into practice in both Cyber GRC and security operations. During my GRC internship,

At the same time, cybersecurity evolves extremely

I supported the implementation of a Business

quickly, so academic learning alone is not enough.

Continuity Management (BCM) solution for an

I have found it important to complement my

insurance client using RSA Archer, aligned with APRA

research with industry experience, certifications,

CPS 230 requirements. I’ve also worked as a SOC

practical labs, conferences and engagement with the

Analyst, monitoring and triaging security events,

cybersecurity community.

so I’ve been able to experience a different side of cybersecurity too.

What aspect of your cybersecurity studies excites you the most, and why?

I also teach cybersecurity at university, covering

The aspect that excites me most is solving security

topics such as authentication, cryptography,

problems where there is no obvious answer. I

malware analysis and network security. Teaching

particularly enjoy authentication and applied

gives me another way to engage with the field:

cryptography because they involve understanding

helping students make sense of concepts that

how a system could be compromised and then

can feel quite technical at first. I’ve also authored

designing mechanisms to make it more secure. More

Deakin University’s Emerging Cyber Threats and

recently, exploring how AI can support cybersecurity

AI microcredential.

has made this even more interesting for me. I enjoy the fact that cybersecurity never stays still. As

What I’ve appreciated about these experiences is being able to look at cybersecurity from different angles.

technology evolves, new risks emerge, which means there is always something new to learn, question and solve.

I’ve worked with the technical detail, explored how organisations manage risk and had the opportunity to share that knowledge with others.

Are there specific aspects of your cybersecurity studies that you find particularly challenging? If so, what are they, and how do you approach overcoming these challenges? One of the most challenging aspects of cybersecurity is keeping up with how quickly the field changes. New technologies introduce new vulnerabilities, attack techniques and security challenges, so what you learn today can evolve very quickly.

108

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

I approach this by continuously learning beyond

as “Industry Mentoring Network in STEM”. These

my formal studies through practical labs, industry

experiences have helped me build connections

certifications, research papers, conferences and

beyond academia, learn from people working across

engagement with the cybersecurity community. I see

different areas of cybersecurity, and gain a better

continuous learning as an essential part of working

understanding of how security challenges are

in cybersecurity.

approached in industry.

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management? If yes, why?

What is your preferred source for staying informed about cybersecurity trends and general information?

Yes, definitely. For me, the people’s side of

Signals Directorate (ASD) and CISA for current

cybersecurity matters just as much as the technical

threats, vulnerabilities and security guidance.

I mainly rely on trusted sources such as the Australian Cyber Security Centre (ACSC), Australian

work. You need to explain risks in a way that makes sense to someone without a technical background

I also follow NIST publications and academic

and helps them make informed decisions.

research for deeper technical developments, alongside LinkedIn for industry discussions.

I want to be someone people feel comfortable asking

at building relationships across different teams.

Have you ever encountered situations where being a woman in cybersecurity made you feel disadvantaged or discriminated against? If so, please share your experiences.

Leadership is something I want to grow into as well,

I have not personally experienced discrimination

alongside strengthening my technical knowledge.

or felt disadvantaged because I am a woman in

questions with, not someone who leaves them more confused by the jargon. That’s why I’m keen to keep developing my communication skills and get better

cybersecurity. My experience has generally been

Are you actively engaged in the broader cybersecurity community? If so, what has been your involvement, and how has it enriched your experience?

supportive. I have also found communities such as

I am actively engaged with the cybersecurity industry events, conferences such as BSides and

What measures do you have in place to enhance your personal cybersecurity in today’s digital landscape?

AISA CyberCon, and academic activities. I am a

I use multi-factor authentication, strong and

member of organisations such as the Australian

unique passwords, and a password manager

Computer Society (ACS), Australian Information

for my accounts. I also keep my devices and

Security Association (AISA), Women in CyberSecurity

applications updated, regularly review account

(WiCyS), and Australian Women in Security

activity and permissions, and remain cautious about

Network (AWSN).

phishing emails, suspicious links and requests for

community through professional associations,

AWSN valuable for connecting with and learning from other women working in cybersecurity.

personal information. I also participate in academic peer review for cybersecurity conferences and journals and have taken part in industry mentoring programs such

I S S U E 32

https://www.linkedin.com/in/keran0323

WOMEN IN SECURITY MAGAZINE

109

USHNA ZUBAIR

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare? When I first looked into cybersecurity, I pictured

Ushna Zubair, a Bachelor of Computer Science student majoring in Cybersecurity at the University of Wollongong. Bachelor of Computer Science student at the University of Wollongong

hacking and coding, with most of the work happening behind a screen. I assumed you had to be incredibly technical to do well, and that was the main thing that mattered. My studies and teaching experience have changed that view, along with the conversations I’ve had with people in the security community. I’ve started to appreciate the decisions behind the technical work. What does a business need to protect

In a casual conversation with someone unfamiliar with the field, how do you articulate the excitement and potential of a career in cybersecurity, aiming to spark their interest?

most? What can it realistically improve with the time and resources it has? Even a good technical recommendation needs to make sense to the people who have to act on it.

I usually start by asking someone to think about the technology they use every day, their banking app or

That’s also helped me work out what I enjoy. I’m

the messages they’d rather keep private. Then we

still interested in how technology works, but I’m

talk about what it would mean if those things weren’t

especially drawn to explaining what it means for

secure. For me, that’s what makes cybersecurity

people and helping them make informed decisions. I

meaningful. Behind every system, there are people

no longer see cybersecurity as a field where everyone

relying on it.

needs to follow the same path. For me, the appeal is being able to use technical knowledge while also

What I find exciting is that there isn’t just one way

working through the human side of a problem.

to work in the field. You might enjoy investigating a

without a technical background. I’m finding myself

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

drawn to that space between the technology and the

I’m particularly interested in an entry-level or

people using it understanding how security decisions

associate role in technology risk or governance,

affect the way a business works.

risk and compliance. I’d like to help organisations

technical problem, helping a business understand its risks or explaining security issues to someone

understand where their security risks are and If someone is curious about cybersecurity, I’d

whether the controls they have in place are

encourage them to explore it rather than worry about

doing their job. What appeals to me is taking that

whether they fit the image of a “cyber person”. I’d tell

understanding and turning it into something useful

them to pay attention to what interests them and

practical improvements that help a business make

give themselves room to try different things. They

better decisions.

don’t need to have their whole career mapped out before they start.

110

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

I’m also keen to explore Sales Development

Then, when I first arrived in Australia, I fell victim to

Representative (SDR) and Business Development

a phishing attack. That made cybersecurity personal

Representative (BDR) roles in cybersecurity. I enjoy

in a way I hadn’t expected. Suddenly, I wasn’t just

talking with people and understanding what they’re

interested in studying it; I was trying to understand

struggling with before discussing what might

something that had happened to me. Why did it seem

help. These roles would give me a chance to build

convincing? What had made me trust it? I wanted

on that interest while developing my commercial

to understand how it worked and how I could help

skills and learning more about how organisations

someone else recognise the warning signs.

approach security. Both my parents are doctors, so I was heading in My previous experience has helped me see the

quite a different direction. But Mum and Dad have

value I could bring to either path. Reviewing

supported me throughout. They recognised my

research applications taught me to pay close

curiosity and encouraged me to follow it, even when

attention to guidelines and give clear, constructive

I couldn’t tell them exactly where it would lead. I’m

feedback. Working in sales and client advisory

really grateful for that.

taught me to listen first, rather than jump straight to a recommendation.

There were times when I questioned my choice, especially watching friends take paths that seemed

I’d like my next role to build on those experiences

more familiar or straightforward. It wasn’t always

while giving me room to develop my technical

easy to feel confident when I was still figuring things

knowledge. I’m open to either direction. What

out. I had to get comfortable with not having every

matters most to me is joining a team where I can ask

answer and give myself time to explore.

questions, get good training and gradually take on more responsibility.

I’m still working out where I fit within cybersecurity. The difference now is that I don’t feel I need to have

When you decided to pursue a career in cybersecurity, how did your parents, peers, or career advisors react? Did you encounter any opposition, and if so, how did you navigate those challenges?

it all mapped out to know it’s something I want to pursue.

before I came to Australia.

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations?

I’ve always been curious

My time at the University of Wollongong and my

about the kind of child who

involvement with ISACA have both helped me work

My interest in technology started well

asks a question, hears the

out where I’d like to take my career. University gave

answer and immediately

me the technical foundation, but meeting people in

wants to know more. My

the wider security community helped me see what I

parents know that side of me

could actually do with that knowledge.

very well! Technology gave me plenty to explore because

Receiving the ISACA Sydney Chapter Student

there was always something else I

Scholarship was a real confidence boost. Being part

wanted to understand.

of the mentorship program meant a lot too. I had the chance to learn from people beyond the classroom

I S S U E 32

WOMEN IN SECURITY MAGAZINE

111

USHNA ZUBAIR

and talk through possibilities I was still figuring

It also reminded me that I want to keep supporting

out. That helped me think more clearly about what

others as I learn. I know what it’s like to be interested

interests me, rather than just which job titles I could

in cybersecurity without being sure where you fit, and

apply for.

I’d like to help other students feel more comfortable asking questions and exploring their options. Being

I’ve found myself drawn to technology risk and

a finalist was a moment I’m proud of, but I’m still

governance, especially work that involves helping

learning and there’s plenty I want to do next.

people understand security. I’m also becoming more comfortable with not having my whole career planned out yet. For now, I want to keep asking questions and build enough experience to make a useful contribution to a team and its clients.

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships? I’ve been able to put my studies into practice through

Recount the most memorable or significant event in your cybersecurity journey to date, highlighting why it left a lasting impression.

teaching and mentoring, as well as IT client advisory

Being named a finalist for Best Security Student

much it involves understanding people’s needs and

at the 2026 Australian Women in Security Awards

helping them work through problems.

and customer-facing roles. Each has given me a different perspective on security, particularly how

meant a lot to me. I was still finding my feet, so being recognised alongside people contributing to the

At the University of Wollongong, I worked as a

industry gave me a real confidence boost. It made

cybersecurity lab demonstrator and tutored Data

me stop and appreciate how far I’d come, rather than

Management Systems. I helped students through

always thinking about what I needed to do next.

practical exercises, troubleshot technical issues and found different ways to explain concepts when

Until then, I’d mostly thought of my studies,

something wasn’t clicking. I also mentored high

supporting other students and getting involved in the

school students in cryptography through PECAN+,

community as separate experiences. That recognition helped me see how

which gave me another opportunity to make technical ideas more approachable.

they were coming together, even while I was still working out my

At DataSCG, I reached out to organisations and

professional direction.

joined discovery calls to understand their IT and cybersecurity needs. From there, I helped prepare recommendations involving Microsoft 365 and security solutions, and followed up with prospective clients. My work at Telstra showed me another side of security: verifying customer identities, following privacy requirements and escalating suspected fraud or unusual account activity. I’m still building my industry experience, but I don’t see these roles as separate from that journey. They’ve helped me become more comfortable asking questions and handling information carefully. Clear, audience-aware communication matters in

112

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

cybersecurity too. That’s something I’ve been able to

My degree has helped me build technical knowledge

practise throughout these roles, and I’m keen to build

and put it into practice. But I don’t expect it to prepare

on it in a dedicated security position.

me for every situation I’ll face at work. I see learning from people in the industry and getting workplace

experience as part of that next step, alongside the

I’ve completed the Google Cybersecurity Certificate,

professionals. I’d like to hear not just what they

which covers foundational cybersecurity skills. I

decided, but what made the decision difficult. What

chose it because I wanted to reinforce what I was

happens when there isn’t enough budget for the ideal

learning in my degree and spend some time exploring

solution, or two priorities compete? Those are the

the subject outside my university coursework.

conversations I’d find useful as I prepare to move

learning I do myself. Something I’d really welcome is more chances to work through actual business problems with

from studying cybersecurity to working in it. I haven’t mapped out a whole list of certifications to decision. If I go into technology risk or IT audit, I’d

What aspect of your cybersecurity studies excites you the most, and why?

be interested in working towards a relevant ISACA

What interests me most is getting to the bottom of a

qualification once I have the right knowledge and

security problem and asking, “What does this actually

experience. If I take a vendor-facing role, I’d want to

mean for the people affected?” I enjoy understanding

understand the products well enough to have useful,

the technical details, but I also want to work out what

informed conversations with customers.

could happen and what someone can realistically do

do next. I’d rather let the work I move into guide that

about it. For me, the important question is, “What will I be able to do with what I’ve learned?” I don’t want to

That’s a big part of why I’m drawn to technology risk

complete a qualification just to add it to my CV.

and governance. I’d like to understand how security

I want to be able to explain the ideas in my own

fits into an organisation’s everyday decisions, rather

words and feel confident putting them into practice.

than being something only the IT team thinks about.

That would matter most when choosing what to study next.

I’ve also found that I really enjoy helping something make sense to someone. Through teaching and

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape?

conversations with clients, I’ve seen the difference

For me, university should give you a solid starting

know the subject well enough to explain it clearly and

point, not leave you feeling like you’re supposed to

help someone decide what to do next.

it makes when an explanation finally clicks. Security advice needs to be understandable to the people acting on it. That’s the kind of work I’d like to do:

know everything by graduation. Tools and threats

a problem and understand why something happens,

Conversely, which aspect of your studies do you find least interesting or useful, and how do you navigate through it?

rather than just knowing which buttons to click.

Coding isn’t the part of cybersecurity I’m most drawn

keep changing, so there will always be more to learn. What I value most is learning how to work through

to. I’m more interested in analysing a problem and

I S S U E 32

WOMEN IN SECURITY MAGAZINE

113

USHNA ZUBAIR

talking through what it means for a business. That

expect to know everything straight away. I do want to

said, I’ve valued studying computer science because

take responsibility for what I need to learn and work

it’s helped me understand what’s happening behind

out how to get there.

the systems and applications we use.

does or how a weakness might affect someone

Do you believe there are areas in cybersecurity that deserve more emphasis in your coursework or areas that could receive less focus?

makes an exercise feel more meaningful to me. It

I’d like to see more attention given to what happens

gives me a reason to work through the parts that

after you identify a security problem. How do you

don’t come as naturally.

decide which risks need attention first, and how do

I find coding more engaging when I can see the purpose behind it. Understanding what an application

you know whether the controls are actually working? I don’t see myself pursuing software development,

I’m interested in understanding how those decisions

but I do want to keep building my technical

are made within a business, including who takes

knowledge. I’d like to understand enough to ask

responsibility for them. That’s where I’d welcome

useful questions and work comfortably with

more practical learning around risk assessment

specialists, while moving towards a role that

and governance.

makes more use of my strengths in analysis and communication.

For example, we could work through a realistic scenario, decide what needs fixing and then explain

Are there specific aspects of your cybersecurity studies that you find particularly challenging? If so, what are they, and how do you approach overcoming these challenges?

our recommendations to different audiences. A

One thing I find challenging is knowing where to

chance to practise both and get feedback—not just

focus. There’s so much to learn in cybersecurity, and

on whether my recommendation was right, but

I can get caught between wanting to understand

whether someone could understand it and act on it.

technical team may need detail that wouldn’t be useful to a business manager, so knowing how to adapt the explanation matters. I’d appreciate the

one topic properly and feeling I should be learning something else too. There’s also a difference

I’d also like more insight into how teams work

between following an explanation in class and sitting

together day to day. I wouldn’t take away the

down to work through a problem on my own.

technical foundations; I’d connect them more closely to situations we might face at work. For me, that

When something isn’t clicking, I want to get better at

would make the learning feel more relevant and give

stepping back and asking, “Which part am I actually

students a chance to explore roles they might not

stuck on?” From there, I can revisit the basics and

have considered.

work through a practical example. Explaining an idea

employment, I want to keep asking questions and

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management? If yes, why?

be open to feedback, even when admitting I don’t

Yes, definitely. Communication is something I want

understand something feels uncomfortable. I don’t

to keep working on. Finding a security issue is

in plain language can also reveal gaps that aren’t obvious when you’re just reading about it. Teaching has reinforced that for me. As I move into

114

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

important, but so is explaining it in a way that makes

conversations have helped me look beyond the roles

sense to the person who needs to act on it. I want

I first associated with cybersecurity and think more

to get better at listening to their concerns, rather

carefully about what might suit me. It’s been useful

than assuming the technical explanation tells them

to hear what employers expect, too, and where I

everything they need to know.

could focus my learning next.

Teaching and client-facing work have given me

Teaching and mentoring have given me a way to

opportunities to practise, but there’s still plenty I’d

contribute while I’m still learning myself. Sometimes

like to improve. I want to ask better questions and

a student’s question makes me pause and realise I

feel more confident presenting my ideas. Business

need to think about a concept differently before I can

writing is another area I’d like to develop. I’m also

explain it properly. I appreciate that exchange. Being

keen to understand more about budgets and why

part of the community has made the move towards

an organisation might prioritise one decision over

professional work feel less like something I have

another, even when the technical recommendation

to figure out alone, and I’d like to keep offering that

seems straightforward.

same support to others as I gain experience.

Leading our Accentify project helped me appreciate as a team. It wasn’t just about my own tasks; it was

What is your preferred source for staying informed about cybersecurity trends and general information?

about shared responsibility and keeping everyone

I like information that helps me understand not just

working towards the same goal. In my next role, I’d

what’s happening, but why it matters. Official security

welcome training in stakeholder management and

advisories and technical guidance give me a starting

project delivery, particularly how to prioritise when

point, while industry discussions help me connect

several things need attention. I want to contribute

the details to what an organisation might actually be

technically, but also be someone my teammates can

dealing with.

how much coordination goes into getting work done

rely on to help move the work forward. I’m particularly interested in ISACA because of

Are you actively engaged in the broader cybersecurity community? If so, what has been your involvement, and how has it enriched your experience?

my interest in governance and risk. I

Yes, and being involved has helped me feel more

can make something much

connected to the industry while I’m still finding my

clearer than reading about it

feet. Through ISACA Sydney’s student scholarship

on my own. LinkedIn is

and mentorship program, I’ve had opportunities

useful for discovering

to learn from people outside university. I’ve also

discussions, but if a

taken part in university cybersecurity activities and

claim catches my

PECAN+, shared my student perspective through

attention, I want

Women in Security Magazine and been recognised as

to check where

a finalist at the Australian Women in Security Awards.

it came from

also really value conversations with professionals and mentors. Being able to ask a follow-up question

before relying What I’ve valued most is being able to ask questions

on it.

and hear about people’s experiences. Those

I S S U E 32

WOMEN IN SECURITY MAGAZINE

115

USHNA ZUBAIR

I’m still figuring out a routine that works for me.

As I build my career, I’d like to offer that same

It’s easy to feel like I should be keeping up with

support to other women who are curious about

everything, but I’d rather spend time understanding

cybersecurity but aren’t sure where they fit. I know

a few developments properly than scroll through

that uncertainty myself. Sometimes it helps to have

headlines and remember very little. I want to be able

someone listen to your questions and encourage

to explain what I’ve learned and why it matters, not

you to give it a go, without expecting you to have

just recognise the topic.

everything figured out.

Have you ever encountered situations where being a woman in cybersecurity made you feel disadvantaged or discriminated against? If so, please share your experiences.

What measures do you have in place to enhance your personal cybersecurity in today’s digital landscape?

I’ve heard people describe cybersecurity as an

to me after I fell victim to a phishing attack when I

unusual career choice for a woman, and those

first arrived in Australia. That experience has stayed

comments can make me second-guess myself.

with me. It’s why I try to pause when an unexpected

When you’re still finding your feet, it’s hard not to

message arrives, even if it looks convincing or

take them personally. I’d rather be talking about what

seems urgent.

Personal cybersecurity became much more real

interests me in the field than explaining why I’ve chosen it.

I focus on habits I can keep up: using a different password for each account, switching on multi-factor

I’m still learning, and there’s plenty I don’t know yet.

authentication where it’s available and keeping my

But that’s part of starting a career, not a reflection

devices and apps updated. If a message asks for

of my gender. I want the chance to ask questions

money or personal information, I check through a

and show what I can contribute, without someone

trusted contact method rather than using the links

deciding what I’m capable of before they’ve worked

or details in the message. I also review my privacy

with me.

settings and app permissions, and make sure my account recovery details are current.

Having people who encourage me makes a real difference. Sometimes that’s a mentor taking the

Working with customers at Telstra gave me another

time to work through a question with me. Other

perspective on this. Identity checks can feel like an

times, it’s seeing a woman in a role I hadn’t imagined

extra step, but being involved in that process helped

myself doing and thinking, “Maybe that’s something

me appreciate the person behind the account and

I could work towards.” I don’t expect to have all the

why their information needs to be handled carefully.

answers. I just want to feel comfortable learning, without worrying that a gap in my knowledge will be

Studying cybersecurity hasn’t made me feel immune

taken as a reason I don’t belong.

to an attack. If anything, it’s made me more aware of how important it is not to become complacent. I’m

Being involved with and the Australian Women in

still learning, and I want my everyday habits to reflect

Security Awards has meant a lot to me. Having the

that, not just what I know in theory.

chance to share my perspective while I’m still finding my feet has been really encouraging. It’s helped me feel part of the community, rather than someone waiting to join it once I have more experience.

116

W O M E N I N S E C U R I T Y M A G A Z I N E

Reflecting on your journey thus far, would you, with the benefit of hindsight, make any changes to your career trajectory? If yes, what adjustments would you consider?

N O V E M B E R • D E C E M B E R 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

If I could do something differently, I’d explore the

Yes, I am. I’m looking at entry-level and associate

different cybersecurity career paths earlier. When

roles in technology risk, GRC and IT audit, as well as

I started, I mostly pictured hacking and highly

client-facing cybersecurity opportunities. I’d love to

technical work. It took me a while to discover how

find a role where I can put my technical education to

much I was interested in the business side of

use while building on what I’ve learned from working

security, particularly understanding risk and helping

with customers and students.

people make decisions. I wish I’d given myself more room to explore that sooner.

Applying has made me think more carefully about how I tell my story. I’m learning not to

I’d also start talking to professionals earlier in my

assume that listing my degree or previous roles

studies. Not just asking, “How do I get a job like

will make the connection obvious. I need to show

yours?” but, “What does your day actually look like?”

how I approached a problem or helped someone

or “What do you find challenging?” A job title doesn’t

understand something, and explain why that

always help me picture the work. Hearing someone

experience matters for the role.

talk honestly about their experience would have helped me work out which roles I wanted to learn

I’m also becoming more thoughtful about which

more about.

opportunities I pursue, rather than applying simply because “cybersecurity” appears in the title. I want

I still value what my degree and the roles I’ve had

to know what I’d actually be doing each day, what

have taught me. I wouldn’t want to lose those

support I’d have and what the team would expect of

experiences. I’d just make more connections

someone starting out. There’s a lot to figure out, and

between what I was learning and where it could take

it can feel daunting. But the process is helping me

me, rather than leaving career exploration until I was

recognise what I can already offer, as well as where I

closer to looking for work.

still need to grow.

Have you actively sought employment opportunities in the cybersecurity field, and if so, what has been your experience with the application and interview process?

I S S U E 32

www.linkedin.com/in/theushnazubair

WOMEN IN SECURITY MAGAZINE

117

HARKIRAT KAUR

Who or what has been the most influential factor in shaping your journey in cybersecurity so far, and how has it impacted your career aspirations? Several people have helped me along the way, but one who really stands out is my university

Harkirat Kaur, a Bachelor of Information Technology student majoring in Cybersecurity at Central Queensland University. Bachelor of Information Technology student at Central Queensland University.

professor, Dr Sangeetha Kutty. Her support has gone well beyond teaching cybersecurity. She’s always encouraged us to attend industry events and meet people working in the field, which has helped me build connections I might not otherwise have made. What’s meant the most to me, though, is how much she’s believed in me. Her encouragement has helped me build confidence in my own abilities and

Reflecting on your initial perceptions of cybersecurity when you first considered studying it, how does the reality of your experiences today compare?

feel more comfortable putting myself forward. I’m really grateful to have her as a mentor, both for the opportunities she’s helped create and for the support she’s given me throughout my studies.

When I first thought about studying cybersecurity, I found it quite intimidating. I pictured people hacking into accounts and spending all day coding, and I wasn’t sure what to expect.

Beyond your academic studies, what practical experience have you gained in the field of cybersecurity through employment or internships?

But once I started learning, I realised how limited that

My three-month internship at a global manufacturing

picture was. The biggest surprise was discovering

company helped me connect what I’d been

just how broad the field is, with different roles suited

learning in class with what cybersecurity looks

to different skills and interests. That changed how I

like in a business. I got a better understanding of

saw it. Instead of feeling like I had to fit a particular

enterprise security, but I also learned a lot about

mould, I could start exploring which parts genuinely

working with people and finding my feet in a

interested me and where I might fit.

professional environment.

Upon graduation, which specific cybersecurity role do you aspire to secure employment in, and what motivates your choice?

One thing that really stayed with me was how

After I graduate, I’d love to work as a security analyst.

technical problems. It was also about working with

I enjoy digging into a problem and connecting the

different teams and helping them understand why

dots to understand what’s really going on. There’s

security mattered to their work.

much of the work involved conversations. It wasn’t just about sitting at a computer and dealing with

something satisfying about working through the

118

details until things start to make sense. It feels

My biggest takeaway was learning to explain

like a good fit for the way I think, and I’m keen to

technical ideas without overcomplicating them.

put my problem-solving and critical analysis skills

Using language your audience understands is an

into practice.

important part of communicating security risks.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

S T U D E N T

I N

S E C U R I T Y

S P O T L I G H T

That’s something I’ll carry into my next role, along

environment. Apart from the technical skills, it is also

with the technical experience I gained.

vital to have good engagement and communication skills. Even if you have a complete knowledge of

Given the rapid evolution of cybersecurity threats, do you feel that your academic program adequately keeps pace with the industry’s current landscape?

the technical side but without good interpersonal

I think AI is moving so quickly that university courses

Apart from this, learning corporate management is

can struggle to keep up with what’s happening in

one key area that I would definitely work on especially

the workplace. It’s encouraging to see AI being

for leading meetings, writing professional emails and

introduced into more courses, but I’d like to see

engaging with other teams at the workplace.

skills one would never be able to deliver their opinion currently and confidently.

students get more hands-on experience with how it’s

ways: it can help attackers carry out threats more

Are you actively engaged in the broader cybersecurity community? If so, what has been your involvement, and how has it enriched your experience?

effectively, but it can also help security teams detect

Yes, I am trying to actively participate in the

and respond to them. That’s why I feel we need to

broader cybersecurity community by participating

understand both sides. For me, it’s not enough to

in cybersecurity events and volunteering several

know that an AI tool exists. I want to understand

sessions. In addition to this, I connect with groups

when it’s useful, where its limitations are and when I

and individuals working/studying in cybersecurity to

need to question what it’s telling me.

learn more about the ongoing updates and be a part

actually used in cybersecurity. What stands out to me is that AI works both

of the community.

What aspect of your cybersecurity studies excites you the most, and why? The cybersecurity aspect that I am most excited

www.linkedin.com/in/harkirat-kaur-149876364

about is definitely the technical side. Practical tutorial days are the favorite part of my studies as they help us understand the concepts rather than just reading or listening about it. Doing the attack-based simulations help me feel more confident about the theoretical concepts I learned and give a sense of joy when you accomplish the given task successfully. Additionally, they also help us become more familiar with real-life techniques and tools.

Considering the holistic requirements of a future role, do you see the need for additional training in non-cyber skills, such as interpersonal communication or management? If yes, why? I believe that I might need more training for noncyber especially for understanding a corporate

I S S U E 32

WOMEN IN SECURITY MAGAZINE

119

LISA ROTHFIELD-KIRSCHNER Author of How We Got Cyber Smart | Amazon Bestseller

The Maths Test Leak It was a sunny Thursday afternoon and twins Olivia and Jack were walking home from school with a sense of quiet relief. For the past week their desks had been buried under graph paper, formula flashcards and highlighters. The term three maths exam had been tough, full of tricky multiple choice algebra questions and fractions, but they had put in the effort. When Miss Wen had collected the papers at the end of the fifth period, both twins felt confident they’d done their best. “I think I actually nailed question seven,” Jack said, kicking a stray pebble along the footpath. “The one with the swimming pool volume.” “Told you drawing the diagram would help,” Olivia smiled. “Now we get a whole weekend with no algebra.” Or so they thought. On Friday morning, the atmosphere at school was noticeably different. When the morning bell rang, instead of Miss Wen handing back marked papers with her usual cheerful commentary, the principal, Mr Quinn, walked into the classroom. The room went completely quiet. “Good morning, Class,” Mr Quinn began without his usual smile. His voice calm but serious. “I need to share some disappointing news. Late yesterday

120

W O M E N I N S E C U R I T Y M A G A Z I N E

evening, the school leadership team was alerted that photographs of yesterday’s maths exam were posted onto social media and shared across several class group chats on Wednesday night.” Instantly there was chatter in the classroom and Jack dropped his head onto his arms. “You’ve got to be joking,” he muttered. “Some students saw the test questions before walking into the exam room,” Mr Quinn continued. “Many others did not. Because the integrity of the test has been compromised, it is impossible for us to know which results are genuine. Therefore, yesterday’s test results have been cancelled. The entire year level will have to sit a new test next Monday morning.” At lunchtime by the basketball courts, everyone was talking about what had happened. “It’s totally unfair,” Jack said, opening his lunchbox. “We spent days studying for that. Why should everyone have to suffer just because someone leaked it?” “Because a test only works if it’s fair for everyone,” Olivia pointed out, unwrapping her sandwich. “Think about it. Some people got top marks without knowing the maths at all, and other people worked hard for every point. How could the teachers grade fairly?”

N O V E M B E R • D E C E M B E R 2026

Their friend Daniel wandered over, looking miserable. He admitted quietly that a photo of the test paper had popped up in his basketball team chat on Wednesday evening. “I saw the first page,” Daniel confessed, his cheeks turning pink. “Someone sent it with a caption saying ‘Tomorrow’s test – thank me later.’ I thought it was just a joke, so I forwarded it to two mates before I realised it was real.”

“That’s the problem with digital stuff,” Olivia said gently. “Once a photo gets forwarded into one group, it jumps into ten others in minutes. Even if you only sent it to two people, they send it to two more, and suddenly it’s everywhere.” That evening over dinner, Olivia and Jack told their parents what had happened.

“Did you tell a teacher when you saw it?” Jack asked.

Their dad shook his head. “It’s frustrating when you’ve done the hard yards, but Mr Quinn made the right call. A leaked test isn’t just cheating; it’s an unauthorised distribution of private school material.”

Daniel looked down at his sneakers. “No. I didn’t want to get anyone in trouble. I didn’t think it would blow up like this.”

“And sharing it makes you part of the problem,” their mum added. “When private documents or tests get posted

I S S U E 32

WOMEN IN SECURITY MAGAZINE

121

online, people often hit ‘share’ without thinking about the ripple effect. One photo can spoil the hard work of an entire grade.” “So, what happens now?” Jack asked. “Now,” their mum smiled, “You two take a deep breath and keep doing what you’ve been doing. The people who relied on memorising leaked answers will have to study harder and cram. But you two actually understand the concepts. You did the work.”

TOP TIPS FOR ACADEMIC INTEGRITY AND DIGITAL SHARING Group chats and social apps make sharing files effortless, but some things should never be passed along. • Never share or forward assessment materials. Sharing photos of quizzes, exams or test papers, even as a joke, violates school rules and academic integrity and can damage your online reputation/digital footprint.

Over the weekend Olivia and Jack did a quick refresher of their notes, but there was no panic. They already knew the methods, the formulas, and the steps.

• Understand the ripple effect. Once an image is uploaded or forwarded into a group chat, you lose control of where it goes. It can spread to hundreds of people in minutes.

When Monday morning arrived, a fresh test was placed face-down on every desk. The questions were completely different; different numbers, different word problems and new diagrams.

• Speak up if you see something wrong. If confidential school documents or test materials appear in your chats, do not forward them. Let a teacher, parent or trusted adult know immediately.

Around the room, several students who had looked confident on Friday were staring at their papers with wide, panicked eyes. But Olivia and Jack picked up their pencils and got straight to work.

• Keep your accounts and devices locked. Never leave school portal logins open on shared computers, and never share passwords with peers.

When the results came back on Thursday, both Jack and Olivia achieved top marks. Walking home that afternoon, the relief was genuine this time. “You know,” Jack said, adjusting his backpack, “cheating online might seem like a quick shortcut, but it only works until the real test arrives.”

• Real learning outlasts shortcuts. Memorising leaked questions doesn’t build real skills. When surprises happen, genuine understanding always wins out in the end. www.linkedin.com/in/lisarothfield-kirschner

howwegotcybersmart.com

Olivia laughed. “And real knowledge doesn’t get cancelled by a resit.”

122

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

How We Got Cyber Smart addresses cyber safety, cyber bullying and online safety for elementary school-aged children. Lisa has partnered with Cool.Org, and her content is found on the Department of Education website.

READ NOW

WOMEN IN SECURITY MAGAZINE CONTRIBUTORS 01

1. AMANDA-JANE TURNER

Author of the Demystifying Cybercrime series and Women in Tech books. Conference Speaker and Cybercrime specialist

2. MICHELLE BOWER

CEO, GNGB

3. MARYAM ABEDI

Manager at KPMG

4. EMILY WANCZURA

Consultant – Technology Risk & Cyber Security at KPMG

5. ASIMINA BASDANI

Chief Information Security Officer (CISO), Head of Information Security Office

6. ESTHER WAFULA

Senior Information Security Consultant

7. MALAK YOUSSEF

Cybersecurity Engineer – Automation & AI

8. RENEE NOBLE

CEO, Girls Programming Network

9. CRAIG FORD

Head Unicorn – Cofounder and Executive Director, Cyber Unicorns. Australian Best Selling Author of A Hacker I Am, Foresight and The Shadow World book series. vCISO – Hungry Jacks, Wesley Mission, PCYC and Baidam Solutions

10. MICHAEL BRAUN

Founder & CEO of MSB Protection

11. JO STEWART-RATTRAY

Oceania Ambassador, ISACA

12. GORDANA GINA MIHAJLOVSKA

CEO AIGentic Consulting

124

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

13. LISA VENTURA MBE FCIIS

Chief Executive and Founder, Unity Group Solutions Limited/AI and Cyber Security Association

14. CANDELA RABEC

Cybersecurity Specialist

15. LILY DAY

Business Continuity Management

16. SHRUTI SHANBHAG

Senior Consultant, Consulting Tech Risk & Operational Resilience

17. ERIN CARROLL

Risk Consultant

18. LAUREN WEBBER

Cyber Consultant

19. SAKSHI KISHORE

Associate Director, Tech Risk and Cyber, Consulting

20. BETH TSCHIDA

CEO of Jamf

21. AMBER RAMSEY 21

22. KAREN STEPHENS

CEO and co-founder of BCyber

23. SIMON CARABETTA

Cyber Security Workforce Skills and Education | Podcaster | DEI advocate

24. BETTINA VAHL

Vice President of Global Channels at Yubico

I S S U E 32

WOMEN IN SECURITY MAGAZINE

125

25. MARINA AZAR TOAILOA

Founder of the Mummy Safety Security Project

26. FATEMAH BEYDOUN

Founding team member of Secure Code Warrior

27. MEHIKA MANOCHA

Lead Engineer at Xero

28. PRASANTH PAVITHRAN

Technology and Management Professional

29. JEANETTE GILL

Head of Customer Success for Asia-Pacific at Secure Code Warrior

30. BEN AMADI

Cybersecurity

31. MADHURI NANDI

Global Cyber Security Leader of the Year (2025, 2026) | Head of Security, Nuvei | Chair, AWSN National Board | Author, Cyber Smart

32. ZESEYA SHARMIN

PhD in Information Technology student at Deakin University

33. KIRAN ILLYASS

Doctor of Philosophy in Information Technology (Cybersecurity) student at Deakin University

34. USHNA ZUBAIR

Bachelor of Computer Science student at the University of Wollongong

35. HARKIRAT KAUR

Bachelor of Information Technology student at Central Queensland University

36. LISA ROTHFIELD-KIRSCHNER

Author of How We Got Cyber Smart | Amazon Bestseller

126

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

SURFING THE NET

THE PSYCHOLOGY OF BAD CODE By SheHacksPurple This is a series. The first blog post is here, #2, #3, #4, and this is the fifth. The behaviour: Shiny New Tech Using a brand-new technology, language, and/or framework, even when it’s not necessarily the best thing to use. Especially if it’s untested, and there’s little guidance.

By Cygenta Our domain also involves managing human risk, understanding and influencing human behaviour, and transforming security culture. We now use all of these terms – and more – to describe what we do, and yet for most CISOs and security leaders, it is the term “security awareness” which comes first to mind.

LEADERSHIP IN THE AGE OF AI: WHY THE HUMAN EQUATION HAS NEVER MATTERED MORE By Women in Digital Artificial intelligence is rewriting the rules of almost every industry in this country. From the mining giants of Western Australia to the fintech start-ups crowding Sydney’s CBD, no sector is untouched. Yet for all the breathless commentary about automation, machine learning and the imminent obsolescence of white-collar work.

READ BLOG

YOUR NAME IS ON THE RISK REGISTER. THE DECISION WASN'T YOURS.

CAN YOUR CYBER CONTROLS MOVE AT THE SPEED OF AI?

By Jane Frankland MBE

By Jaime Kipnes

I've watched CISOs sign off risk acceptances for decisions they argued against and lost. It usually goes something like this. They've spent months warning that something needs to change. Nobody really disagrees. But there's a release date to meet, and delaying it will cost money. The cyber risk is harder to quantify. Something could go badly wrong, or nothing might happen at all.

AI is reshaping the cybersecurity landscape at a breathtaking rate. Threat actors including statefunded attackers are exploiting AI-enabled capabilities to target systems, networks and data with greater speed and precision than ever before. As a result, organizations’ cyber resilience and incident response capabilities are being stretched to the limit.

WHO CONTROLS YOUR CONNECTIVITY? THE INFRASTRUCTURE RISKS BEHIND THE FCC'S PROPOSED RULES

READ BLOG 128

CONVERSATIONAL SECURITY AWARENESS: PUTTING HUMANITY INTO YOUR HUMAN RISK MANAGEMENT PROGRAM

W O M E N I N S E C U R I T Y M A G A Z I N E

READ BLOG

By Worldwide Technology (Madison Horn) A utility can secure its control systems and still depend on a communications provider whose remote access practices it barely understands. A bank can buy redundant circuits that share an underlying facility. For organizations running essential services, the security of the communications network is part of their own ability to keep operating.

READ BLOG N O V E M B E R • D E C E M B E R 2026

WOMEN IN AI: CAREER PATHS, SKILLS, AND RESOURCES TO GET STARTED

ENGINEERING LEADERSHIP: THE FIRST 90 DAYS FROM IC TO MANAGER

By Skillcrush

By Womenhack

For women curious about an AI career, the field can seem exciting and hard to break into at the same time.Whether your background is in writing, design, research, customer support, project management, or tech, there is room to build on what you know and learn what comes next.

The slow feedback loop is why many new managers feel unproductive in month one. A week can pass with no finished pull request and no clear win. That is normal, and it does not mean you are failing. If you are still deciding whether the move is right for you, read deciding whether to move from engineer to manager. This plan starts after you have said yes.

READ BLOG

CYBERSECURITY HAS A DIFFERENTIATION PROBLEM.

KICKING OFF CYBERSECURITY CAREER WEEK WITH NIST!

By TEAM LEWIS ( Talia Scribner)

By NIST (Susana Barraza)

Spend ten minutes on any security conference floor, or scroll through a few vendor websites. The bold words, the corporate mission, the brand positioning… all the language begins to blur. Everyone is “AI-powered,” and because of that, everyone offers “realtime visibility.”

Be ready to engage, explore, and try something new. Use CCW to ask questions, attend an event, connect with people already working in the field, or participate in challenges. You never know which conversation, activity, class, or resource might introduce you to your future cybersecurity career.

READ BLOG I S S U E 32

READ BLOG

WOMEN IN TECH By Built By Girls Challenging young women to be builders, creators, and innovators the protagonists in their own lives. Built By Girls is building the next wave of tech leaders - who just happen to be girls.

READ BLOG

THE FUTURE OF COMPUTER SCIENCE ENGINEERING: BUILDING A SMARTER DIGITAL WORLD By Deepali Bathe Deepali Bathe Computer Science Engineering (CSE) is no longer just about writing code. It now shapes healthcare, education, banking, transport, and entertainment. As a CSE student, I want to look at where this field is heading and what it means for students and professionals like me.

READ BLOG WOMEN IN SECURITY MAGAZINE

129

TURN IT UP MAEVE SECURITY PODCAST With Kendra, Maeve The Maeve Security Podcast spotlights the women shaping cybersecurity and tech, in their own words. Each episode features candid, unscripted conversations about career journeys, hardwon lessons, and the realities of building a life in this industry, from unconventional paths into security to burnout, mentorship, and everything in between.

CLICK TO LISTEN

CLICK HERE With Dina Temple-Raston Investigative reporting on cybercrime, intelligence and the people shaping our digital world. Women-led rather than womenfocused, with an accessible storytelling approach.

CLICK TO LISTEN 130

W O M E N I N S E C U R I T Y M A G A Z I N E

HIT LIKE A GIRL POD: EMPOWERING WOMEN IN HEALTH IT With Joy Rios, Grace Vinton, and Rebecca Love Three women. Three lenses. One big conversation about the future of healthcare, technology, and leadership. Policy & tech. Patient. Nursing. Each miniseries begins with all three of us around the mic, framing the big question. Then each of us hosts an episode through our own lens—bringing you voices you haven't heard, perspectives you haven't considered, and healthcare conversations that actually matter.

CLICK TO LISTEN

WOMEN IN CYBERSECURITY PODCAST With Yuri Diogenes, Alexandra Francu, and Iulia Iancu This podcast brings you real stories, expert insights, and bold conversations with women leading the charge in cybersecurity across Romania, Europe, and beyond. New episodes drop regularly featuring career journeys, technical deep dives, leadership lessons, and the latest in cyber policy and innovation.Follow us and join a growing community of professionals who believe in a more inclusive, secure digital world.

CLICK TO LISTEN

WOMEN IN CYBER — EXPERT INSIGHTS

ALL THE CYBER LADIES

With Caitlin Harris Panel conversations that combine technical perspectives with women’s career stories. Topics include breaking into cybersecurity, C-suite leadership and the realities of being a CISO.

With Lucinda Sterk (Bureau Veritas Cybersecurity) A podcast for and by women in cybersecurity, supported by Bureau Veritas Cybersecurity. A good addition when looking beyond the most familiar US-led shows.

CLICK TO LISTEN

CLICK TO LISTEN N O V E M B E R • D E C E M B E R 2026

WICYS PRESENTS WOMAN IN THE MIDDLE

AFTERNOON CYBER TEA WITH ANN JOHNSON

BUILD YOUR BRAVE CAREER FOR WOMEN IN TECH

With Jackie McGuire, also known as JackiesinSecurity Connects established cybersecurity professionals with people entering the industry, treating security as a human and cultural challenge— not just a technical one. WiCyS published a five-part series recorded at its 2026 conference.

With Ann Johnson Executive-level conversations about cyber risk, emerging technology and leadership. Its 2026 episodes include AI, trust, global supply chains and why resilience needs shared governance rather than being left to IT.

With Nicole Trick Steinbac Build Your Brave Career is for women in tech who are done being overworked, overlooked, and underpaid...and are ready to change it. If you're experienced, capable, and tired of working harder without getting what you've earned.

CLICK TO LISTEN

THE WISP PODCAST

LEADING WOMEN IN TECH PODCAST

HUMAN FACTOR SECURITY

With Toni Collis For ambitious women ready to rise, lead, and thrive — without burning out. Are you delivering results… but still waiting to be seen as a true leader? Tired of performance reviews with praise — but no promotion?

With Jenny Radcliffe The human side of security: social engineering, behaviour and the disciplines that help explain why people make the decisions they do. A useful counterweight to technology-heavy cyber coverage.

With Nicole Dove A strong starting point for women’s experiences in security and privacy. Conversations with the Women in Security and Privacy community explore career journeys, achievements and lessons learned.

CLICK TO LISTEN I S S U E 32

CLICK TO LISTEN

CLICK TO LISTEN WOMEN IN SECURITY MAGAZINE

131

OFF THE SHELF

THIS IS HOW THEY TELL ME THE WORLD ENDS: THE CYBERWEAPONS ARMS RACE Author // Nicole Perlroth An investigation into the secretive market for software vulnerabilities and the global trade in cyberweapons. A compelling starting point for understanding how commercial incentives and government decisions have shaped today’s threats.

BUY THE BOOK

SECURING WHAT FEEDS US: CYBERSECURITY IN FOOD AND AGRICULTURE Authors // Kristin King The first book dedicated to cybersecurity threats facing the food and agriculture sector. Written by Kristin King, founder of AnzenSage, with over two decades spanning IT, OT/ICS, and cybersecurity, this book addresses insider sabotage, ransomware attacks on supply chains, and nation-state threats targeting production operations across farming, processing, transportation, and retail.

BUY THE BOOK

BROAD BAND: THE UNTOLD STORY OF THE WOMEN WHO MADE THE INTERNET Author // Claire L. Evans In fact, women turn up at the very beginning of every important wave in technology. They may have been hidden in plain sight, their inventions and contributions touching our lives in ways we don’t even realize, but they have always been part of the story.

BUY THE BOOK

CONFIDENT CYBER SECURITY: HOW TO GET STARTED IN CYBER SECURITY & FUTURE PROOF YOUR CAREER Author // Dr Jessica Barker This jargon-busting Amazon number one bestseller will give you a clear overview of the world of cyber security. Exploring everything from the human side to the technical and physical implications, this book takes you through the fundamentals.

BUY THE BOOK

132

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

ALICE AND BOB LEARN APPLICATION SECURITY Author // Tanya Janca Alice and Bob Learn Application Security is an accessible and thorough resource for anyone seeking to incorporate, from the beginning of the System Development Life Cycle, best security practices in software development. This book covers all the basic subjects such as threat modeling and security testing, but also dives deep into more complex and advanced topics for securing modern software systems and architectures.

BUY THE BOOK

CYBER SMART: PROTECT YOURSELF ONLINE Author // Madhuri Nandi Written by cybersecurity leader Madhuri Nandi, this fully updated second edition turns real online risks into short stories, simple rules and hands-on activities. Readers learn the Manas mindset: pause, question, check and choose before you click. Inside, young readers learn how to: Build strong passwords and keep their accounts safe; Spot scams, fake giveaways and free game coin tricks; Handle strangers, pressure and cyberbullying; Think before they post, share or tag; Tell real from fake in a world of AI videos and voices; Protect private pictures, personal information and their feelings; Fix things fast when something goes wrong. Every chapter ends with a Cyber Explorer Challenge to try with a parent or teacher. The book also includes a family tech agreement, a discussion guide for homes and classrooms, a glossary and an index.

BUY THE BOOK

THE INTERNET IS LIKE A PUDDLE Authors // Shona Innes and Irisz Anocs “The internet is like a puddle” uses the analogy of a puddle to explore both the fun and positive side of the internet but also to help children understand that there are often hidden risks below the surface. The book emphasises the importance of adults helping children to keep safe but also encourages children to listen to their gut instinct when something doesn’t feel right or safe online.

BUY THE BOOK

GIRLS WHO CODE Author // Stacia Deutsch | Foreword by // Reshma Saujani Loops, variables, input/output – Lucy can’t wait to get started with the new coding club at school. Finally, an after school activity that she’s really interested in. But Lucy’s excitement turns to disappointment when she’s put into a work group with girls she barely knows. All she wanted to do was make an app that she believes will help someone very special to her.

BUY THE BOOK

I S S U E 32

WOMEN IN SECURITY MAGAZINE

133

OFF THE SHELF

THE ADVENTURES OF SNACKER THE HACKER: AN INTRODUCTION TO TECHNOLOGY AND CYBER SECURITY FOR CHILDREN Authors // Lyron Foster and Lauren Foster This book is an action-packed adventure that takes readers on a journey through the world of technology and crime-solving. The story follows Alexis, a young girl hacker with a love for Japanese snacks, and her best friend Tania as they navigate the challenging world of cybercrime in their hometown of Hilo, Hawaii.

BUY THE BOOK

UNPLUGGED NINJA: A CHILDREN'S BOOK ABOUT TECHNOLOGY, SCREEN TIME, AND FINDING BALANCE (NINJA LIFE HACKS) Author // Mary Nhin The new children's book series, Ninja Life Hacks, was developed to help children learn valuable life skills. Fun, pint-size characters in comedic books easy enough for young readers, yet witty enough for adults.

BUY THE BOOK

THE TECHNOLOGY TAIL: A DIGITAL FOOTPRINT STORY Authors // Julia Cook and Anita DuFalla A cute, creative story about children and their texts, tweets, posts and pics. Don’t be mean and irresponsible! That’s the straight-to-the-point advice “Screen” has for young readers who are active on social media.

BUY THE BOOK

A SMART GIRL'S GUIDE: DIGITAL WORLD Author // Carrie Anton Digital devices put a whole world at your fingertips. Play a game, listen to music, do research for school, read a story, or make a video -- anywhere, anytime. Connect with friends and family in fast and easy ways. Post photos and share ideas and inspiration. And that's only a small part of it.

BUY THE BOOK

134

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

THE LEARNING HUB CYBERSECURITY ESSENTIALS This Cybersecurity Essentials course prepares you for the entry-level Cisco Certified Support Technician (CCST) Cybersecurity certification and entry-level cybersecurity positions such as Cybersecurity Technician, Junior Cybersecurity Analyst, or Tier 1 Help Desk Support roles.

VISIT HERE

INTRODUCTION TO CYBER SECURITY: STAY SAFE ONLINE This free online course, Introduction to cyber security: stay safe online, will help you to understand online security and start to protect your digital life, whether at home or work. You will learn how to recognise the threats that could harm you online and the steps you can take to reduce the chances that they will happen to you.

VISIT HERE

IT MASTERS INTRODUCTION TO COMPTIA SECAI+ IT Masters mentor and cyber security professional Georg Thomas presents an Introduction to CompTIA Security AI+. This recently launched certification is an extension of Security+ and examines the intersection between cyber security and AI.

VISIT HERE

BUILD WITH AI: REAL-WORLD PROJECTS FOR CAREER-READY SKILLS IBM SkillsBuild invites you to Build With AI: Real-World Projects for Career-Ready Skills, a series of hands-on sessions where you'll build real, practical AI projects step by step, no experience required. Pick one session or join them all. Participate in at least one event and become eligible for an exclusive career talk with IBM experts.

VISIT HERE

I S S U E 32

WOMEN IN SECURITY MAGAZINE

135

THE LEARNING HUB CS406: INFORMATION SECURITY The first network was invented in the late 1960s with the birth of ARPAnet, a project launched by the US Department of Defense. That network advanced into what is now known as the Internet and has grown into a global phenomenon to become an integral part of our daily lives.

VISIT HERE

FOUNDATIONS OF CYBERSECURITY This is the first course in the Google Cybersecurity Certificate. In this course, learners will be introduced to the cybersecurity profession, including the primary job responsibilities and core skills of entrylevel analysts; significant events that led to the development of the cybersecurity field; and security’s continued importance to organizational operations.

VISIT HERE

NETWORK SECURITY SUPPORT ENGINEER In this course, you will learn how to diagnose and troubleshoot the most common networking and security problems in a FortiGate network security solution.

VISIT HERE

REAL-TIME CYBER THREAT DETECTION AND MITIGATION This course introduces real-time cyber security techniques and methods in the context of the TCP/IP protocol suites. Explanation of some basic TCP/IP security hacks is used to introduce the need for network security solutions such as stateless and stateful firewalls. Learners will be introduced to the techniques used to design and configure firewall solutions such as packet filters and proxies to protect enterprise assets.

VISIT HERE

136

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

FEATURING FREE SECURITY TRAINING RESOURCES THAT ARE AIMED AT INCREASING SECURITY AWARENESS AND HELPING PEOPLE BUILD AND UPSKILL THEIR SECURITY SKILLS.

CYBERSECURITY AND ITS TEN DOMAINS This course is designed to introduce students, working professionals and the community to the exciting field of cybersecurity. Throughout the MOOC, participants will engage in community discourse and online interaction. Participants will gain knowledge and understanding of cybersecurity and its domains.

VISIT HERE

SECURITY & ETHICAL HACKING: ATTACKING THE NETWORK This course explains the science and art behind offensive security techniques used in penetration testing of networks and systems. A review of networking concepts is given. Students will utilize low-level programming through network interfaces, in executing a variety of network attacks, while learning to use essential auxiliary tooling for both recon and active attacks. An introduction to cryptogpahy for pentesters is provided.

VISIT HERE

CYBERSECURITY AND INTERNAL THREATS With today's technological boom, it's important to know how you can protect yourself against cyberattacks and insider threats. This course will teach you the concepts of cybersecurity, cyberattacks, insider threats, and some preventive measures to help you stay protected.

VISIT HERE

CLOUD SECURITY BASICS This course introduces you to cybersecurity for the cloud. We'll learn and apply classic security techniques to today’s cloud security problems.

VISIT HERE

I S S U E 32

WOMEN IN SECURITY MAGAZINE

137

J O B B OA R D SENIOR CYBERSECURITY INCIDENT COORDINATOR | MICROSOFT FULL TIME

AUSTRALIA

RESPONSIBILITIES As a Senior Cybersecurity Incident Coordinator, you will independently coordinate customer engagements and concurrent operational workstreams, keep stakeholders aligned, and enable technical specialists to deliver effective response outcomes. OPERATIONAL MANAGEMENT • Coordinate intake and pre-engagement scoping with customers and technical leads: clarify needs, desired outcomes, dependencies, resource requirements and delivery timelines.

• Manage engagement staffing and capacity, including special-event support, matching available skills to demand and escalating resource gaps or conflicting priorities. • Maintain escalation pathways, direct issues to the appropriate delivery teams, track progress and promptly raise urgent, sensitive or unresolved matters to leadership.

APPLY HERE

CHIEF INFORMATION SECURITY OFFICER | SATISPAY FULL TIME

ITALY

WHAT YOU'LL BE DOING As our Chief Information Security Officer (CISO), you’ll play a key role in defining and leading the overarching information security and data protection strategy for our financial platform. This is an opportunity to lead within a high-growth, constantly evolving environment,

a challenge perfectly suited for an executive ready to navigate and shape change at scale and contribute to something bigger.

APPLY HERE

CYBER LEADER – DIRECTOR | DELOITTE FULL TIME

NEW ZEALAND

IN THIS ROLE, YOU WILL: • Build and nurture relationships with key stakeholders in client organisations • Identify and convert new opportunities to support clients achieving their business outcomes through applying effective cyber expertise • Lead and deliver cyber engagements from shaping through to implementation • Take accountability for programme outcomes, timelines, and budgets • Contribute the growth and direction of Deloitte’s national Cyber practice including bringing new cyber services and offerings into delivery with clients

138

W O M E N I N S E C U R I T Y M A G A Z I N E

• Apply strong commercial acumen to contribute to running of the practice effectively and profitably • Work closely with our Technology & Transformation leaders to deliver integrated outcomes • Support and develop high‑performing delivery teams across the Cyber practice

APPLY HERE

N O V E M B E R • D E C E M B E R 2026

SECURITY LEAD | LEIDOS AUSTRALIA FULL TIME

AUSTRALIA

THE OPPORTUNITY In this role, you will provide security leadership across the design, delivery and operation of complex systems. You will integrate security considerations into engineering decisions, coordinate assurance activities and help teams understand and manage security risk throughout the system lifecycle. • Develop and maintain security plans, risk assessments, control requirements and assurance evidence. • Advise architects, engineers and project leaders on secure design, implementation and operational practices.

• Coordinate vulnerability, compliance and security review activities, ensuring findings are prioritised and addressed. • Engage customers, technical authorities and governance forums to communicate security posture, risks and remediation progress.

APPLY HERE

CYBERSECURITY SENIOR CONSULTANT | EY FULL TIME

INDONESIA

SKILLS AND ATTRIBUTES FOR SUCCESS: • Outstanding team player • High level of motivation • Strong work ethic • Self-starting attitude • Independent and able to manage and prioritize workload • Ability to quickly and positively adapt to change • Excellent written and verbal communication, presentation, client service, and technical writing skills, coupled with excellent executive presence.

• Significant experience in managing and delivering medium to large teams on complex programs and projects. • Assessing, designing, architecting, and developing solutions leveraging the latest technologies and trends to exceed the business requirements

APPLY HERE

IT SECURITY ANALYST | APPEN FULL TIME

INDIA

YOUR IMPACT • SOC & Alert Management: Monitor, triage and resolve alerts in Microsoft Defender XDR and Sentinel; tune detections to reduce false positives and improve response times. • Incident Response: Lead incidents end-to-end (containment, eradication, recovery, lessons learned); maintain the Incident Response Plan and playbooks. • ISO 27001: Maintain ISMS policies, risk register and audit evidence; support internal and external audits and close findings.

I S S U E 32

• IAM & Access Reviews: Administer Entra ID (Conditional Access, MFA); run quarterly user and privileged access reviews and enforce least privilege.

APPLY HERE

WOMEN IN SECURITY MAGAZINE

139

J O B B OA R D SENIOR THREAT ANALYST | NEW YORK CITY OFFICE OF TECHNOLOGY & INNOVATION FULL TIME

USA

RESPONSIBILITIES WILL INCLUDE: • Perform many critical functions within the Threat Management discipline including staffing 24x7x365 coverage at the Citys Security Operations Center (SOC) augmenting FTE shift schedules including days, nights, weekends, and holidays. • Interface with OTI Cyber Command teams internally, with City agencies, vendors, and informationsharing partners. • Monitor City networks and security alerts for intrusion, attempted compromise, and anomalous behavior;

• Apply mitigation techniques or escalation factors; correlate threat intelligence across various logs collected by established security controls. • Produce routine SOC metrics & reporting. • Maintain situation reports (SITREPS) Perform weekly quality control checks. • Work closely with SOC Director on incident preparation including the continuous development of new SOC playbooks and runbooks • Handle special projects and initiatives as assigned.

APPLY HERE

CYBERSECURITY ENGINEER | XANADU FULL TIME

CANADA

minded builder who enjoys working across the entire stack—from hardening infrastructure and automating As part of the newly formed cybersecurity team you will bridge the gap between our high-level cybersecurity workflows to developing internal tools that keep our innovation secure. strategy and daily technical operations. You will work at the intersection of our IT infrastructure and our core R&D teams to ensure our intellectual property is protected without slowing down innovation. This APPLY HERE is a "wear-many-hats" role perfect for a securityYOUR ROLE AND RESPONSIBILITIES:

HEAD OF IT EDP SOFTWARE ENGINEERING SERVICES | BOEHRINGER INGELHEIM FULL TIME

PHILIPPINES

DUTIES & RESPONSIBILITIES: • Global Support Oversight: Manage 2nd level support for core platform components such us but not limited to: CI/CD Jenkins, GitHub, Atlassian, Datahub, Snowflake, Databricks, Collibra, Power BI, Tableau, Software Development and AI platforms…, ensuring timely and effective issue resolution across the Americas, EU, and APAC regions • Training & Development: Collaborate with platform product teams to design and deliver impactful training programs that enhance user skills and platform adoption

140

W O M E N I N S E C U R I T Y M A G A Z I N E

• Stakeholder Collaboration: Build strong relationships and feedback loops with platform product teams and implementation partners to continuously improve our services • Team Leadership: Inspire, coach, and develop a diverse team, guiding individuals in their career progression and fostering a collaborative, highperformance culture

APPLY HERE

N O V E M B E R • D E C E M B E R 2026

IT B2B DIRECTOR | THE RECRUITER FULL TIME

FRANCE

PROFILE You have led technology organisations in B2B, commerce or enterprise platform environments, with proven experience in delivery, run, and integration into a complex ecosystem. YOU BRING: • Senior technology leadership experience, including managing complex delivery portfolios (replatforming, multi-stream) and business-critical operations. • Proven ease operating and communicating at ExecBoard level, with Commercial, Sales and Finance stakeholders.

• Experience developing managers and supporting teams through change. • Experience in budget management at scale and vendor relationship management. • A solid understanding of AI and how it integrates into delivery practices. • Fluent English required; French is a strong asset.

APPLY HERE

HEAD OF TECHNOLOGY OPERATIONS | WEAVER FINTECH LTD FULL TIME

SOUTH AFRICA

• Disaster recovery capability and infrastructure incident management • The stability and resilience of our on-premises server • A growing TechOps team (SecOps Manager, Network/ and network infrastructure Server engineer, EUC technicians) • Security operations — access management, endpoint • The AI and automation agenda within TechOps — security, threat response, and compliance identifying and implementing smarter ways to operate • The IT Service Desk and End User Computing function — including SLAs, standards, and team performance • IT governance, vendor management, and APPLY HERE audit relationships WHAT YOU'LL OWN

CHIEF INFORMATION OFFICER | NETWORK INTERNATIONAL FULL TIME

NIGERIA

KEY RESPONSIBILITIES: Ownership & Accountability • Be the Senior IT Manager in West Africa, be part of the Management Team and represent the wider Global IT Team in West Africa. • Lead and direct the IT Team in West Africa. • Lead IT delivery projects and programs, including the design and deployment of new IT systems and services in West Africa. • Ensure all SLAs and KPIs are met by the IT Team related to the IT Services we offer to our Clients 24X7. • Lead the Service Delivery Team in West Africa and act as an escalation point for Incident and Problem management activities.

I S S U E 32

• Manage all of the IT Assets in West Africa to ensure optimum return on investment including availability, quality, performance, capacity management, etc. • Monitor performance of information technology systems to determine cost and productivity levels, and to make recommendations for improving the IT infrastructure.

APPLY HERE

WOMEN IN SECURITY MAGAZINE

141

EMAIL FOR A QUOTE TODAY JANE@SOURCE2CREATE.COM.AU

1 SEPTEMBER 2026

#2026WISAWARDS

BEST VOLUNTEER / MENTOR Proudly Sponsored by

Winner

Highly Commended

Special Recognition

Roma Singh

Keryn McMartin

Jeanine French

IdentityXP

AWSN

FINALISTS

NOMINEES

Roma Singh

Jeanine French

az (es)

Ravneet Kaur

Leanne Ngo

Community Ambassador at AWSN

Security Change and Adoption Lead at BUPA

Kersti Eesmaa

Sanja Petrovic

Subi Shrestha

Renee Noble

Leanne Swan

Dr Farina Riaz

Bahar Fardaran

StephanieSoo

CEO at Tech Inclusion

Cyber Trust and Safety Lead at City of Gold Coast

Anita Williams

Pranali Mandewalkar

Pooja Tyagi

Bianca Edgar Partner Marketing Director APJ at Darktrace

Leanne Ngo Associate Professor at La Trobe University

Beth Dwyer Senior Information Security Consultant at MYOB

Kersti Eesmaa COO of Vertical Scope Group

Biljana Roksandic

Leana El-Hourani

Cyber GRC officer at Synergy

Head of Information Security & GRC at Mission Australia

Dr Farina Riaz Rearch Fellow at CSIRO

Keryn McMartin Identity Consultant at IdentityXP

144

BUPA

Sanja Petrovic General Manager, Cyber Security and Data Governance at HUB24

Jeanine French

Leanne Swan

Biljana Roksandic

Srishti Khemani

Roma Singh

Stephanie Gray

Paula Sillars

Yasaman Samadi

Parisa Shojaei

Marie Chandler

Keryn McMartin

Mandy Ho

Sahar Zare

Leana ElHourani

Bianca Edgar

Bimal Jeet Kaur Jalpah Desai Alaina Lawson Linda-Clare Chilvers Marina Azar Toailoa

Mahima Kopparam Kathryn Jepsen

Yasaman Samadi

Jeannette Ngau

PhD Candidate and Researcher at RMIT University

Ammie Cauldwell

Marlena Dudek

Beth Dwyer

Sarah Kenyon

W O M E N I N S E C U R I T Y M A G A Z I N E

Claudine Beltrami

Renee Noble

Gabriela Guiu Sorsa Kate Baker

Natalie Hingco Perez Anoushka Pandey Women in Cybersecurity Australia Affiliate

N O V E M B E R • D E C E M B E R 2026

ROMA SINGH: MAKING SPACE FOR OTHERS IN CYBERSECURITY The first step into cybersecurity can be a strange one. For people changing careers, returning to work, arriving in Australia with experience from elsewhere, or simply trying to work out where they fit, the industry can seem like it has its own language and its own rules. There are qualifications to understand, acronyms everywhere, job ads asking for experience, and rooms full of people who appear to already know one another.

That is often where Roma Singh steps in. As

It is high-pressure work, often invisible when it is

Community Ambassador with the Australian

done well. The job involves looking ahead, dealing

Women in Security Network, Roma is known across

with uncertainty and helping people make decisions

the sector not only for her senior cybersecurity

before a problem becomes an incident. Roma is

experience, but for the way she makes herself

trusted to take technical cyber risks and make them

available to others. A quick conversation at an

meaningful to executives and boards, without losing

event can turn into a CV review. A question about a

sight of what is actually at stake.

certification can become months of encouragement. Someone who arrived convinced they did not belong

But she has never seen cybersecurity as a job that

in cybersecurity may leave feeling they have a real

belongs only to specialists. Outside her formal role,

shot at it.

Roma gives substantial time to AWSN, the Tangible Uplift Program, BSides, ISACA Global, Girls in Tech

Roma has spent her career working across banking,

and youth cybersecurity initiatives. She volunteers

consulting, telecommunications, government,

at events, supports workshops, helps coordinate

aged care and disability services. She now leads

community programs and mentors people at

cybersecurity strategy across a major transport

different stages of their careers.

portfolio, where the work ranges from information security governance and operational technology

There is no grand performance to it. Often, it

protection to supplier security, risk frameworks and

is simply Roma being there. She is there when

executive advice.

someone needs to understand how to prepare for

I S S U E 32

WOMEN IN SECURITY MAGAZINE

145

a CISM certification. She is there when a career

People can be highly capable and still feel they

changer needs help explaining why their previous

are not technical enough, experienced enough or

experience counts. She is there when a young

connected enough. They may have been told, directly

woman is attending an industry event for the first

or indirectly, that the industry is not for them. Roma

time and is unsure where to stand, who to speak with

has a way of challenging that thinking without

or whether anyone will take her seriously.

making it feel like a lecture. She listens to where people are stuck, helps them work out a next step,

Roma mentors women and non-binary people from

and then encourages them to take it.

a wide range of backgrounds, including students, migrants, career changers and early-career

Her mentoring is not transactional. There is no neat

professionals. Her guidance includes the practical

finish line where the meeting ends and the support

pieces, CVs, interviews, networking, certifications and

disappears. Roma follows up. She remembers what

job applications, but it is rarely limited to that.

someone was working towards. She encourages them after setbacks. She asks whether they applied

The harder part of entering cybersecurity is

for the role.

often confidence.

146

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

That kind of support has helped many people

These are not necessarily future cybersecurity

secure cybersecurity positions, pursue professional

professionals yet. Some are simply young people

qualifications, build their networks and become

trying something new. But they get to see that

active in the wider community. Her contribution has

cybersecurity can be hands-on, creative and relevant

been recognised through AWSN’s Mentor of the Year

to the real world. They learn about online safety

recognition, though it is clear she is not doing the

and problem-solving. More importantly, they meet

work for the title.

someone who makes the field feel possible.

Cybersecurity professional Ryan Fox described the

That visibility matters. A young woman may not

impact of Roma and the Tangible Uplift Program

remember every technical detail from a Capture

while he was studying for CISM. “I couldn’t be more

the Flag challenge, but she may remember meeting

thankful to you and the team; you all have truly been

a woman who works in cybersecurity and speaks

blessed while I’ve been studying for CISM—thank you

about it like there is room for her there too.

to yourself and the Tangible Uplift Program team,” he said.

Roma’s impact is not confined to mentoring. Through AWSN, the Australian Computer Society,

Roma’s connection to the Tangible Uplift Program

the Department of Home Affairs pilot project and

has been substantial. As Volunteer Program Director

Box Hill TAFE’s Industry Reference Group, she has

and Mentor, she led a team of nine women delivering

contributed to conversations about career pathways,

learning sessions on information risk management.

professional standards, education and inclusion.

She also took care of much of the work that keeps a program visible and connected: LinkedIn, newsletters,

She understands that encouraging people into

the website, campaigns and panels with senior

cybersecurity is only part of the job. There needs to

industry leaders.

be a path when they arrive.

The program gives women practical exposure

The women and non-binary professionals Roma

to cybersecurity leadership, risk management

mentors often go on to support others. The students

and professional development. But it also gives

she meets learn enough to talk to friends and family

them something less tangible: a community that

about online safety. The communities she volunteers

understands why the work can feel difficult at times.

with become more welcoming because someone has taken the time to make them so.

Nivedita Newar, Deputy CISO and founder of the Tangible Uplift Program, said Roma’s leadership has

That is the quiet strength of her work.

been felt over many years. “We are so grateful to

It keeps moving.

have you by our side. I have been learning so many leadership qualities from you over the years. So proud to call you a dear friend.” Roma also spends time with people who are much earlier in their journey. At Amazon Girls’ Tech Day Melbourne, she has run Capture the Flag activities for high school, TAFE and university students. She has volunteered at Girls in Tech events and supported

Roma Singh is making cybersecurity more accessible, not through slogans or polished promises, but through time, attention and the simple act of showing up for people.

students through cyber boot camps.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

147

KERYN MCMARTIN: KEEPING THE DOOR OPEN For Keryn McMartin, cybersecurity is not only about technology. It is about people: who gets access, who feels they belong, and who is given the confidence to take the next step.

Named the 2026 highly commended Best Volunteer/

The impact has been immediate and personal.

Mentor, Keryn is an Identity and Access Management

People have formed friendships, found mentors,

specialist at Identity XP, where she works across

secured jobs and stepped into volunteering after

project engineering and managed services. She

becoming part of the community. Keryn has also

helped establish and mature the organisation’s IAM

worked to ensure the chapter feels genuinely

managed services offering, creating processes and

inclusive. As a frequently solo parent herself, she

documentation while helping newer team members

understands that family responsibilities can make

develop their skills.

traditional networking difficult. Her approach makes space for people whose careers or lives do not fit the

Her technical capability is substantial. Keryn holds

usual mould.

three SANS certifications, earned through the Women in Cybersecurity Security Training Scholarship. Yet it

Keryn currently mentors around five women through

is the way she shares what she knows that has made

the WiCyS mentoring program and supports several

such a mark on the people around her.

others informally. Her mentees come to her for earlycareer guidance, confidence-building, networking and

As the inaugural Sunshine Coast Chapter Lead for the

help identifying opportunities such as scholarships.

Australian Women in Security Network, Keryn helped build a regional cybersecurity community from the

One career-changing mother she has mentored

ground up. For many people working remotely or

has gone on to pursue opportunities she had not

outside capital cities, professional connections can

previously considered and has been awarded

be hard to come by. AWSN Sunshine Coast now

multiple scholarships. Keryn helped her build

gives women in security a place to meet, learn,

foundational knowledge, widen her network and

network and find support.

see a future in cybersecurity that had once felt out of reach.

148

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

This is what distinguishes Keryn’s mentoring. She

creativity and observation can strengthen security

does not simply offer advice and step back. She

practice. Keryn also volunteers through WiCyS

makes introductions, shares opportunities, checks in

Capture the Flag mentoring, CrikeyCon and AWSN

regularly and helps people feel capable before they

national working groups, and contributes as a

fully believe it themselves.

speaker and panellist across industry forums.

Her own career path informs that approach. With a background in art and education, Keryn brings a user-centred and creative lens to cybersecurity. She sees previous careers not as something people need to overcome, but as strengths they can bring into the sector. Communication, observation, empathy and divergent thinking all have a place in security. That idea will sit at the heart of her upcoming

Keryn says she would not be in cybersecurity without the people who opened doors for her. Through her work, she is making sure those doors remain open for others.

CyberCon 2026 workshop, which explores how

I S S U E 32

WOMEN IN SECURITY MAGAZINE

149

JEANINE FRENCH: THE CONNECTOR BUILDING CYBERSECURITY COMMUNITY For Jeanine French, cybersecurity has always been about more than technology. It is about whether people understand it, trust it and feel they have a place in the profession.

As Security Change and Adoption Lead within

for people at very different stages of their careers

Bupa’s CISO function, Jeanine works at the point

to connect.

where technical security programs meet the people expected to use them. Her job is to turn

It is not just networking for networking’s sake. For a

complex initiatives into something practical: clear

student trying to break into cyber, a career changer

communications, training, awareness campaigns

wondering whether their experience counts, or

and engagement that helps security become part of

someone returning to work after a setback, one

everyday work rather than another policy people are

useful conversation can change the direction of

asked to read.

a career.

That ability to bring people with her has shaped

Jeanine understands that instinctively.

Jeanine’s volunteer work too. Over the past three years, she has directly mentored

150

As Melbourne Chapter Lead for the Australian

or coached around 30 women through career

Women in Security Network, she gives a considerable

transitions, certification journeys, leadership

amount of time to building a professional community

opportunities and professional development. She has

where women and underrepresented people can

reviewed CVs, helped people prepare for interviews,

meet, learn and find their feet. She coordinates

made introductions and encouraged women to

events, works with volunteers, engages sponsors

put themselves forward for roles or speaking

and partner organisations, and creates opportunities

opportunities they may have dismissed too quickly.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

One woman Jeanine supported after a redundancy had begun to question whether she had enough experience to remain in cybersecurity. Jeanine helped her identify the value of her transferable skills, supported her through her CISM journey and connected her with professional opportunities. She went on to secure a new cybersecurity role and has continued to build her career. That sort of support often happens quietly. A coffee, a LinkedIn message, an introduction to a hiring manager or mentor. But it matters. Jeanine is also a natural collaborator. She helped bring Bupa, AWSN, AISA, ISACA, ISC2 and ACS together for a large International Women’s Day cybersecurity event, which attracted 178 people in person and reached further through online participation. It created space for mentoring, professional development and conversations between people who might otherwise never have met. Within Bupa, Jeanine has actively championed Women in Security Excellence (WISE), helping create greater visibility, connection and opportunities for women working across cybersecurity and technology. She has also contributed to the ongoing development of the Security Influence and Trust (SIT) community, supporting opportunities for collaboration, knowledge sharing and connection across the security profession. Her broader work reflects her passion for making cybersecurity more human, engaging and accessible, using creativity, connection and meaningful conversations to inspire positive security behaviours and build a stronger security culture. Her plans are simple, even if the work is not. Jeanine wants to keep growing AWSN Melbourne, deepen mentoring opportunities and support more women into leadership. She is especially committed to students, career changers and emerging professionals who may not yet have the networks or

For Jeanine, success is not really measured by the number of events on a calendar. It is measured by what happens afterwards: someone feeling less alone, applying for the role, meeting the mentor, or realising they belong in cybersecurity after all.

confidence to open doors for themselves.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

151

THE ONE TO WATCH IN PROTECTIVE SECURITY Proudly Sponsored by

Winner

Highly Commended

Danielle Hinchliffe

Pranali Mandewalkar

NAB

METRO SOUTH HEALTH

FINALISTS

NOMINEES

Pranali Mandewalkar

Richa Sharma

Nelda Johannesen

Senior Information Security Officer from Metro South Health

Rafana Fatima

Elakiya Devi Kishok Kumar

Consultant Physical Security Operations from NAB

Pranali Mandewalkar

Nelda Johannesen

Rebecca Amore

Danielle Hinchliffe

Senior Manager Personnel Security at NBN

Rafana Fatima

Rhiana Cooke Danielle Hinchliffe

Yulyn Foo

Cloud Security Specialist at Grant Thornton

Yulyn Foo Principal Advisor, Protective Security at Queensland Health

I S S U E 32

WOMEN IN SECURITY MAGAZINE

153

DANIELLE HINCHLIFFE: TURNING INCIDENTS INTO INTELLIGENCE Customer aggression has become one of the most difficult risks facing Australia’s frontline workers. It can begin with frustration, escalate quickly and leave branch staff dealing with threats, abuse or violence that no one should have to accept as part of their job.

Danielle Hinchliffe saw that the information collected

Technology, Governance, Assurance and the

after these incidents had more value than it was

Physical Security Operations Centre to create a more

being given.

consistent national view of customer aggression.

As a Consultant in Physical Security Operations at

That meant agreeing on a shared language

National Australia Bank, Danielle has helped change

for severity, escalation and response. It meant

the way Aggressive Customer Incident data is

reducing duplication and building a trusted source

understood and used. What had often been treated

of information that leaders could use to make

as routine incident reporting is now being shaped

decisions.

into practical risk intelligence: information that can identify trends, hotspots, repeat offenders and

The work has not stayed within NAB.

emerging triggers before another colleague is put in harm’s way.

Through the Australian Banking Association, Danielle has helped drive a broader conversation around the

It is a major piece of work, particularly this early in

use of Aggressive Customer Incident data across the

her career.

banking sector. Her focus is on establishing common severity definitions, incident triggers and governance

Inside NAB, Danielle recognised that incident data

arrangements that could allow major banks to better

was fragmented. Reports sat across different

understand emerging threats and act earlier.

systems and teams, inconsistencies made it difficult

154

to identify patterns, and responsibility was spread

The ambition is straightforward, although achieving

across several functions. She brought together

it is anything but: when organisations measure

colleagues from Retail, Health and Safety, Property,

aggression in the same way, they can recognise

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

risks sooner and respond with greater consistency.

She is contributing to a two-stream de-escalation

A threat identified in one setting may help protect

training model, with a national baseline for all

workers somewhere else.

relevant staff and more targeted support for higherrisk sites. It is a practical response to a complex

For Danielle, this is also about getting the balance

problem, grounded in the reality of frontline work.

right. Customer aggression data is sensitive, particularly where the safety and privacy of

Looking ahead, Danielle’s vision reaches beyond a

employees are concerned. She has advocated for de-

single bank. She wants to see a shared operating

identified operational data that offers useful insights

model for customer aggression across Australian

without exposing colleagues. It is careful work,

banking and the wider retail sector, one that enables

requiring sound judgement and the ability to bring

earlier warning, better intelligence sharing and

people together around an issue where systems,

coordinated action.

priorities and risk appetites differ. Danielle is also helping shift protective security from reacting after an incident to preventing harm where possible. Her approach connects physical security with data, digital systems, CCTV, access information, incident-management platforms and workflow design. The result is a clearer picture of what is

At a time when the protective security profession is becoming more data-led and interconnected, Danielle is already helping define what that future could look like.

happening across a large national network.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

155

PRANALI MANDEWALKAR: SECURITY WITH PEOPLE AT THE CENTRE In a hospital, security cannot sit off to the side.

It has to work alongside clinical care, busy

are not disrupted. Pranali’s strength is in bringing

emergency departments, legacy systems, round-the-

clarity to that complexity. She takes detailed

clock services and people whose focus is rightly on

technical findings and turns them into practical

patients. For Pranali Mandewalkar, that is exactly

remediation plans, with clear ownership, priorities

what makes the work matter.

and follow-up.

As a Senior Information Security Officer at Metro

Her work has helped strengthen the end-to-end flow

South Health, Pranali works in vulnerability

of vulnerability and penetration-testing outcomes

management across one of Queensland’s most

across Metro South Health. Rather than treating

complex health environments. Her role involves

testing as a one-off exercise, she has focused on

identifying high-risk applications and systems,

the harder part: tracking issues through to closure,

coordinating penetration testing, and working with

keeping stakeholders accountable and ensuring risks

technical teams, vendors and system owners to

are visible to the people responsible for decisions.

make sure serious findings do not simply sit in a report waiting for attention.

She has also helped develop dashboards that give leadership a clearer view of the organisation’s

It sounds straightforward on paper. In practice, it

security posture and remediation progress. In a large,

rarely is.

dispersed health network, that visibility matters. It enables leaders to focus resources on the risks

Health services run on large technology estates,

with the greatest potential impact, rather than being

with tightly connected applications and limited

overwhelmed by the sheer volume of security data.

opportunities to take systems offline. A vulnerability

156

may be urgent, but resolving it can require careful

Pranali’s approach is practical rather than

planning so that patient care and critical operations

prescriptive. She understands that security needs to

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

fit the reality of clinical work. A process that might work neatly in a corporate office may be unhelpful in an emergency department, where speed, accessibility and patient safety are non-negotiable. So she frames security in terms that resonate: protecting patients, supporting continuity of care and making it easier for staff to do the right thing. It is an approach that has helped build trust with clinical, technical and administrative teams alike. Her influence reaches beyond the day job. Pranali has volunteered extensively across the security community, including as a former Brisbane Chapter Lead for the Australian Women in Security Network. Through AWSN, she helped create a local space where women across the profession could meet, learn and build connections. She has also contributed as a Case Manager for the National Missing Persons Hackathon, applying her analytical skills and security mindset to work with a deeply human purpose. Her involvement with the Tangible Uplift Program reflects the same belief: improving Australia’s security posture is not only about systems and controls. It is about giving people the capability and confidence to contribute. With certifications including ISC2 Certified in Cybersecurity, SSCP and CISM, Pranali is continuing to build her technical and leadership foundation. Her goal is to help organisations make vulnerability and risk management more proactive, data-led and grounded in operational reality.

For a profession often measured in frameworks and controls, Pranali brings something equally valuable: the ability to make security work for the people who rely on it.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

157

158

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

BEST SECURE CODER Proudly Sponsored by

Winner

Special Recognition

Sathvika Venkatesh

Yan Liu

SportsBet

Retrospect Labs

FINALISTS

NOMINEES

Sathvika Venkatesh Cyber Security Engineer at SportsBet

Yan Liu Principal Software Engineer at Retrospect Labs

Gurmeen Kaur Software Engineer at Telstra

Yan Liu

Gurmeen Kaur

Lana Belakhov

Tatyana Stojnic

Sonal Agrawal

Anjelica Juturu

Sathvika Venkatesh

Fiona Akhounova Katrina Steen

Anjelica Juturu Specialist Lead Manager at Deloitte

Lana Belakhov Principal Consultant at CyberCX

I S S U E 32

WOMEN IN SECURITY MAGAZINE

159

SATHVIKA VENKATESH: WRITING SECURITY INTO THE WORKFLOW Good secure coding is often invisible when it is working properly.

A security analyst gets the information they need

together security signals from tools including

without jumping between six different systems. A

CrowdStrike, AWS, Microsoft 365, Palo Alto,

developer is stopped from adding a risky domain

Netskope and Tenable into a more consistent

before it reaches production. An incident is

incident workflow.

created, prioritised and tracked without someone having to manually copy details from one platform

Rather than relying on a standard vendor

into another.

integration that did not suit the organisation’s needs, Sathvika designed a custom PagerDuty and

For Sathvika Venkatesh, a Cyber Security Engineer

ServiceNow connection. The result was controlled

at Sportsbet, that is the point. Her work is about

synchronisation between the platforms, automatic

building security into the systems people already use,

incident creation and a clearer process for escalation

so the safer option becomes the easier one.

and tracking. Critical alerts are less likely to be lost in the handover between systems, while teams have a

Sathvika’s contribution has been felt across incident

stronger audit trail of what occurred and when.

response, cloud security, threat intelligence and developer workflows. She is a hands-on engineer,

She also helped create SecOps Bot, a security

but also someone who thinks about what happens

automation platform built on AWS serverless

after the code is written: who needs to use it, how

technology. It gives analysts quicker access to threat

it will scale, whether it can be audited and whether

intelligence, identity, endpoint and authentication

it makes security feel like an enabler rather than

information through a single controlled interface.

another roadblock. The security design is deliberate. The bot is

160

One of her major projects has been the SecOps

restricted to approved Slack workspaces and

PagerDuty incident response platform. It brings

channels, integrations are read-only, authorisation

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

checks happen before requests are processed, and credentials are securely managed through AWS Secrets Manager. It is a useful example of secure coding done properly: functionality without unnecessary access or hidden risk. Sathvika has also developed an AI-powered threat intelligence platform aligned to the NIST Cybersecurity Framework 2.0. The platform ingests information from external sources, processes lengthy reports and creates concise, actionable summaries for the Security Operations team. It reduces the manual work involved in reviewing threat intelligence and helps emerging risks become part of defensive activity sooner. Her work on AWS egress allowlisting has brought zero-trust thinking to outbound network traffic. Automated controls validate requested domains, look for unusual changes and conduct reputation checks against VirusTotal before approval. That helps prevent malicious or incorrectly configured destinations from entering production, without turning every request into a lengthy manual process. She has also played a key role in cloud and AI security, including the security RBAC design and rollout of Wiz across AWS, Azure, GCP, Okta, Microsoft 365 and Jira. More than 15 data sources have been brought into the SIEM pipeline through her work, improving visibility and detection capability. What sets Sathvika apart is that she does not keep the knowledge to herself. She writes guides, infrastructure patterns and integration templates so other engineers can build securely alongside her.

Her code solves today’s security problems. More importantly, it leaves the organisation better equipped for the next ones.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

161

YAN LIU: ENGINEERING TRUST WHERE IT MATTERS MOST When people take part in a cyber exercise, they need space to practise the moments they hope never happen. They share decisions, evidence, responses and lessons across teams, sectors, and organisations. Behind that work is a simple expectation: the platform must protect the information trusted to it.

Yan Liu is a Principal Software Engineer and Head

implemented patterns for object-level permissions

of Product at Retrospect Labs. Her work centres on

across deeply nested exercise data. These controls

Gauntlet, Retrospect Labs’ cyber security exercise

ensure people see only the information they are

platform. Security shapes every decision she makes,

meant to see, even in complex scenarios with many

and she has embedded secure coding into how

teams, roles, and access paths.

Gauntlet is designed, reviewed, tested, and released. That kind of security is difficult to make simple. Yan works at the intersection of engineering and

Gauntlet supports high-profile exercises involving

product design. She gathers requirements, designs

government, critical infrastructure and large

and builds features, reviews code, runs demos,

organisations. Exercise platforms are still an

identifies edge cases, coordinates testing, and helps

emerging category, with few patterns to follow and

decide when work is ready for release, ensuring

many edge cases to explore. Yan brings clarity to

it meets the minimum viable secure product

that complexity, thinking carefully about how people

(MVSP). She also sets product direction, prioritising

use the product, where trust boundaries sit, and how

improvements for customers that keep quality and

secure design can feel natural rather than restrictive.

security at the centre of the process. Her impact is also visible in the way the team builds

162

Some of her most important work is built into

software. Under Yan’s leadership, secure coding is

Gauntlet’s foundations. Yan designed the multi-

a practical engineering discipline, not a compliance

tenancy architecture that keeps customer

formality. All Gauntlet code goes through peer

data strictly separated. She also designed and

review, automated security testing, and manual

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

acceptance and regression testing before production

It lets people focus on learning, responding and

release. Automated security tests cover 100% of

improving, confident that the systems supporting

the API surface across combinations of user roles

them are reliable and well protected.

and access patterns, helping prevent unauthorised access across security boundaries. This layered approach enforces least privilege at every level and protects against common OWASP vulnerabilities as well as risks unique to cyber exercises. A 2026 security assessment showed the strength of this approach. It identified no high or critical risk findings and recognised strong defence in depth and secure development practices. These results reflect the habits Yan has helped build into the team: careful design, disciplined review, and constant attention to how software behaves under pressure. Yan is motivated by building high-quality software that solves real problems and gives customers clear value. That motivation matters in security. The best

As Gauntlet continues to evolve, Yan’s product mindset remains central to its direction. She drives prioritisation conversations, proposes new features and looks for ways the platform can support more organisations and more demanding exercises. That includes a firm belief that enterprise-grade security controls like SSO should be available to every customer by default. Yan cares about the people who rely on Gauntlet, and it shows in every line of code she writes.

secure code is often invisible when it works well.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

163

BEST SECURITY STUDENT Proudly Sponsored by

Winner

Highly Commended

Special Recognition

Hazel Hogan

Mary George

Sham Polavarapu

Queensland University Of Technology

La Trobe University

Sprightly Mobility

FINALISTS Sham Polavarapu Security Analyst at Sprightly Mobility

Hazel Hogan

Officer, Information Security Governance, Risk and Compliance at Queensland University Of Technology

Mary George

PhD Student at La Trobe University

Paige Haines

Cyber Capability, Education, and Training Consultant at CyberCX

Kiran Illyass

Graduate Researcher Cyber Security at Deakin University

I S S U E 32

Simone Chitsinde Student at University of Canberra

Keryn McMartin

Full time student at TAFE

Zeseya Sharmin PhD Researcher (DUPR Scholar) & Graduate Researcher Teaching Fellow at Deakin University

Lindsay Coudert Student at Edith Cowan University

Ushna Zubair

Final-Year Cybersecurity Student at University of Wollongong

NOMINEES Yasaman Samadi PhD Candidate and Researcher at RMIT University

Piper Roberts

Security Advisor at CSIRO

Hope LucasWarneke

Offensive Security PhD Student at CyberCX

Sachita Thapa

Cyber Consultant at Deloitte

Jacinta B

Graduate Cyber Security at Queensland Government

Hope LucasWarneke Layla Sainsbury Mary George Zeseya Sharmin Sachita Thapa Astrid Jane Fernandes

Kiran Illyass Ushna Zubair Miranda Raffaele Vy Nguyen Michelle Wang Sienna Smith Kanako Yano

Simone Chitsinde

Kat Ho

Hazel Hogan

Aliyannah Webb

Parnamika Ahuja

Ayla Parayno Narciso

Keryn Mcmartin Sonesh Seddiqi Teegan Slomoi Nikshitha Reddy Taylor Powell Paige Haines Ami Gade Amrusha Kar Ellaina Kriketos

Michelle Langtry Yasaman Samadi Jacinta B Sumi Aitken Lindsay Coudert Sham Polavarapu Shaden Morsy Piper Roberts

WOMEN IN SECURITY MAGAZINE

165

HAZEL HOGAN: BUILDING A CAREER WHERE LAW MEETS CYBERSECURITY Hazel Hogan did not arrive in cybersecurity through a neat, well-mapped pathway.

She grew up on a semi-rural property in South-East

assurance reporting for QUT’s Risk and Audit

Queensland, without reliable internet and without

Committee and Executive Leadership Team. Hazel

the kind of professional network many young people

joined the function as a student in January 2025,

take for granted. Learning how to navigate the

but has quickly earned trust through the quality of

professional world was something Hazel largely had

her work.

to work out for herself. Her academic pathway is equally ambitious. She Now, as an Officer in Information Security

is completing a Bachelor of Laws with Honours

Governance, Risk and Compliance at Queensland

alongside a Bachelor of Information Technology,

University of Technology, she is helping shape how a

majoring in Computer Science, while working

major institution makes security decisions.

full-time. Her studies focus on data privacy and cybersecurity regulation, giving her an uncommon

Hazel works across capital project risk assessments,

ability to move between legal requirements and

third-party risk assessments and the governance

technical controls without losing the meaning

material that supports formal decision-making.

of either.

She also serves as secretary to QUT’s Information Security Steering Group, the operational body

In 2025, Hazel authored nine Information Security

responsible for overseeing the university’s security

Standards, including QUT’s first Artificial Intelligence

strategy and program.

Management Standard. Developing it meant working in a fast-moving area where there was no settled

166

It is a role that demands care. Decisions,

approach. She brought together ISO 42001, the

endorsements and risk positions need to be

Queensland Government Enterprise Architecture

documented accurately, given the right context and

Foundation Artificial Intelligence Risk Assessment

followed through to completion. The work informs

framework and Australia’s AI Ethics Principles, then

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

worked through differing views across the university

Women in Technology Awards, competed in the

to create a coherent and defensible standard.

AWSN Incident Response Competition and guest lectured to master’s-level cybersecurity students

She also prepared 20 standards for endorsement

about careers in GRC. As Vice President of QUT’s

by the Information Security Steering Group and

Student Cyber Security Club, she worked to increase

coordinated QUT’s Information Security Management

participation, particularly among women.

System uplift to ISO 27001:2022, mapping every control against the updated requirements.

Hazel plans to complete her CRISC certification and continue specialising in AI governance, risk

For someone early in her career, it is a significant

and assurance.

body of work. Hazel has also taken a broader look at QUT’s third-party risk management capability, producing a current-state assessment, gap analysis and phased uplift roadmap for the full vendor lifecycle. She has proposed stronger scrutiny for high-risk AI and payment systems, improvements to contract templates and a clearer way to record vendor risk over time. Away from her formal role, Hazel is active in AISA,

Her motivation is grounded in something simple: people cannot be expected to protect themselves from risks they cannot see. Institutions hold enormous responsibility for the systems and data people rely on every day. Hazel is already taking that responsibility seriously.

IAPP and ISC2. She has represented QUT at the

I S S U E 32

WOMEN IN SECURITY MAGAZINE

167

MARY GEORGE: MAKING SPACE FOR OTHERS IN CYBERSECURITY Mary George did not enter cybersecurity knowing exactly where she belonged.

She had initially considered health sciences, then

As the recipient of the 2026 La Trobe Student Voice

moved into information technology with limited

Grant and a student project lead, Mary played a

technical experience and only a vague idea of what

key role in supporting student involvement in the La

a cybersecurity career might look like. The learning

Trobe University Cyber Clinic initiative. The project

curve was steep. So was the question many women

brought students together with cybersecurity

still ask themselves when they walk into a room

professionals, government representatives,

full of people who seem more certain: Do I really

SMEs, not-for-profit organisations and startups,

belong here?

creating opportunities for meaningful industry and community engagement.

Mary has turned that uncertainty into purpose. Through the grant-supported initiative, Mary helped Now a second-year PhD candidate at La Trobe

champion student participation, collaboration

University, Mary researches how outreach and

and professional connection, contributing to an

engagement programs can better support women

environment where students could build confidence,

entering and staying in cybersecurity. Alongside

strengthen their networks and apply their learning in

her research, she teaches across cybersecurity

a community-focused setting.”

subjects as a casual academic, serves as President of the Women in Cybersecurity La Trobe

“In addition to leading the WiCyS La Trobe Student

Student Chapter and is Treasurer of the La Trobe

Chapter, she continues to expand her student

Cybersecurity Society.

leadership involvement as incoming Co-President of Enactus La Trobe University and is the current

It is a full calendar. But the common thread is simple:

Treasurer of the La Trobe Cybersecurity Society.”

helping students feel less alone as they find their way into the industry.

168

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Mary grew up in a migrant family and was the first in her family to attend university. Without established professional networks or people close to her who could explain the pathways into technology, she had to build her own connections and seek out mentors. Those experiences now shape the way she leads. Since becoming President of the WiCyS La Trobe Student Chapter in 2024, Mary has grown the group to more than 120 members and expanded its leadership team from three students to eight. She also manages a LinkedIn community of more than 180 students and professionals, creating a practical bridge between people studying cybersecurity and those already working in it. Over the past 18 months, Mary has led more than 15 events and initiatives, involving more than 150 students, academics and industry professionals. She has directly mentored at least 20 student peers, supporting them with scholarship and job applications, professional development, leadership opportunities and the confidence to put themselves forward. When a student-led Women in Cyber event attracted more than 70 attendees, Mary took on the role of MC, coordinated speakers and worked behind the scenes to make the room feel welcoming. It is the kind of work that can look effortless from the audience. It rarely is.

chatbot is exploring another way to offer scalable support to people entering the profession.

Mary’s influence extends beyond campus. She has represented La Trobe at more than 10 high school

Through Melbourne Companions, a student-led social

outreach programs, industry forums and community

enterprise developed with Enactus and WiCyS La

events, reaching over 500 students, teachers and

Trobe, Mary co-leads a team delivering cyber safety

community members. Her message is honest:

and AI awareness programs for older Australians.

cybersecurity can be challenging to enter, especially when you do not see many people like yourself in the field. But there are pathways, communities and careers worth exploring. She is also co-author of Kylie the Cyber Hero, a published comic series designed to make cybersecurity more accessible to girls and young

Mary is not waiting for a future leadership role to begin leading. She is already building the communities, tools and opportunities she once needed herself.

women. Her work on a generative AI mentoring

I S S U E 32

WOMEN IN SECURITY MAGAZINE

169

SHAM POLAVARAPU: LEADING BEFORE THE TITLE ARRIVES At 17, Sham Polavarapu moved to Australia on her own to study cybersecurity at Deakin University.

She was the first in her family to study overseas.

For a startup, where everyone is expected to cover

She was adapting to a new country, a new education

more than one lane, that requires independence,

system and the usual uncertainty that comes with

sound judgement and the ability to explain security

starting life again somewhere unfamiliar. During her

in a way that makes sense to people focused on

first year, she worked several part-time jobs to fund

building a business. Sham has demonstrated all of it.

her studies and travelled roughly three hours each way to university.

Her leadership was evident early. Although paired with a more experienced graduate intern, Sham

Somehow, she maintained a High Distinction record.

naturally became an informal leader in the team.

That tells part of the story. The other part is what

She brought confidence and clarity to the work,

Sham has done with the opportunity since.

while making space for her colleague to contribute. When support was needed, she stepped in without

Now in her second year of a Bachelor of Information

taking over.

Technology, specialising in Cyber Security, Sham

170

is already building the sort of professional and

That balance says a lot. Sham is now helping

community record many people take far longer to

onboard, mentor and supervise incoming interns at

establish. She works as a Security Analyst with early-

Sprightly, where her views are regularly sought on

stage startup Sprightly Mobility, a role she secured

security, team building and public communication.

through the Australian Women in Security Network’s

It is a significant level of trust for someone still

Victorian Summer of Cyber program.

completing her degree.

At Sprightly, she was not handed a token student

She has also recently started as a GRC Analyst

project. Sham was trusted with meaningful

with GRC Mastery, where she works on compliance

work from the beginning, helping establish the

standards and training. Her curiosity extends

organisation’s information security governance and

into research. At Deakin, Sham has worked on

build its readiness for ISO 27001.

pedagogy research under Dr George Aranda,

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

artificial intelligence research under Dr Je Sen Teh

Her interest in the field is not confined to campus.

and digital forensics research under Dr Ansam

She has co-presented at BSides Melbourne, hosted

Khraisat. She will present her forensics research at

a session at AISA CyberCon and delivered technical

BSides Sydney next month, and she will be featured

workshops for DUCA. Through Deakin’s Equity and

in the upcoming Deakin Mathematical Yearbook

Accessibility Program, she has run IT and career-

for her work in discrete mathematics and elliptic

pathway sessions for high-school students, helping

curve cryptography.

young people see higher education and technology as realistic options. She is now building cybersecurity

Outside work, her leadership footprint is growing

workshops for Deakin and training mentors to run

quickly. As President of the Deakin University

them, with the aim of getting more high-school

Cybersecurity Association, Sham leads a committee

students and Open Day visitors interested in cyber.

of more than 20 people and represents around 995 members, making DUCA one of Australia’s largest

She is also the author of Cybersecurity for Teenagers,

student-led cybersecurity societies.

which reached #2 on Amazon’s bestseller list.

She was also an organiser and judge for the 2026

One small story captures her approach. When

ACUCyS Hackathon, a 36-hour student cybersecurity

another internship candidate was unsuccessful at

event. Her work spanned sponsorship, venue

Sprightly, Sham reached out without being asked

coordination, recruitment and challenge design

to help them find other opportunities. That is not

the kind of behind-the-scenes responsibility that

something you can teach easily.

determines whether an event actually happens. She also won first place nationally with her team at GovHack, a hackathon sponsored by the Australian Government, and is a member of the IT Student Academy, an invite-only program for high-achieving

Sham is clearly ambitious, but she is not climbing alone. She is building ladders as she goes.

IT students.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

171

EXCLUSIVE

WHAT'S INCLUDED? OFFICIAL PARTNER RECOGNITION Your logo will be prominently displayed at the beginning of the magazine in our “Partner of the Issue” panel.

GLOBAL AUDIENCE REACH Your brand will be seen by 5,000+ global subscribers through our free, bi-monthly digital publication, dedicated to supporting and showcasing women in security.

2 FULL-PAGE ADVERTS Feature your brand in two issues of your choice between March and December.

2 JOB POSTINGS Advertise up to two job opportunities in the magazine and across our social media platforms, reaching a highly engaged cybersecurity audience.

ONLINE BANNER ROTATION on WomenInSecurityMagazine.com

This high-value package ensures maximum visibility for your brand while directly supporting the continuation of Women in Security Magazine.

Join us in making an impact—partner with us today!

EMAIL JANE@SOURCE2CREATE.COM.AU

NEURODIVERSITY CHAMPION Proudly Sponsored by

Winner One

Winner Two

Christie Lim

Olivia Briggs

The Salvation Army

OKTA

FINALISTS

NOMINEES

Christie Lim

Laura O'Neill

Julie Toke

General Manager, Information Security and Governance at The Salvation Army Australia

Head of Advisory & Assurance at Fujitsu

Olivia Briggs

Olivia Briggs Commercial Account Executive, Auth0/Okta at Okta

Joanne Denaro Manager, Identity and Access Management from Cenitex

Claire Carpenter Cybersecurity Consultant at Bluerydge

Louise Rogerson Identity and Access Management Consultant at UniSuper

IAG (Insurance Australia Group) Laura O'Neill Christie Lim Joanne Denaro Sharin Yeoh Claudia Foley Mina Zaki Claire Carpenter Louise Rogerson

I S S U E 32

WOMEN IN SECURITY MAGAZINE

173

CHRISTIE LIM: INCLUSION THAT SHOWS UP IN THE WORK For Christie Lim, inclusion is not a campaign, a theme for one month of the year or something parked with Human Resources. It is part of how she leads.

Across more than two decades in cybersecurity,

senior leadership roles where security outcomes

Christie has built and led security functions in some

carry real consequences for customers, communities

of Australia’s most complex environments: financial

and staff.

services, government, retail, property, logistics, energy and not-for-profit. She is now General

In each setting, she has had the opportunity to shape

Manager of Information Security and Governance

more than technology, risk registers and governance

at The Salvation Army Australia, leading in an

structures. She has helped shape who feels welcome

organisation whose mission is centred on people

in the room.

who are too often overlooked. That includes neurodivergent professionals, whose That choice matters.

different ways of thinking can be a genuine strength in cybersecurity, but who may still encounter

For neurodivergent professionals considering

workplaces that reward conformity over capability.

whether cybersecurity is a field where they can build

Christie’s leadership is grounded in the belief that

a career, senior leaders set the tone. Where they

people should not have to hide or minimise who they

invest their time, the people they promote and the

are to contribute.

culture they create all send a message. Christie’s career has consistently shown that high-performing

Her commitment extends far beyond her own teams.

security teams and inclusive teams are not

Through the Purple Team Australia Program, Christie

competing ideas.

mentors emerging cybersecurity professionals from diverse backgrounds. The program focuses

174

They are connected. Christie has helped build

on building capable talent pipelines, and for

security functions from the ground up at

neurodivergent people at the early or middle stages

organisations including Vicinity Centres and

of a career, access to a senior mentor can make a

Officeworks. She has delivered cyber resilience

huge difference. A trusted conversation can help

initiatives across the Victorian Government and held

someone make sense of an unfamiliar workplace,

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

recognise their strengths or find the confidence to keep going when the industry feels isolating. Christie also mentors through the Australian Women in Security Network’s Security Mentoring Program. For neurodivergent women, the barriers can compound. They may be navigating gender bias, limited representation and workplace environments that do not always accommodate different communication styles or ways of processing information. Her involvement is practical and personal. She gives her time, shares perspective gained across multiple industries and supports people as they work out where they want to go. There is a quiet strength in that kind of leadership. Christie does not suggest that inclusion means lowering expectations. Her career is evidence of the opposite. She has led major security programs, managed risk and compliance responsibilities across sectors, and built functions capable of supporting organisations with serious operational and community responsibilities. The standard remains high. The door is simply opened wider. In an industry that is still working to improve representation and belonging, Christie’s contribution has been patient and consistent. She has invested in people long before a formal title or award asked her to do so. Her impact is difficult to capture in a single metric. It shows up in the professionals who feel seen, the teams shaped by her example and the emerging leaders who have had someone senior believe in them.

That is how culture changes not all at once, but through leaders who keep making room.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

175

OLIVIA BRIGGS: MAKING WORK WORK BETTER

For Olivia Briggs, neurodiversity at work is not something to be quietly managed behind the scenes. It is a source of insight, capability and better decision-making.

Through practical conversations, honest communication and changes that make everyday work more workable, Olivia is open about the way she works best. She knows that her capacity for hyperfocus and deep work is strongest in the morning . That openness has had an effect well beyond her own desk. It has helped shift neurodiversity away from a “checkbox” mindset where diversity initiatives treat people as policy obligations rather than talent. Championing this approach, Olivia demonstrated how neurodivergent professionals bring precise, high-value capabilities to the technology and security sectors: exceptional pattern recognition, sustained deep focus, data-led thinking, and the courage to challenge outdated processes. By advocating for an asynchronous-first communication culture for routine updates, she helped protect deep-work hours, allowing teams

176

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

to tackle complex strategic problems without

While no single initiative can claim credit for every

constant fragmentation.

result, the changes have helped create a more sustainable environment for people to contribute.

Olivia shattered the persistent myth that accommodating different ways of thinking somehow

By trialling programs herself and helping leaders

lowers standards or slows momentum.

understand what neurodivergent employees need to thrive, Olivia has helped build a workplace where

She proved the exact opposite: when you remove

people are more comfortable self-advocating.

friction, performance accelerates. In cybersecurity where catching the anomaly in the noise is everything these are not just accommodations; they are strategic assets. The outcomes have been felt across the workplace. The organisation has seen stronger psychological

There is nothing complicated about the principle behind Olivia’s work; when people have the conditions to do their best thinking, everyone benefits.

safety, better team workflows and productivity.

Building what’s next is what BHP does best

bhp.com/together

I S S U E 32

WOMEN IN SECURITY MAGAZINE

177

MOST INNOVATIVE EDUCATOR IN CYBERSECURITY Proudly Sponsored by

Winner

Highly Commended

Special Recognition

AWSN National Program

Rahat Masood

Stacey Edmonds

University of New South Wales

Lively, a Learning Agency

FINALISTS AWSN National Program AWSN

Rahat Masood Senior Lecturer, School of Computer Science and Engineering, UNSW Sydney; former Director, UNSW Online Cyber Security Program; Associate Head of School, Engagement from University of New South Wales

Stacey Edmonds Founder and CEO of Lively, a Learning Agency

Girls' Programming Network Girls Programming Network

178

Parisa Shojaei Sessional Academic, Tutor and Exam Supervisor from University of Wollongong

Caroline von Konigsmark Manager Security Culture at Okta

Michelle Riberio SheLeadsTech Ambassador from ISACA Melbourne

Alina Limbu

NOMINEES Caroline Von Konigsmark Michelle Riberio Dr Farina Riaz

Stacey Edmonds Rahat Masood Alina Limbu

Girls' Programming Network

AWSN Victorian Women in Security Programs

Bianca Edgar

Armaan Sidana

Parisa Shojaei

Marina Azar Toailoa

Cyber Security Awareness Training

Tangible Uplift Program

Information Security Officer at HUB24

Biana Edgar Partner Marketing Director APJ at darktrace

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

AWSN: BUILDING A CYBERSECURITY PIPELINE THAT LASTS Cybersecurity education often arrives as a one-off: a workshop, a short course, a career webinar that sparks interest but leaves people wondering what comes next. The Australian Women in Security Network has taken a different approach.

Over 12 months, from April 2024 to March 2025,

LEARNING TOGETHER, STAYING CONNECTED

AWSN delivered 30 cybersecurity-focused programs

For school students, SheDiscovers Security

nationally in partnership with the Australian Signals

creates an early point of connection. Across the

Directorate. The programs reached 595 women and

year, 163 girls took part in immersive experience

girls across Australia, from high-school students

days featuring hands-on activities, interactive labs

beginning to consider technology careers through

and cyber challenges. The aim is not to turn every

to established practitioners preparing for executive

attendee into a security analyst overnight. It is to

leadership and board roles.

make cybersecurity feel possible, particularly for girls who may not have seen themselves represented in

What makes the model stand out is not simply the

the field.

number of programs. It is the way they connect, and the relationships that continue long after a

SheLearns Security supported 266 women through

workshop finishes.

foundational and intermediate training, including Cyber Security Essentials, open-source intelligence,

AWSN has built a learning pathway designed

CompTIA Security+, incident response and ISC2

to support people at different points in their

Certified in Cybersecurity. Technical development

cybersecurity journey. Its four national program

was paired with career coaching, CV support and

streams SheDiscovers Security, SheLearns Security,

industry guidance.

SheLeads Security and SheSpeaks Security recognize that building a stronger cybersecurity workforce

That combination matters. A qualification can open

is not just about entry-level training. People need

a door, but knowing how to talk about your skills,

practical skills and opportunities to progress. They

meet people in the industry and identify the right next

also need to feel they belong.

opportunity can be just as important.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

179

The workshops and cohort-based programs also

involved 161 women in real-world cyber scenarios,

offer a safe environment to ask questions, try

with some participants going on to secure

something unfamiliar and learn alongside others

employment after the competition.

facing similar challenges. Some of their biggest impacts happen between participants: a conversation

At the leadership end of the pipeline, SheLeads

that becomes a friendship, or a connection that gives

Security supported 140 women through programs

someone the confidence to keep going.

including Aspiring CISO, CISM certification, board readiness and emerging leadership development.

For AWSN, seeing women stay connected beyond

It recognises a gap the industry has been slow

the program is one of the most rewarding outcomes.

to address: technical talent alone does not

They have worked through challenges together.

automatically lead to senior influence.

They become each other’s cheerleaders, celebrating progress and offering encouragement when the next

Meanwhile, SheSpeaks Security trained 26 women

step feels difficult.

through The Powerful Presenter and Project Friedman initiatives, supporting participants to build

180

AWSN also created chances for people to practise

confidence as speakers and contribute at industry

under pressure. Its Incident Response Competition

events such as CyberCon.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

The education does not stop when a course ends.

Its recommendations give that responsibility

AWSN’s mentoring program has involved more than

practical shape. Employers can review recruitment

1,400 participants, creating a community where

processes to reduce bias, improve access to

people can ask questions, find guidance and stay

flexible work and examine the workplace practices

connected to peers who understand the journey.

that influence whether women stay and progress. Government and industry bodies can support gender

MEASURING PROGRESS AND CHANGING THE SYSTEM

pay gap audits and the collection of workforce and

Alongside its education programs, AWSN has

is happening and where it is not.

retention data, making it easier to see where change

invested in research to understand where the industry stands and what needs to change. Building

For AWSN, this places the programs and research

a pipeline is important. Knowing whether the wider

within the same effort. Workshops can help women

workforce is becoming more inclusive matters too.

build skills and confidence, but they cannot, on their own, remove the barriers women encounter once

In partnership with RMIT University, and with

they enter a workplace.

sponsorship support from the Australian Signals Directorate, AWSN contributed to a two-phase

The bottom-up work of developing the pipeline

study examining gender dimensions in Australia’s

and the top-down work of changing organisational

security sector. The first phase, undertaken in

systems need to happen in parallel. Otherwise, the

2022–2023, combined Census analysis with a sector

industry risks encouraging women into careers

survey to establish a benchmark for understanding

without addressing the conditions that may push

representation and informing future action. It is

them out.

the source of the widely cited finding that women made up around 17% of Australian cybersecurity

A PATHWAY SUPPORTED BY THE SECTOR

occupations in 2021 not a current workforce

None of this happens in isolation. AWSN works

estimate, but a baseline against which progress can

with the Australian Signals Directorate, training

be assessed.

organisations, certification bodies, mentor volunteers, corporate partners and collaborators

The research also showed why access to community

across the sector. Those partnerships keep programs

and support deserves attention. Only 27% of women

grounded in the skills industry needs now, while

surveyed reported having a role model or mentor

helping participants build relationships that may

of the same gender, compared with more than 50%

shape their careers for years.

of men. That finding reinforces the importance of creating opportunities for women to connect with people who can help them see a future in the industry But bringing more women into cybersecurity is only part of the task. The second phase, undertaken in 2024, examined why women leave the workforce and what could improve their retention and representation. Drawing on a literature review and interviews with women who had left, the research called for a whole-of-sector response. Responsibility extends beyond individual participants or training providers to employers, organisational leaders,

AWSN’s innovation is not one particular tool or course. It is the whole pathway: making the first step feel possible, creating a community that stays with people as they progress, and using research to challenge the barriers that learning alone cannot fix.

government, education and the wider community.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

181

DR RAHAT MASOOD: TEACHING CYBERSECURITY WHERE IT HAPPENS Cybersecurity education can sometimes feel removed from everyday life: passwords, protocols, systems and controls, all taught at a comfortable distance from the people affected by them.

Dr Rahat Masood takes the opposite approach.

they create AI-powered bots, test narratives and

Her teaching begins with the messy reality of digital

see how influence spreads across a fictional social

life misinformation, privacy, scams, AI-generated

platform.It is confronting by design.

content, online manipulation and the question of who can be trusted.

Students learn how social bots, coordinated campaigns and AI-generated personas can

182

A Senior Lecturer in the School of Computer Science

manipulate public discussion. They see how easily

and Engineering at UNSW Sydney, Dr Masood

engagement can become more powerful than

teaches more than 1,000 students each year across

accuracy, and how difficult misinformation is to

undergraduate, postgraduate, online and professional

contain once it gains momentum. UNSW describes

learning. Her work reaches well beyond the

Capture the Narrative as a simulated social-media

classroom, but the thread is consistent: cybersecurity

manipulation competition designed to help students

is not only a technical discipline. It is about people,

understand how AI and large language models can

evidence, behaviour and public trust.

amplify misinformation and disinformation.

Her most distinctive initiative is Capture the Narrative,

The scale of the first major competition was striking.

a large-scale social-media wargame she co-leads.

It involved 108 teams from 18 Australian universities,

Rather than asking students to simply identify

with participants generating more than seven

misinformation in a lecture or quiz, the competition

million player-bot posts in a simulated environment

places them inside a controlled simulation where

populated by around 4,000 AI-driven citizens.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Her university teaching follows the same philosophy. In foundational cybersecurity subjects, students write weekly security blogs, respond to one another’s reflections and connect technical ideas to current incidents, media stories and their own digital habits. She uses memorable case studies including scenarios inspired by Stargate and Houdini to help students understand concepts such as authentication, integrity, replay attacks and secure communication. In Digital Forensics, students take part in a mock trial, acting as expert witnesses questioned by judges and prosecutors. They must explain their analysis clearly, defend evidence and acknowledge uncertainty. It is a rare opportunity to practise the communication and ethical judgement required in real investigations. Dr Masood has also helped make cybersecurity accessible to people without a traditional technical background through UNSW Online, supporting learners from law, business, health, policy and technology. Her current research spans trustworthy AI, privacy, misinformation and inclusive security, bringing emerging issues directly into teaching. Outside university, she has delivered cyber safety and privacy sessions for older community groups and spoken publicly about children’s data, unsafe apps, scams and AI risks. Her research on nearly 200 school-endorsed apps has brought fresh attention to children’s privacy and hidden data collection. The findings were just as valuable as the event itself.

Dr Masood’s vision is ambitious: expand Capture the

Students did not necessarily become more confident

Narrative, build practical privacy tools for parents and

at identifying bots, and teams often prioritised high-

schools, and establish a community cyber clinic for

volume posting because engagement was rewarded

people who need accessible advice.

as an uncomfortable reflection of the real socialmedia ecosystem. That is part of Dr Masood’s approach. Learning does not need to produce neat answers to be valuable. It should help people recognise complexity, question assumptions and make better decisions when the

She is teaching people how to deal with the cyber risks already here. And the next ones coming.

information is incomplete.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

183

STACEY EDMONDS: WHEN CYBER SAFETY BECOMES INSTINCT At the 2026 Women in Security Awards, Stacey Edmonds was named special recognition for Most Innovative Educator in Cybersecurity. It is an accolade that makes sense the moment you hear her talk about the problem she is trying to solve.

Stacey is co-founder and CEO of Lively, a learning

and built around her taxonomy of the signs of

agency built around a fairly simple idea: cyber safety

social engineering. Learners are not simply told

should not feel like a once-a-year compliance task.

what phishing looks like. They learn to read intent,

It should become instinctive closer to looking both

pressure, urgency, impersonation and the little details

ways before crossing the road than sitting through

that make a message feel wrong.

another mandatory module. The results are hard to ignore. Independent Her platform takes an approach that feels

controlled testing at Transport for NSW saw click-

refreshingly different. Rather than relying on the

through rates fall from 32.9 per cent to 10.9 per

familiar phishing test, Phishy or Not? for workplaces

cent. In schools, more than 130,000 scenarios have

and Dodgy or Not? for schools and communities

been played, with in-game data showing a 50 per

use short, game-based scenarios drawn from the

cent reduction in susceptibility to unwanted-contact

kinds of scams people are actually seeing. AI-written

scenarios.

messages, suspicious texts, unwanted contact, deepfakes and telephone calls. The question is

But the real innovation may be what Lively measures.

not whether someone can remember a policy. It is whether they can spot when something feels dodgy.

Most awareness programs count clicks or course completions. Stacey’s model tracks

That distinction matters.

competence, confidence, behavioural change and calibration whether people are right for the right

184

For more than two decades, Stacey has worked

reasons, and whether they know when they are

across safety learning, culture change and cyber

unsure. It gives organisations a more useful picture

education. Her work is grounded in behavioural

of human risk than a pass-or-fail phishing exercise

science, including inoculation and nudge theory,

ever could.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

The platform is also deliberately broad. It can

an Australian development house with more than 30

support a Year 3 classroom, a hospital workforce,

years in business, builds and maintains the platform.

a small business without a security team, or older

Lively also works with the Trustworthy Digital Society

Australians learning how to navigate scams with a

Hub (UNSW Sydney and UTS), and one of Australia’s

little more confidence. Lively is a social enterprise.

largest banks is about to bring Phishy or Not? to its

Businesses play Phishy or Not? at commercial rates.

small business customers. Watch this space!

That revenue runs the platform, the same platform that delivers Dodgy or Not? to schools at a price schools can afford, and free to the communities who need it most. Partnerships are helping push the work further. NSB Cyber has made the platform part of its managed service and sources live scam material from the dark web, so people practise on scams while they are still circulating. Businesses and schools also send in the

Stacey’s ambition is bigger than another cyber-awareness product. She wants cyber safety to become a habit people keep for life. That feels like the sort of innovation the sector has been waiting for.

scams they receive. SRA Information Technology,

I S S U E 32

WOMEN IN SECURITY MAGAZINE

185

SOURCE2CREATE.COM.AU

AISA.ORG.AU

IS NOW AISA'S NEW PUBLISHING PARTNER Click here to read the newest edition of CyberConnect

CHAMPION OF CHANGE Proudly Sponsored by

Winner

Highly Commended Highly Commended

Octavian Grigore

George Coldham

Ad Wolst

NBNco

Microsoft

Bupa

FINALISTS Octavian Grigore NBNco

George Coldham Microsoft

Ad Wolst Bupa

Dilshan Jayarathna TAL

Ryan Mclaren Retrospect Labs

I S S U E 32

Eder Plansky

NOMINEES Ryan Mclaren

Wilson Chiu

Jol Alexander

Jay Hira

Brad Churcher

Sahil Bhatt

James Calder

Jason Pang

William Brown

Don Tibbits

Peter Gigengack

Octavian Grigore

Wayne Rodrigues

Thomas King

NBNco

Philip Boadi

James Calder

George Coldham

Fortinet

Dilshan Jayarathna

Ghayath Nehme Evan Morrison

Elliot Dellys

Evan Morrison

Peter Dowley

Jim Boughton

Louis Cremen

HUB24

Dan Goldberg

Bharat Bajaj

Aswin Pal

Daniel Petreski

Jason Cheon

Eder Plansky

Enrico Venezia

Puneet Tikoo

Fujitsu

Jay Hira KPMG Australia

Thomas King Microsoft

Brad Churcher

Ad Wolst

WOMEN IN SECURITY MAGAZINE

187

CHAMPIONING CHANGE, ONE CAREER AT A TIME For Octavian Grigore, changing the gender balance in cyber security has never been about a target on a dashboard. It comes down to the moments that sit behind the numbers: who gets invited into the room, who is trusted with meaningful work, and whose name is raised when an opportunity appears.

As Senior Manager, Digital Investigations at nbn,

additional rotation, then advocated for her to remain

Octavian leads teams accomplishing highly technical

permanently in Security. Along the way, he supported

work across cyber investigations, digital forensics,

her beyond technical capability, helping build

incident response and cyber intelligence. Under

confidence in executive communication, stakeholder

Octavian’s leadership, female representation in his

engagement and public speaking. Claudia is now a

team has grown from 10 per cent to 50 per cent.

Women in Security award winner and an established professional in the field.

Under Octavian’s leadership, female representation in his team has grown from 10 per cent to 50 per cent.

For Babs, the issue was visibility. Her work was

But the figure only tells part of the story.

critical, though much of it happened quietly behind the scenes. Octavian made sure senior leaders

Growing up in Romania, Octavian saw women close

understood her contribution, championed her

to him including his mother-in-law, a teacher, and his

progression and successfully advocated for a well-

wife, a nurse held to different standards despite their

deserved promotion.

capability and commitment. It left him with a view that has carried into his leadership: talent should not

Hardi arrived at nbn from New Zealand without a

have to fight to be seen.

traditional cyber or technical background. Octavian saw her potential early, involving her in significant

That belief has shaped the careers of women

investigations, executive reporting and development

including Claudia Nave, Babs James, Hardi Shah and

of the organisation’s Incident Response Playbook.

Caitlyn Bygate.

She earned a Threat Intelligence certification, performed strongly in a Capture the Flag competition,

188

When Claudia’s graduate rotation in Security was

and moved from the graduate program into a

ending, Octavian did not simply wish her well and

permanent Digital Investigations Analyst role ahead

send her back to the program. He pushed for an

of schedule.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

His approach is not about lowering the bar. Quite the

Octavian understands the difference between

opposite. It is about questioning whether the barriers

mentoring and sponsorship. Mentoring offers

people accept are actually relevant.

guidance. Sponsorship means using influence when someone is not in the room.

Earlier in his career at the Australian Taxation Office, Octavian saw women excluded from forensic site visits because an equipment case was considered too heavy. He asked a straightforward question: had anyone actually asked them? They had not. The eventual solution was even simpler: put the Pelican case on a trolley.

In a sector still working towards better representation, that kind of leadership can quietly change the direction of a career and, over time, the culture around it.

It is a small story, but it says plenty.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

189

CHAMPION WHO MAKES ROOM George Coldham’s day job is in cloud security architecture at Microsoft, dealing with the shifting realities of modern cyber risk. But outside the office, much of his work is about people: who gets a chance to be heard, who feels comfortable walking into a room, and who is invited to take the next step in a career that can still feel hard to enter.

Based in Western Australia, George has built one

program featured more women than men. It was

of the state’s more active grassroots cybersecurity

not accidental. It reflected the work that goes into

communities. He is a meetup organiser, whether

seeking out different voices, encouraging people to

leader or committee member for multiple meetups,

put their hand up, and designing an event where first-

which run around 15 a year. For instance the Perth

time speakers feel they belong.

Microsoft Security Meetup, which ran 10 this year, Global AI Perth Chapter, 3 events, Perth GitHub

For several women, that encouragement has

Meetup, 4 events, Rust meetup, 2 events. He is an

become a genuine career stepping stone. George

organiser and host for many communities. That

has co-submitted talks with female peers and

reach matters. But it is the way George uses it that

supported early-career women preparing for their

has made a difference.

first conference presentations. In one case, when he could not co-present with a colleague himself,

In cybersecurity, gender imbalance is not always

he introduced her to another suitable collaborator.

obvious or deliberate. Often it shows up in smaller

She went on to present at the conference, then

ways: the person who has the confidence to submit a

spoke at three more events, a goal she had been

conference abstract, the familiar names selected for

working towards.

panels, the informal networks that open doors before a role or speaking spot is ever publicly available.

It is a simple example, perhaps, but it says a lot about

George’s approach has been to intervene at those

the difference one well-timed introduction can make.

practical points. George’s contribution is not limited to community

190

He makes sure women are part of the conversation

events. Within Microsoft, he encourages female

as speakers and contributors, rather than simply

colleagues to pursue speaking opportunities and

attendees in the audience. At the most recent

greater professional visibility. If he is not the right

Global Security Bootcamp he organised, the speaker

person to help directly, he connects them with

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

someone who is. This is how sponsorship works

can be easy to dismiss, yet it is often what

when it is done properly: not vague encouragement,

determines whether someone returns, participates,

but a useful referral, an introduction, a nudge towards

asks a question, or decides they have a place in

something tangible.

cybersecurity after all.

The work is demanding. Community leadership takes time, particularly alongside a full-time role in a fast-moving industry. And changing representation is rarely achieved through one event or one policy. George has stayed with it, building recurring platforms rather than relying on one-off initiatives. He also works closely with a female event partner, ensuring varied perspectives influence how programs are shaped and speakers are selected. Women who attend his events have described

George Coldham’s advocacy is grounded in a straightforward belief: stronger cybersecurity comes from broader perspectives. He has turned that belief into action, quietly and consistently, by making more room at the table and sometimes by helping someone find the confidence to sit there.

them as safe and inclusive spaces. That feeling

I S S U E 32

WOMEN IN SECURITY MAGAZINE

191

CHAMPION OF CHANGE: AD WOLST At Bupa, Ad Wolst leads security teams through the kind of complex, high-pressure work where cybersecurity decisions matter quickly and the stakes are real. As Security Crew Lead within Bupa’s Technology function, he is responsible for delivering strategic security outcomes, reducing cyber risk and bringing multidisciplinary teams together across a large enterprise.

But the part of his leadership that has made a lasting

merits. In annual remuneration cycles, Ad has taken

impression is less about a standalone inclusion

direct action to address gender pay gaps, prioritising

initiative and more about the decisions he makes

increases where parity had not been achieved. He

when nobody is watching: who gets an opportunity,

acknowledges that a review cycle alone is not a

whose voice is heard in the room, and what happens

perfect fix. Still, it is action, not just intention.

when fairness is found wanting. Within his teams, diversity is not treated as a statistic Ad’s approach to gender equity starts with

to be reported and moved on from. In technical

recruitment. He has challenged the idea that

forums and strategic conversations, Ad makes space

security roles should only go to people who arrive

for contributions that may otherwise be missed. He

with traditional technical credentials already in

actively draws people in and works to ensure that

hand. Instead, he looks for capability, curiosity and

the loudest voice, or the most senior one, does not

a willingness to learn. That has opened doors for

automatically carry the day.

people coming from finance, service desks, project management and other adjacent fields.

One example captures that approach well. A Senior Project Manager with a data background wanted to

It is a practical response to a familiar problem in

move into security. Rather than steering her back

cybersecurity: if organisations only recruit from the

towards a more conventional pathway, Ad supported

same narrow talent pool, they will keep getting the

the transition and helped create room for her to

same imbalance.

develop on the job. She is now building hands-on security expertise a career shift that depended on

He has also advocated for anonymised job

someone seeing potential rather than a lack of

applications, helping remove bias before a candidate

prior experience.

has even had the chance to be considered on their

192

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

The challenge, as Ad has openly recognised, is that

His motivation is personal. Speaking on an

there are still too few women applying for technical

International Women’s Day panel, Ad said he hopes to

security roles. His response has been to tackle both

leave a legacy of respect in the workplace and invites

sides of that issue: actively encouraging more diverse

others to hold him accountable when he falls short. It

candidates into the field while removing unnecessary

is a simple statement, but it says a great deal.

barriers that shrink the pool in the first place. He also understands the cultural pressures of cybersecurity work. During periods of heightened risk, teams can slip into habits that reward overwork and individual heroics. That can push people out, particularly those balancing caring responsibilities or other commitments. Ad counters this by reinforcing shared accountability and sustainable ways of

For Ad Wolst, inclusion is not separate from high performance. It is part of how strong security teams are built.

working, even when the pressure is on.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

193

194

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

UNSUNG HERO Proudly Sponsored by

Winner

Highly Commended

Angela Kamaru

Emily Holyoake

Roma Singh

Warembo wa Cyber

Not A Standard

Department of Transport and Planning

FINALISTS Roma Singh

Security Advisor at the Department of Transport and Planning

Angela Kamaru

Founder of Warembo wa Cyber

Emily Holyoake

Anjali Varghese Cyber GRC Lead at Grant Thornton

Rachel Choong Senior Cyber Security Project Manager

Madeleine Brown

Founder of Not A Standard

Senior Consultant at Cyconsol

Alex Penna

Jackie Orchard

COO at Tech Inclusion

Jeannette Ngau Cyber Risk and Compliance Consultant at

Monash University

Jhanna Boutsyk

Senior Security Consultant at Mantel

I S S U E 32

Head Of Information and Data Security Advisory at Team Global Express

Hardeep Sandhu

Information Security Officer at hub24

NOMINEES Yen Chiu Chin

Cloud Solution Architect – Security at Microsoft

Deepti Karnik Portfolio Audit Manager, Group Internal Audit at IAG

Dominika Zerbe-Anders

Fiona Martin

Kirstie Cerone

Alex Penna

Anjali Varghese

Erin Carroll

Deepti Karnik

Stephanie Puccetti

Jackie Orchard

Hiba Jahanzeb

Angela Kamaru

Claire Brennan

Nimisha Bhatta

Tian Liu

Yen Chiu Chin

Pramiti Bhatnagar

Julie Gleeson

Deb Cidoni

Nina Colley

Cyber and Business Resilience Partner at KPMG Australia

Nang Tip

Kaela Lee

Kathryn Manuel

Sahiti Poosarla

Tian Liu

Shivani Thakur

Christine Buntat

Natasha Passley

Sophie Hill

Hardeep Sandhu

Saba Bagheri

Madeleine Brown

Emily Holyoake

Jhanna Boutsyk

Louisa von Stiegler

Hilary Bea

Beheshta Ghafory

Rachel Choong

Jeannette Ngau

Senior Identity Engineer, Identity and Access Management at TAL

Natasha Passley

Senior Managing Directorat FTI Consulting

Roma Singh

WOMEN IN SECURITY MAGAZINE

195

A QUIET FORCE MAKING ROOM IN CYBER For Angela Kamaru, cybersecurity has never been just about technology, certifications or the next job title. It is about people particularly the people who walk into the industry wondering whether there is a place for them at all.

As founder of Warembo wa Cyber, Angela has built

Women who initially joined uncertain about their

a community for women of colour seeking a safer,

place in the field are now pursuing certifications,

more welcoming doorway into cybersecurity. On

applying for roles and taking practical steps towards

paper, that is her role. In practice, it barely captures

cybersecurity careers. Some are beginning to see

the hours she gives, often outside work and without

themselves not merely as observers of the industry,

fanfare, to mentor students, support career changers,

but as future practitioners, leaders and contributors.

make introductions and reassure women who have spent too long feeling like outsiders in the room.

That matters. Australia’s cybersecurity workforce needs more people, but it also needs a broader range

Warembo wa Cyber began from a personal place.

of voices, experiences and perspectives. Angela’s

Angela entered the sector as a woman of colour and

work is helping open that pipeline in a very human

rarely saw herself reflected in the people around her.

way. There is no grand campaign behind it. No

That experience could have been isolating. Instead,

gatekeeping. Just consistent effort and a willingness

she used it as the starting point for something

to sit beside someone while they work out what

bigger: a space she wished had existed when she

comes next.

was finding her own footing. Angela’s leadership is grounded in Ubuntu the idea The community now brings women together

that “I am because we are”. You can see it in the way

each month to study, share opportunities, ask the

she builds connection rather than competition. She

questions they may not feel comfortable raising

does not talk about diversity as a distant industry

elsewhere, and talk honestly about the realities of

goal; she makes it tangible through gatherings,

building a career in cyber. It is free support, but it

conversations and small acts of encouragement that

is not casual support. For many, it has become the

add up over time.

difference between stepping back and pressing on.

196

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

There is something particularly powerful about that kind of leadership. It is rarely the loudest. It does not always come with a formal brief, a budget or public recognition. Yet it changes the texture of an industry. Angela understands that representation alone is not enough.”Seeing someone who looks like you can spark hope, and intentional, practical support helps turn hope into momentum.”The “intentional” captures that the support is deliberate rather than something

Her contribution is quiet, deeply personal and already rippling outward. For the women who have found confidence, direction and community through her work, Angela Kamaru is not simply opening a door into cybersecurity. She is making sure it stays open.

that just happens. Through Warembo wa Cyber, she is creating both.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

197

THE WORK THAT PUTS PEOPLE BACK INTO CYBERSECURITY Emily Holyoake does not see cybersecurity as a world of systems alone.

Yes, the controls matter. The alerts, the threat

It helps make sense of what tech-facilitated abuse

intelligence, the risk registers and the policies all

can look like, how it may be detected, and where

have their place. But Em has spent much of her

prevention can begin.

career asking a harder question: what happens to the person on the other side of a cyber incident?

The significance is not simply that SAFE exists, although that matters. It is that Em has given human-

As founder and CEO of Not A Standard, a sovereign

centred security something practical to stand on.

Australian security and intelligence company, Em works at the intersection of cybersecurity, human

“Human-centred” can easily become a phrase people

behaviour and real-world harm. Her focus includes

nod along with in a meeting, then leave behind when

tech-facilitated abuse, domestic and family violence,

the next technical priority appears. Em has pushed

fraud, violent extremism and the often-overlooked

the conversation further. She has built a structure

human consequences of online harm.

around it. A framework. A method. A way to analyse harm without reducing people to the tired idea of the

It is not always comfortable territory for an industry

“weakest link”.

that can favour neat technical problems and compliance-based answers. But that is exactly why

Her work asks organisations to look at why an

her work matters.

incident happened, what conditions enabled it, and what could be changed to create a safer outcome.

Em created SAFE, a platform that applies structured

That shift in thinking has implications well beyond a

intelligence methods commonly used for cyber

single incident or business. It challenges the industry

threats to interpersonal harm. She has also published

to recognise that security decisions can affect

and continues to maintain a tech-facilitated abuse

people’s safety, autonomy and lives.

threat matrix, available openly for others to use.

198

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Building this work has not been straightforward.

is like to assume there may not be room for you and

There is rarely a budget line for human harm. In

she is determined to make that room more visible.

many organisations, it sits outside traditional cyber programs and outside the controls-and-compliance

For Emily, different wiring is not a problem to

model that still shapes much security spending.

overcome. Often, that is the point.

Em has also built much of it herself. The strategy, the engineering, the research and the case-making can all land on the same desk. As she puts it, a new idea can take a while to become an obvious one. Alongside her work through Not A Standard, Em has been generous with her time and encouragement for people entering the sector, especially neurodivergent people and those who have not followed a

Her contribution may not always be the loudest in the room. But it is reshaping what the room is prepared to talk about and, importantly, who it is prepared to protect.

conventional pathway into cyber. She knows what it

I S S U E 32

WOMEN IN SECURITY MAGAZINE

199

ROMA SINGH: MAKING SECURITY STRONGER, ONE PERSON AT A TIME There is a certain kind of cybersecurity work that rarely makes headlines.

It is the careful work done before a project moves

Policy Framework, Information Security Manual,

forward. The tough questions asked in design

Essential Eight and Victorian Protective Data

forums. The risk register that is kept current. The

Security Framework.

policy document that gets revised before it becomes outdated. The steady conversations that help an

It is exacting work. It also has a very real

organisation make better decisions before a problem

public purpose.

turns into an incident. With experience across banking, government, IT For Roma Singh, Security Advisor at the Victorian

service management, risk, compliance and incident

Department of Transport and Planning, this is the

management, Roma brings a practical view of

day-to-day work of protecting a large and complex

security. She understands that good advice has

public-sector environment. Her role spans security

to work in the real world. It needs to protect an

advice, third-party risk, governance, architecture

organisation without bringing a project to a standstill,

reviews, information asset management and

and it needs the people involved to understand why

non-standard software approvals. Projects come

it matters.

before her at critical Gate 1 and Gate 2 enterprise architecture forums, where security needs to be

She has also been raising awareness of emerging

considered early, not bolted on later.

issues across government, including artificial intelligence and post-quantum cryptography.

Roma works across the detail: developing

These are not distant concerns. They are the

security playbooks, risk registers and treatment

next set of decisions public-sector organisations

plans; reviewing designs; supporting testing and

will need to make, often before there is a perfect

deployment; and helping stakeholders navigate

playbook available.

requirements including the Protective Security

200

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

But Roma’s contribution reaches well beyond

Roma knows something about navigating unfamiliar

the department.

ground. A migrant woman with more than 16 years in a male-dominated sector, she has faced messages

Through the AWSN Mentoring Program, Tangible

that she should step back or leave cybersecurity

Uplift Program, cyber boot camps and community

altogether. She chose another response: to keep

events, she has supported hundreds of women,

learning, keep showing up and make the path less

students and young people exploring careers in

difficult for those coming after her.

cybersecurity and STEM. She volunteers at AISA CyberCon Melbourne, BSides Melbourne, hackathons,

That is what makes her contribution so meaningful.

Capture the Flag activities and Girls in Tech events.

Roma is technically capable, deeply committed and

She has spent full days working with school students,

respected by her peers. Yet her real mark may be the

including around 1,000 girls at Amazon Girls in

confidence she leaves behind in others.

Tech in Melbourne, helping make cybersecurity feel possible rather than intimidating. For some, that encouragement has led to a first cyber role. For others, it has meant returning to work after a career break, pursuing further study, developing confidence in public speaking, or simply realising

In an industry often focused on technology, Roma Singh reminds us that resilience starts with people.

they belong in the industry.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

201

MAY • JUNE

IN 2022, YOU CAN NO LONG ER TAKE SECU RITY WORK ERS FOR GRAN TED P10-13

20 22 W W W. W O

AS THE SECU RITY THREAT MORP DEFE NSIV E HS, TEAM S MUST CHAN GE TOO P76-79 IF YOU CAN’T YOUR WAY TO SPEND SECURITY THISGOOD TRY FOCU SINGYEAR, ON YOUR PEOP LE P94-97

YEAR OF THE SECURITY WORKER

MENINSE

WHO RUNS

CURITYM

AGAZINE.

COM

WORLD the

W W W. W O

MENINSE

CURITYM

AGAZINE.

COM

TO O U R M A

GAZINE

MARCH • APRIL

Never miss an edition again! Subscribe to the magazine today for exclusive updates on upcoming events and future issues, along with bonus content. SUBSCRIBE NOW

AI IN CYBERSECURITY CHAMPION Proudly Sponsored by

Winner

Highly Commended

Nivedita Newar

Holly Wright

Yasaman Samadi

UNSW

Microsoft

RMIT University

FINALISTS Nivedita Newar

Deputy CISO at UNSW

Holly Wright

Penetration tester at Microsoft

YASAMAN SAMADI

Anmol Atkin

Senior IT Security Specialist at xero

Sarah Young

Director of Security at Microsoft

Rachel Choong

PhD Candidate and Researcher at RMIT University

Program & Project Manager at AGL

Harriet Farlow

Security Solution Specialist at Microsoft

CEO at Mileva Security Labs

Sujatha Santhosh

Manager, Cybersecurity Department of Communities at Department of Communities WA

Hazel Chen

Parisa Shojaei

Cybersecurity Risk Analyst, AI Security Governance and Cloud Security at Cultural Infusion

Malak Youssef

Cyber Security Engineer at DXC Technology

I S S U E 32

Highly Commended

NOMINEES Mahrita Harahap

Harriet Farlow

Patricia Calabro

Anmol Atkin

Shirin Jacobs

Yasaman Samadi

Tatyana Stojnic

Pranjali Mahabaley

Cairo Malet Rachel Choong Hazel Chen Aliah Al-Shabib Aoife O’Connell Sujatha M Nivedita Newar Anushree Kadam Reshma Devi Anita Williams Sharin Yeoh Courtney Parker

Parisa Shojaei Holly Wright Jyoti Kajrolkar Sarah Young Malak Youssef Nayna Jalnekar Tahire Wijetilaka Petrina Olds Adiba Zarin Mersija M Garima Chawla

WOMEN IN SECURITY MAGAZINE

203

NIVI NEWAR: TURNING AI AMBITION INTO SAFER PRACTICE Artificial intelligence is everywhere in cybersecurity conversations right now. It can be easy to talk about possibilities. Much harder to turn that possibility into work that is useful, secure, governed and trusted by the people expected to use it.

Nivi Newar has been doing precisely that at UNSW.

creating a practical way to consider issues such as data protection, model security, logging, vendor

As Deputy CISO, Nivi has helped move AI from

assurance and AI risk management before new

a future-facing idea into practical cybersecurity

technology is adopted at scale.

capability. Her work has focused on the less glamorous, but vital, part of AI adoption: making sure

For Nivi, though, technology is only part of

people understand the tools, know where the risks

the equation.

sit, and have the confidence to experiment without losing sight of security, privacy and accountability.

Across UNSW’s 80-person cybersecurity function, she has led an extensive capability uplift program,

Her approach has been hands-on from the beginning.

ensuring staff could access AI learning through

As early as 2023, Nivi was helping embed AI-enabled

UNSW, Microsoft, AWS and ISACA. She established

risk assessment, cyber assurance and security-

an Innovation Hub and regular showcase sessions

exemption capabilities into cybersecurity operations.

where people could test ideas, share what had

In 2024, she led delivery of an AWS Bedrock proof

worked and, just as importantly, discuss what

of concept that automated elements of cyber risk

had not.

assessments and exemption processes. The result was more than 75 AI and automation That alone would be a significant achievement. But

initiatives across the function. These ranged from

Nivi’s impact has been much broader.

automated risk and vendor assessments to policy advisory assistants, reporting workflows and

204

She contributed to UNSW’s AI Assurance Framework,

cyber awareness tools. They reduced repetitive

designing and implementing its AI Safety and

administrative work and gave staff more time for the

Security Pillar. She also helped introduce AI-specific

judgement, analysis and collaboration that security

guardrails into cybersecurity assessment processes,

work actually needs.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

The impact on the team has been telling. Employee

opportunities and back themselves before they feel

satisfaction rose from 56 per cent in 2024 to 89

completely ready.

per cent in 2025, with lower administrative burden, improved work-life balance and reduced burnout all

Her work has been shared with Microsoft, Telstra and

part of the story.

government cybersecurity teams, while her industry contribution has included speaking at forums such

Nivi has also made a point of ensuring that AI

as CrowdStrike’s CrowdTour Sydney and helping

capability is not reserved for the usual technical

drive discussions on AI-enabled threats, deepfakes

specialists. Through mentoring, sponsorship and

and prompt injection through the UNSW Cyber

community work, including as founder of TUP, she

Security Summit.

has encouraged women, non-binary people and professionals from non-traditional backgrounds to see a future in cybersecurity and AI. Having arrived in Australia as a migrant woman of colour without an established professional network, she understands how much difference visibility and practical support can make. She has used her own position to open doors: encouraging people to pursue

Nivi’s strength is that she does not treat responsible AI as a brake on innovation. She treats it as the thing that makes innovation worth doing. And that is a lesson the whole industry can take forward.

certifications, present at events, apply for leadership

I S S U E 32

WOMEN IN SECURITY MAGAZINE

205

HOLLY WRIGHT: BUILDING THE DEFENCES BEFORE THE PLAYBOOK EXISTS Holly Wright has made a career out of asking whether a hard cybersecurity problem can be solved differently than building the answer herself. As a penetration tester at Microsoft, she works at the sharp end of AI security, using AI to find vulnerabilities before attackers do and helping shape the safeguards needed as the technology moves into everyday products.

FOR HOLLY WRIGHT, AI HAS NEVER BEEN SOMETHING TO WAIT FOR.

It is an unusual vantage point, and one she has

Long before “AI-ready” became a phrase attached to

offensive security, defensive tooling and AI

every technology strategy, Holly was building with

product development.

earned over more than a decade working across

it, testing it and working out how it could genuinely improve security. Not in theory. In real products, with

“I understand how attacks work because I run them,”

real users, and with the uncomfortable understanding

Holly says. “I understand how defences fail because

that every new capability can also create a new

I’ve spent a decade helping organisations spot when

way in.

it happens.”

Today, as a penetration tester at Microsoft, Holly

That dual perspective has shaped much of her work.

tests AI-specific attack surfaces across products

Earlier in her career, Holly helped design and deliver

used by millions of people and organisations

QRadar Network Threat Analytics from the ground

worldwide, including Teams, Outlook, Exchange

up, turning the case for a machine-learning capability

Online, SharePoint and OneDrive. Her job is to think

into a released product. She also developed AI-driven

like an adversary: find the weak point, validate the risk

identity security capabilities and contributed to work

and help close it before someone else finds it first.

protecting logins and digital credentials against online fraud.

206

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

More recently, she developed a prompt shield

tools and testing methods where established ones

prototype for runtime protection of large language

do not yet exist.

model applications. It was designed to defend against prompt injection attacks at the application

But she does not keep that knowledge to herself.

layer and won IBM’s Think Tank competition. Prompt injection is one of the emerging risks in AI-enabled

Holly has spoken at AISA CyberCon, AWSN, the Cloud

systems, where malicious instructions can influence

Security Alliance, Engineers Australia and university

a model’s behaviour or steer it away from its intended

events, sharing practical lessons on attacking and

purpose. Holly was working on practical defences

defending LLMs. She has mentored through Griffith

while much of the industry was still getting its head

University, supported interns at IBM and Microsoft,

around the problem.

and worked with school students through programs including the Queensland Premier’s Coding Challenge

She also led the creation of a bespoke LLM algorithm

and ABCN Goals.

that helps administrators create structured access policies with minimal prior knowledge, encoding

Her message has remained consistent: “You can’t be

security best practice into the process. The project

what you can’t see.”

moved from prototype to a funded, fast-tracked release in three months, requiring collaboration across globally distributed research and development teams. That pace matters. The AI security landscape is changing faster than conventional security playbooks can keep up. New models, attack techniques and vulnerabilities arrive constantly. Holly has met that

For Holly Wright, leadership is not about predicting the future of AI in cybersecurity. It is about doing the work now and making it easier for others to step into the field beside her.

challenge by working from first principles, building

I S S U E 32

WOMEN IN SECURITY MAGAZINE

207

YASAMAN SAMADI IS WORKING ON DIFFICULT PROBLEMS In cybersecurity, the most interesting work often happens where the map runs out. For Yasaman Samadi, PhD, that space sits between artificial intelligence, blockchain, financial crime and the security challenges that quantum computing may bring.

It is a demanding place to work. Cryptocurrency

has also contributed to wider industry conversations

laundering does not always follow a neat, single-

through Cyber Today, the Quantum Security Defence

chain path. Activity can move across networks,

Global forum, the inaugural QSECDEF Australia

leaving investigators to piece together incomplete

Summit and CyberWest Hub.

evidence. Yasaman’s research tackles that problem with graph-based AI and anomaly detection, looking

But technical achievement is only part of the story.

for patterns of behaviour that conventional, rulebased systems can miss.

Yasaman has made a point of creating room for other people to enter, participate and be seen.

What makes her work stand out is its practical intent.

Through Australian Professionals of Multicultural

This is not research kept safely behind an academic

Communities, she organised and moderated Seen,

wall. Through her collaboration with CloudTech

Heard, and Elevated Networking Night Melbourne.

Group, Yasaman has worked to connect technical

The event was designed to give women, non-binary

research with the realities faced by cybersecurity

people and other underrepresented professionals

teams: data that is noisy or limited, threats that

access to conversations that can otherwise feel

keep changing, and tools that need to be explainable

closed off or difficult to reach.

enough to support an investigation. That kind of work matters. A networking night will That bridge between research and practice is central

not fix the industry’s representation gap on its own,

to her leadership. Yasaman has completed her PhD in

but a good one can shift someone’s sense of what

Cybersecurity at RMIT University and now works as

is possible. It can provide a useful introduction, a

a Senior Cybersecurity Engineer. Her achievements

moment of confidence, or the practical advice that

include A+ ranked publications and a published book

helps a person take their next step.

focused on machine learning and data security. She

208

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Her involvement with Quantum Women carries the same purpose into highly specialised technical fields, where representation can be particularly thin. Yasaman is not asking for greater inclusion; she is helping build the connections that make it more likely. The Women in Security Awards recognised Yasaman as a Cybersecurity Champion in 2026. The award acknowledges her research, but also the way she uses visibility. She is showing that cybersecurity advocacy can involve rigorous technical work, public conversation and community-building often all at once.

That combination is Yasaman’s real contribution. She is helping the industry prepare for threats that are still evolving, while making sure more people have a place in shaping the response.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

209

PROTECTIVE SECURITY CHAMPION Proudly Sponsored by

Winner

Christina Rose Certis

FINALISTS

NOMINEES

Christina Rose

Sahar Zare

Vice President, Regulatory Compliance & Critical Infrastructure at Certis

Lakeisha Fitzpatrick

Rebecca Winfield Manager, Protective Services & Crisis Management at Insurance Australia Group

Cindy Boon Rhiana Mooney Adriana Jones

Rhiana Mooney

Christina Rose

OT Security Architect at Secolve

Tara Dharnikota

Rebecca Amore

Security Governance Manager at NBN

Rebecca Winfield

Adriana Jones

Luana Broederlow

Founder at The Innocent Souls Project

I S S U E 32

Bimal Jeet Kaur

WOMEN IN SECURITY MAGAZINE

211

CHRISTINA ROSE: SECURITY LEADERSHIP THAT STARTS WITH PEOPLE For more than three decades, Christina Rose has worked in the places where protective security becomes very real: airports, operations centres, government frameworks and crisis environments. Her impact reaches beyond her own career. It sits in the people she has brought through the industry, the systems she has helped shape, and the quiet practical decisions that have kept others safe.

Christina was one of the first women to hold a senior

International Women’s Day presentation broadcast

aviation security leadership role at a Tier 1 Australian

across her organisation. It was personal, honest, and

airport. At the time, women in those roles were

clearly landed with the people listening.

rare. She did not treat that as a personal victory and moved on. She recruited women, backed them, and

In 2026, she was invited to speak at the iSpring Days

made room for them to grow. Many of those early

APAC Conference on employment equity in security.

colleagues are now leaders across airports, airlines,

The invitation was unsolicited. The organisers had

government and critical infrastructure.

found her work and wanted her voice in the room.

That is a powerful measure of leadership. Not simply

Christina’s career has also helped push the

being the first person through the door, but keeping

conversation on security convergence forward.

it open.

She co-authored a chapter in Cybersecurity in Transport Security Systems, drawing on experience

212

Her support continues through active mentoring

across aviation, critical infrastructure and complex

with the Australian Women in Security Network

operational environments. Her work has consistently

and ilead, as well as direct sponsorship of an

recognised something the sector is still getting used

emerging professional through the Institute of

to: physical and digital security are not separate

Resilience Emerging Leader Scholarship. In 2025,

issues when an incident is unfolding. They are part of

Christina shared her own professional journey in an

the same risk picture.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

At Qantas Group, Christina held executive oversight of the Duty Security Controller function within the Integrated Operations Centre. The role involved responding to security events across physical, operational and systems-based dimensions, while working with law enforcement and government regulators in real time. It is demanding work. Decisions need to be clear, quick, and grounded in the people affected by them. Her response during the 2024 civil unrest in New Caledonia showed that clearly. Stranded for nine days while undertaking regulatory work, Christina provided on-the-ground intelligence to airlines with affected passengers, acted as a liaison with DFAT, supported distressed travellers and local staff, and retrieved supplies for others despite the risks. She later received an Honourable Mention at the ASIAL Security Industry Awards 2025. There is a thread running through all of it. During COVID, Christina helped redeploy aviation security personnel into hospitals and health facilities rather than see them stood down. Through her volunteer work with the Australian Federal Police Veterans Association, she has continued to support the people behind the protective security system. She also secured a $10,000 Qantas Group grant for the association in 2023.

Christina Rose understands that security is ultimately about people. The technology, training, regulation and response plans matter enormously. But so does who gets supported, who gets heard, and who is given the confidence to lead next.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

213

Yasmin helps Australians stay secure online.

Be part of something bigger. Do you want to tackle tech challenges that don’t exist anywhere else? Or lead a team disrupting cybercrime? Are you interested in strengthening Australia’s cyber resilience while protecting critical infrastructure? Or helping keep citizens secure online? Then we need you on our team at the Australian Signals Directorate.

ASD is hiring. Apply now. asd.gov.au/careers

214

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

BEST PROGRAM FOR YOUNG INDIVIDUALS IN SECURITY Proudly Sponsored by

Winner One

Winner Two

P-TECH at Camberwell High School

GPN Junior

FINALISTS Girls Programming Network Junior

P-TECH at Camberwell High School Cybermarvel - See Yourself in Cyber Tangible Uplift Program (TUP) Fortinet Education Outreach Program — Empowering Young Women and Non-Binary Individuals in Cybersecurity

NOMINEES Palo Alto Networks CyberFit Nation Program Girls Programming Network Junior Incident Response Competition IAG

AWSN Incident Response Competition

P-TECH at Camberwell High School

CyberFit Nation Program

Mentoring Program

WorkPath Australia

Orro University

I S S U E 32

Scholarship Program Fortinet Training Institute — Education Outreach Program Cyber Kickstart Pathways Tangible Uplift Program WorkPath Australia See Yourself in Cyber

WOMEN IN SECURITY MAGAZINE

215

A PROGRAM THAT MAKES TECH FEEL POSSIBLE At Camberwell High School, technology careers are not being presented as some far-off destination for a select few. Through its P-TECH program, students are meeting the people who work in cybersecurity, visiting workplaces, tackling research projects and beginning to picture themselves in the industry. It sounds simple. It is not.

For many young women, the decision to pursue

For female and non-binary students, that visibility

technology can be shaped well before university

matters. Mentors and role models help challenge

applications are due. If they do not see people

the old idea that technology is a boys’ club, while

like them working in the field, or if they assume

direct contact with industry makes the field feel less

cybersecurity is only for a particular type of student,

intimidating and more achievable.

they can quietly opt out. Camberwell High School’s P-TECH program has been working to interrupt that

Matilda’s experience captures what that can look like

pattern since 2020.

in practice.

The industry-connected learning initiative links

She joined Camberwell High School’s Launch

students with mentors, workplace experiences, guest

program in Year 9 in 2022 and took part in P-TECH

speakers and practical project and thesis work. It

the following year. With support from an industry

brings the working world into the school and gives

mentor, she researched cybersecurity and wrote

students a clearer view of the many routes into

a thesis on zero-day attacks. She then completed

technology, cybersecurity and their related fields.

work experience with NBN Co, stayed in touch with her workplace mentor, and added Computing to her

The program does not treat technical knowledge

VCE pathway.

as the whole answer. Students are encouraged

216

to develop confidence, communication skills and

After graduating in 2025, Matilda began university

professional networks alongside their understanding

in 2026 to study IT and Science, majoring in

of cybersecurity concepts. They can ask questions

cybersecurity. She has credited the opportunities

of people already doing the work, hear what a real

she received through P-TECH particularly her work

career looks like, and test their own interests in a

experience placement with giving her the confidence

supportive setting.

to commit to a future in the field.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

That is the kind of shift the program is designed to

These moments matter because they connect

create. Not pushing students into a predetermined

classroom learning to actual workplaces, actual

career but letting them see enough of the industry to

people and actual problems.

make an informed and confident choice. With around 35 per cent female participation in each P-TECH is supported by a growing group of industry

cohort, P-TECH is helping build a stronger, more

and tertiary partners, including NBN Co, Trustwave,

representative technology pipeline. It is also giving

Visy, MYOB, the University of Melbourne and

industry a chance to meet the people who may one

Swinburne University. In Year 10, 25 students have

day shape it.

taken part in mentoring activities with around 25 industry mentors, allowing for meaningful one-onone support while they complete their cybersecurity thesis research. In 2025, students also participated in workplace visits, industry presentations and career-focused

For students at Camberwell High School, cybersecurity is no longer just something they read about, it is becoming a place they can belong.

activities delivered with program partners.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

217

WHERE A CYBERSECURITY JOURNEY CAN BEGIN A room full of primary school students solving code puzzles may not look like the beginning of Australia’s future cybersecurity workforce. But that is exactly what GPN Junior is building one curious question, one Morse Code clue, one encouraging mentor at a time.

Created by Tech Inclusion’s Girls’ Programming

a little bit noisy. More importantly, it gives young

Network, GPN Junior introduces girls and gender-

people permission to experiment without worrying

diverse students in Years 3 to 6 to technology and

about getting the answer wrong.

cybersecurity before they have had time to decide it is “not for them”. That matters more than it sounds.

The program began as a Sydney pilot in early 2024. Across its first eight workshops in 2024 and

By upper primary school, many children have

2025, GPN Junior welcomed 459 primary school

already absorbed the idea that technology belongs

students and mobilised 277 volunteers. Half of

to somebody else. Maybe it is the loudest kid in

those volunteers came from high school, creating a

the room. Maybe it is the person in a hoodie they

powerful cycle of encouragement that is central to

have seen on television. Maybe they have tried a

the program’s impact.

coding activity once, felt behind, and quietly ruled themselves out.

For a Year 4 student, seeing an older girl confidently explain a cyber activity can change the shape of

GPN Junior offers a different first experience.

what feels possible. These mentors are not distant experts. They are relatable. They remember what

The half-day workshops combine an hour of block-

it was like to be new to coding, unsure about

based coding using accessible tools such as Scratch

technology, or worried they would not fit in.

and Blockly with practical, unplugged activities that

218

bring cybersecurity concepts off the screen. Students

The experience works both ways. Across the first

might decode messages in Morse Code, tackle a

eight events, 143 high school girls and gender-

scavenger hunt, work through a puzzle, or discover

diverse students stepped up as volunteers. They

how computers use information. It is hands-on and

gained real experience explaining technical concepts,

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

working with younger students and leading activities.

Participant feedback suggests the program is getting

Some have spoken about building confidence,

the balance right, with 97 per cent of students rating

strengthening their resumes and feeling more

their workshop experience three or higher out of

connected to a future in cybersecurity. One volunteer

five. In the first quarter of 2026, GPN Junior reached

told an organiser she could not sleep the night before

another 85 students and engaged 40 volunteers.

an event because she was so excited. That enthusiasm is contagious. One parent shared that her daughter had been put off technology by a previous program. She agreed to try GPN Junior and, by the end of the day, was asking when she could come back. It is a small story, perhaps. But it gets to the heart of the work: confidence can be fragile, especially when it is

GPN Junior is not trying to turn every child into a cybersecurity professional by lunchtime. It is doing something more useful. It is making sure more young people can imagine themselves becoming one.

still forming.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

219

Want to get matched with Lead Gen experts but dont know where to start?

Our solution experts can help you find the right supplier, Looking to streamline your B2B lead generation process?

Want to use multiple suppliers but dont have time to coordinate? Need a consistent stream of leads coming into the sales team? Looking to tap into new markets? Need end-to-end lead nurture programs?

LET US HELP YOU OVERCOME YOUR LEAD GEN CHALLENGES REACH OUT TODAY FOR AN INSTANT QUOTE. The team at Source2Create has all the necessary skills to get the job done for you, so your time can be reserved to focus on other things.

With:

aby@source2create.com.au charlie@source2create.com.au source2create.com.au

CYBERSECURITY CHAMPION Proudly Sponsored by

Winner

Highly Commended

Susana Pentland

Farah Harrison

Radha Ramadev

CyberCX

BHP

TAL Australia

FINALISTS Amelia Edge

Community and Volunteer Manager at AWSN

Susana Pentland Cyber Capability, Education and Training Consultant at CyberCX

Sarah Barnbrook Founder and CEO at Away from Keyboard Inc.

Farah Harrison

Manager CyberAware at BHP

Kritika Bhardwaj Head of Security Operations at Fortescue

Nikki Peever

Director Cybersecurity at CAUDIT

Radha Ramadev Manager – Attack Surface Management, Cyber Threat Management at TAL Australia

Roma Singh

Security Advisor at Department of Transport and Planning

Anya Avinash

Head of Cyber Security at BankFirst

Giang Phung Cyber Security Consultant at Retrospect Labs

Belinda Noel

Chief Growth Officer at Secolve

Keryn McMartin Identity Consultant at IdentityXP

NOMINEES Bahar Fardaran

Amelia Edge

Senior Lead Security Solution Architect at Lumen Technologies

Mersija Mujic

Rini Ismail

Catt Tyree

Head of Advocacy and Community at AWSN

Sarah Sloan

Head of Cybersecurity Policy, APAC at Cisco

Zara Ta

Cloud Solution Architect - Security at Microsoft

Elese Cox

Sales Engineer at Mimecast

Bec Caldwell

Cyber Intelligence Engagement Specialist at CyberCX

Emily Tabet

ISO27001 Audit and Assurance Service Lead at Phronesis Security

I S S U E 32

Rini Ismail

Lucy Ford

Kritika Bhardwaj

Sarah Barnbrook

Farah Harrison

Saba Bagheri

Hardi Shah

Henriette Elise Onarheim

Shifali Shifali

Elese Cox

Nicole Henry

Carmen Cheung

Radha Ramadev

Prapurna Uppuluri

Sakshi Kishore

Jessica Levasseur Lima Bezerra

Sevtap Kazim

Sarah Sloan

Susana Pentland

Emily Tabet

Anita Williams Becky Wan Yasaman Samadi Sahar Zare Nikki Peever Belinda Noel Luisa Amanda Bec Caldwell Jenelle Leighton Sush Gupta Anya Avinash

Natasha Moodley

Ash Hucker

Keryn Mcmartin

Giang Phung

Cosi Robinson

Bahar Fardaran

Roma Singh

Ankita Tripathi

Madhuri Nandi

Anureet Kaur

Ankita Singh

Marysia Orlowski

Ellen Brookes Zara Ta Gergana Winzer Zeena Skelly

Stella Park Marion Rehehan Sherley Pidakala

Biljana Roksandic

WOMEN IN SECURITY MAGAZINE

221

MAKING CYBERSECURITY FEEL WITHIN REACH Susana Pentland knows what it feels like to enter cybersecurity without the neat, traditional pathway story many people assume they need. No obvious straight line into the industry. Just curiosity, determination, and a willingness to keep showing up.

That experience has shaped the way Susana works

matter. They make space for people to say, “I feel

now as a Cyber Capability, Education and Training

that too,” and perhaps stay in the industry a little

Consultant at CyberCX. She is building her own

longer because of it.

career, certainly, but she is also making the path less daunting for the people coming behind her

Susana’s standout contributions at CyberCX are

particularly women, career changers and those

her role as a Cyber Awareness & Training Lead for

wondering whether they belong in cyber at all.

Scentre Group (Westfields) and her work as an educator in CyberCX’s Cyber5050 microcredential

Susana is an active part of CyberCX’s Women in

program. She turns complex concepts into practical,

Security initiative, where she speaks with colleagues

usable knowledge for people new to the sector,

and women who are new or starting out on their

helping demystify cybersecurity for those who may

journey, about backing themselves and bringing

not arrive through a conventional technical pathway.

their full experience to the table. It is a message

She also hosts and moderates the Cyber5050

that carries weight because she does not present

panel talk series, where women working across

cybersecurity as an exclusive club for people who

the security industry speak openly about career

have always known how to code or build computers

pivots, motherhood, mentorship, leadership and the

as children.

pressure to prove themselves in a fast-moving field.

Instead, she talks honestly about the realities many

These conversations challenge the idea that there

women encounter: imposter syndrome, being

is only one kind of cybersecurity professional, and

the only woman in the room, and the uncertainty

only one pathway into cyber. That idea has quietly

that can come with making a career shift. Those

excluded plenty of capable people for years.

conversations are not always comfortable, but they

222

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Her commitment to accessible cyber education also reaches well beyond the workplace. Susana authored Cyber Security for All Kids and Cyber Security for All Seniors, a book series designed to spark everyday family conversations about safe online habits. The series is a thoughtful response to a very real gap. Cybersecurity is often spoken about in boardrooms and specialist circles, yet so many of our most important security habits begin at home around the kitchen table, on a child’s first device, or in a hurried conversation before school. She has also helped deliver cyber awareness talks and interactive social engineering activities at HerTechPath’s Dare to Dream: STEM Careers for Girls events, reaching more than 160 high school students in Adelaide and Sydney. For young women considering a future in STEM, seeing someone who is relatable and genuinely passionate about cyber can have more impact than another brochure about career options. Within CyberCX, Susana has supported new graduates through the very buddy program that once helped her. Beyond CyberCX, she is also an active mentor to cyber and engineering students at UNSW. She know’s first-hand how valuable it is to have someone answer the small questions, offer encouragement after a tough week, or simply make a workplace feel less foreign. Susana’s contribution is a reminder that innovation in cybersecurity is not only about new tools or technical breakthroughs. It is also about people. Who feels welcome. Who receives support early enough to persist. Who gets the chance to see their own potential before they talk themselves out of it.

That is the work Susana Pentland is doing, with generosity and real purpose.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

223

FARAH HARRISON IS MAKING CYBER EVERYONE’S BUSINESS Cybersecurity can still feel like a closed room. Too technical. Too complicated. Somebody else’s responsibility. Farah Harrison has spent much of her career opening that room up.

At BHP, where she leads global cybersecurity

and one-on-one support from Cyber Buddies are all

awareness and training, Farah is helping reshape the

part of the approach. The aim is not to turn every

conversation away from compliance checklists and

employee into a cyber specialist. It is to give people

IT jargon towards something far more practical: what

the confidence to notice a suspicious email, report an

people can do, every day, to help keep themselves,

issue, ask a question, or make a safer decision when

their colleagues and the business safer.

it counts.

The scale makes that challenge significant. BHP

At the heart of that work is BHP’s Cyber Academy,

has a workforce of around 90,000 people spanning

a six-month program Farah founded & established

corporate offices, mine sites, operational teams and

for non-technical employees. Since its launch, the

communities across the world. Not everyone sits at

Academy has produced more than 200 graduates

a desk. Not everyone has a technical background.

across BHP’s global operations. These graduates

Farah recognises that a one-size-fits-all approach will

are not just completing a course and moving on.

not work. Cyber education has to meet people where

Many have become cyber advocates within their

they are, particularly those who may not sit behind a

teams, helping reinforce good habits and making

desk or come from a technical background.

cybersecurity part of everyday conversations.

That philosophy sits at the heart of her approach:

That ripple effect is where Farah’s leadership

make complex cyber risks relevant rather than

really shows.

intimidating and turn awareness into practical action. The Academy was designed with a clear

224

Her work is built around making complex risks feel

understanding of real working life. People are busy.

relevant rather than intimidating. Short learning

Frontline teams have competing priorities. Long

modules, real-life scenarios, monthly Cyber Talks

training sessions can easily become another thing to

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

put off. Farah and her team tackled that by keeping

to Work initiatives and Women in Cyber network.

learning flexible and manageable, with short on-

Her mentoring also reaches high school students

demand modules of 20 minutes or less, ongoing

through Victoria’s P-TECH program, as well as

conversations and a structured mentoring model that

women and children from migrant communities in

connects participants with Cyber Buddies.

regional Victoria.

She has also taken cyber safety beyond the

There is something quietly powerful about Farah’s

workplace. Farah led BHP’s inaugural Cyber for

approach. She does not separate resilience from

Kids initiative, engaging more than 100 children

inclusion, or technical capability from human

and families in conversations about online safety at

confidence. She sees them as connected.

home. Through Cybersecurity Awareness Month, she has helped reach more than 4,500 people across 18 global locations, including operational sites that are often overlooked in traditional awareness programs. Just as importantly, Farah has used her influence to create pathways into the profession for people who may not see cybersecurity as an obvious option. She supports women and non-binary people

By making cybersecurity understandable, useful and shared, Farah Harrison is helping build a stronger culture at BHP and showing what modern cyber leadership can look like.

through BHP’s Technical Entry Program, Return

I S S U E 32

WOMEN IN SECURITY MAGAZINE

225

RADHA RAMADEV: BUILDING SECURITY THAT LASTS In cybersecurity, the visible moments tend to get the attention: the incident contained, the attacker found, the critical vulnerability closed before it becomes a headline.

But strong security is usually built much earlier. In

incident. By equipping them to identify and escalate

the training session that helps someone recognise

potential threats, Radha has widened TAL’s defensive

a suspicious email. In the new starter who is

capability and given non-security staff a meaningful

made to feel capable from day one. In the regular

role in protecting the business.

conversation with a technology team that turns a security problem from someone else’s issue into a

She also designed TAL’s Cyber New Joiner

shared responsibility.

induction program. It gives new team members a structured introduction to the function, its systems,

That is where Radha Ramadev has made her mark.

expectations and ways of working. For people entering cybersecurity — particularly those without

As Manager of Cyber Threat Management at

a traditional security background — that kind of

TAL, Radha leads work across attack surface

practical support can change the whole experience

management, threat detection, vulnerability

of joining a team.

remediation and incident response. She is technically accomplished, but her leadership extends beyond

Radha knows this personally. A decade into her cyber

the technical. She has worked deliberately to make

career, she has worked through the extra layers that

cybersecurity feel less like an exclusive specialist

can come with being a woman in a technical field still

function and more like a collective responsibility.

dominated by men, while balancing the demands of an always-on profession with raising a family. She

One example is the cybersecurity training she

has not made that experience the centre of her story.

has delivered for TAL’s helpdesk staff. These are

Instead, she has used it to create better conditions

colleagues who do not work in security every day,

for others.

yet they are often close to the early signs of an

226

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

In 2025, her team delivered serious results. Radha led TAL’s Windows 11 CIS Level 2 compliance rollout, alongside passwordless authentication, ThreatLocker endpoint protections, automated monitoring and dark web scanning. For the second consecutive year, TAL maintained zero externally facing vulnerabilities with a CVSS score of 7 or above. Then came the test. During a three-month external red team assessment, TAL faced simulated Wi-Fi intrusion, Microsoft 365 compromise and insider-threat scenarios. Every attack path was detected and contained. In the most difficult M365 scenario, Radha personally worked through the available log data and identified the attacker’s account while the adversary was active in the environment. The team achieved a 100 per cent remediation rate across more than 15 highpriority findings. She also led TAL’s participation in Exercise Cyber Arrow, the national incident-response simulation run by the Australian Signals Directorate and Australian Cyber Security Centre. TAL’s performance reflected the capabilities Radha has steadily built: rapid containment, active threat hunting and effective collaboration between cyber, infrastructure and operations. Her style is calm rather than showy. When faced with incomplete information, she has learned not to wait for perfect certainty. She escalates early, watches closely and backs her team to act.

Radha’s contribution is not just a stronger security posture. It is a stronger culture, one where people are prepared, trusted and able to respond when it counts.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

227

INTERESTED IN WORKING TOGETHER? Contact Aby Aby@source2create.com.au www.source2create.com.au

MEDIA

CONTENT

EVENTS

ADVERTISING

CUSTOM AS-A-SERVICE

BEST PLACE TO WORK IN SECURITY Proudly Sponsored by

Winner

Highly Commended

TAL

Grant Thornton Australia

Fujitsu

FINALISTS

NOMINEES

Grant Thornton Australia

Securoak

Australian Super

TAL Australia

Avanade

TAL Australia

Fujitsu Cyber

Infoblox

CSIRO

CSIRO Integrity Unit Security and Risk

Grant Thornton Australia

Australian Super Avanade PwC Retrospect Labs IAG Mission Australia Hub24

I S S U E 32

ANZ

PwC Australia

Hub24

IAG (Insurance Australia Group)

Mission Australia

Retrospect Labs Solis Fujitsu Cyber

Bank First StealthCyber Bupa Datacom

WOMEN IN SECURITY MAGAZINE

229

TAL: WHERE INCLUSION SHOWS UP IN THE SECURITY TEAM

TAL has been named the Best Place to Work in Security at the 2026 Women in Security Awards, and the win lands because the organisation’s approach feels less like a campaign and more like a culture that has had time to take root.

At the centre of it is a cyber security team of

In October 2024, Fiona became TAL’s Group CEO and

more than 40 specialists, working across threat

Managing Director, carrying that same belief into the

management, DevSecOps, identity and access

organisation’s top role.

management, governance, architecture and

230

transformation. Half of those roles are now held

This year, the strength of that groundwork has

by women, the first business unit at TAL to reach

been particularly visible in the leadership of the

gender parity.

cyber function.

That result did not suddenly appear in 2026. When

Maryam Bechtel was appointed Chief Information

Fiona Macgregor was TAL’s Chief Information

Security Officer in late 2025, then commenced

Officer, she helped grow the cyber security function

parental leave in May. TAL promoted Samer Fouani

from a small team into the substantial capability

internally to Acting CISO, her first appointment to

it is today. She made diversity part of the way the

the role. When Maryam returns, Samer will become

team was built, not something added after the fact.

Deputy CISO and Head of Cyber Transformation.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

It is a meaningful picture: one woman supported

There is also clear investment in the conditions that

taking parental leave without stepping away from

let people stay and progress. TAL provides 16 weeks

her career, while another steps into the CISO role

of funded parental leave for primary carers, pays

after building a strong track record in technology

superannuation for up to 12 months of leave, and

governance, resilience, CPS 230 obligations and

guarantees flexible work on return. More than 43

third-party risk.

per cent of TAL’s senior leadership roles are held by women, above its 40:40:20 target.

“It’s rewarding to work with our teams to make a tangible difference in digital safety, uplifting controls and strengthening our resilience as threats evolve,” Samer says. TAL’s work is not confined to senior appointments. Its Cyber Academy is creating a practical pathway into the profession. The first cohort was 75 per cent women, and two women from that group have progressed into TAL’s technology graduate program. A graduate from the 2024 intake has since secured a permanent Security Engineer role in Architecture and

For an industry still working to broaden who sees security as a career they can belong in, TAL is showing what sustained effort can look like. Not perfect language in a policy document. Real people moving into roles with responsibility, support and room to grow. That is why this award feels well earned.

Cloud Security.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

231

GRANT THORNTON AUSTRALIA: HIGHLY COMMENDED BEST PLACE TO WORK -

Women make up around 60 per cent of Grant Thornton Australia’s internal cyber security function. They work across governance, risk and compliance, threat detection, offensive security, cloud security, vulnerability management, incident response and ISO 27001 governance.

At the helm is Head of Cyber Security Jessica

Manager level. One female Partner leads the firm’s

Jones, whose work has helped lift the firm’s cyber

national Cyber Resilience practice and was previously

strategy and connect security capability with the

recognised as the Australian Women in Security

broader needs of the business. Earlier this year,

Awards’ Most Outstanding Woman in IT Security.

Jones was named Cyber Professional of the Year by CyberDaily. It is a welcome recognition, but it also

MORE THAN A HEADCOUNT

reflects something her team sees day to day: security

There is a difference between having representation

leadership that makes room for people to learn,

and creating the conditions for people to stay,

challenge ideas and take ownership.

develop and lead.

“There was a conscious decision to build a team

Grant Thornton has put practical support behind

where people feel they truly belong,” Jessica says.

that distinction. The firm’s Security Journey platform

“Cyber security is not traditionally a diverse industry

provides role-based training pathways, while Cyber

and I didn’t want us to be another team that accepted

Credly Badges recognise capability development in

that as the norm.”

a way that is visible across the organisation. Team members can build technical depth without feeling

That decision is visible beyond the internal team.

they have to follow one fixed career route.

In Grant Thornton’s 16-person Technical Risk Consulting practice, six women work in client-facing

The Cyber Champions program also gives people an

cyber and risk roles, including at Partner and Senior

opportunity to be recognised for strengthening cyber resilience across the business.

232

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Grant Thornton provides a platform for all team

Grant Thornton has also made a point of involving

members to present, influence behaviour and put

allies. Its allyship training asks men to move beyond

their expertise in front of a wider audience all year

good intentions and take practical action when they

round. This is particularly apparent during Cyber

see bias or barriers at work.

Awareness Month where the team creates regional hubs to host workshops and information sessions

The organisation’s Speak Up campaign adds

with all employees.

another layer, offering confidential conversations, an anonymous tip line and clear pathways for raising

Flexible work is well established at the firm through

concerns about discrimination, harassment or

its Flex Appeal policy, which enables roles to be

unacceptable behaviour.

performed through hybrid, part-time or adjusted working arrangements. In 2023, Grant Thornton

For Jessica, the outcome is simple: a team where

adopted a nine-day fortnight at full pay for all its

high performance and wellbeing are not treated as

people. The firm also offers 26 weeks of parental

opposing ideas.

leave, including superannuation payments during unpaid leave.

“That is what I am most proud of,” she says. “People feel safe to speak up, challenge ideas and lead.”

These details matter, particularly in cyber, where incident response can be demanding and careers can easily become shaped by who is most available at the loudest moments.

A CULTURE THAT SPEAKS UP The firm’s Gender Equity Network (GEN) has created a useful place for honest conversations that do not always fit neatly into a formal development program. Its ‘GENerator Circles’ bring small groups together across offices to talk through issues such as confidence, sponsorship, career decisions and the

In a sector still working to improve representation, Grant Thornton’s win offers a grounded example of what can happen when inclusion is built into hiring, development and the everyday rhythm of a security team.

mental load many women carry.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

233

FUJITSU CYBER: MAKING ROOM AT THE TABLE Fujitsu Cyber has been named Highly Commended Best Place to Work in Security at the 2026 Women in Security Awards, recognised for something the cyber sector still needs more of: women being visible not only in entry-level roles, but in technical work, client delivery and leadership.

Women make up 50 per cent of Fujitsu Cyber’s

Laura’s approach has centred on mentoring, practical

division, well above the 17 per cent industry

support and making space for people to develop

benchmark cited in its nomination. They are spread

confidence. It is not just about encouraging women

across Advisory and Assurance, Security Operations,

to apply for the next role; it is about removing some

Incident Response and Technical Consulting,

of the quiet barriers that can make a career in

supporting government, health and education clients

security feel harder than it needs to be.

around the country. Women from Fujitsu Cyber are also taking that That matters. Cybersecurity does not get stronger

work outside the company. They mentor students

when everyone in the room has the same

and emerging practitioners through organisations

background, career path or instinct about risk.

including the Australian National University, Women in ICT, the Australian Women in Security Network,

Laura O’Neill, who leads Cyber Advisory at Uvance

AISA and Canberra Cyber Hub.

Wayfinders, Fujitsu’s consulting arm, has helped shape a part of the business where women are well

The workplace policies behind the result are

represented in senior roles.

substantial. Fujitsu Cyber provides funded training and certification opportunities, with development

Across the wider cyber leadership group, 38.5 per

intended to be accessible across the team rather

cent of senior security roles are held by women.

than reserved for a select few. Its graduate and early-

Fujitsu has also reached gender balance in its

career programs use inclusive language and targeted

Tech Expert Circle program, which supports

outreach through universities, STEM programs and

technical leadership and career progression for

diversity networks.

specialist practitioners.

234

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

The organisation also takes a more flexible view of

Its reported median gender pay gap is 4.69 per cent

what makes a good cyber candidate. Recruitment

and average gap 0.14 per cent, below the national

focuses on capability and potential, rather than

median benchmark referenced in the nomination.

relying too heavily on traditional qualifications or a

Fujitsu continues to review pay data and address

narrow idea of the “perfect” background.

emerging gaps.

Candidates are assessed through anonymised

There are clear channels for reporting discrimination,

processes designed to reduce gender bias, while

bias and harassment, alongside mandatory training

interview panels include at least 50 per cent women

in unconscious bias, inclusion and workplace

and people from diverse backgrounds. Promotion

conduct. Employee feedback through engagement

is based on capability and readiness, a small but

surveys helps inform where the organisation needs

important distinction in an industry where many

to do better.

capable people, particularly women, can hesitate to put themselves forward unless they meet every criterion. Fujitsu’s commitment is also visible in the policies that support people through the less predictable parts of life. The company offers flexible work arrangements, enhanced parental leave, family and domestic violence leave, menopause leave and fertility leave available to employees of any gender affected by fertility treatment or related care. It has also removed the previous 12-month waiting period for primary

Fujitsu Cyber’s win is not simply about reaching a percentage. It is about building a team where women can be technical experts, trusted advisers, incident responders and leaders then stay long enough to reshape the industry for those coming behind them.

parental leave.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

235

SAVE ON HIRING COSTS Let Us Join Your Team Now !!! "Get skilled support to fill your team’s gaps at the same wage rate. Source2Create provides a team of professionals across marketing, social media, admin, and content management, ready to enhance productivity without adding strain to your budget."

DO YOU CURRENTLY HAVE ANY OF THE FOLLOWING REMOTE OPEN POSITIONS? Marketing support

Admin support

Marketing strategy

Canva ad creators

Event coordinators/managers Telemarketers

Wordpress content administrator

Linkedin/Instagram managers

Admin and Data Entry

SCHEDULE A CALL TODAY OR EMAIL ABY ABY@SOURCE2CREATE.COM.AU www.source2create.com.au

MOST OUTSTANDING IN PROTECTIVE SECURITY Proudly Sponsored by

Winner One

Winner Two

Lacey Shields

Jodee Pollard

National Disability Insurance Agency

Macquarie Group

FINALISTS

NOMINEES

Marina Toailoa

Bridie Thomas

Alexandra Marshall

Luana Broederlow

Founder of Mummy Safety Security Project

Chief Operating Officer at Certis Security Australia

Fadzayi Moyo

Maryam Shoraka

Jodee Pollard

Andi Gynn

Ana Lewis

Biljana Roksandic

Regional Security Director at Macquarie Group

Director & Chief Security Officer at Servare Consulting

Saba Bagheri

Taylor Shera

Sarah Wood

Marina Azar Toailoa

Tara Dharnikota CISO at Victoria University

Sarah Wood Senior Manager, Physical Security Fund Services at Australian Super

Lacey Shields Director Safety, Wellbeing and Security at National Disability Insurance Agency

Alexandra Marshall

Yashmin Lata Bridie Thomas Jodee Pollard Andi Gynn

Lacey Shields Priya Gnanasekaran Tara Dharnikota

Manager at Tasmania Government

I S S U E 32

WOMEN IN SECURITY MAGAZINE

237

LACEY SHIELDS: LEADING SECURITY WITH PURPOSE When Lacey Shields talks about protective security, the focus is never just on systems, compliance or the latest risk register. It is about people, the staff going to work each day, the communities interacting with government services, and the teams responsible for making difficult decisions when the stakes are high.

That people-first approach, paired with an

During the Northern Rivers floods, Lacey established

exceptional record of delivery, is why Lacey has been

crisis-management reporting arrangements that

named Australia’s Exemplary Leader in Protective

helped support the Department’s response during

Security at the 2026 Women in Security Awards.

an extraordinarily difficult period. The approach was endorsed by the Attorney-General and contributed

Across a career spanning government, financial

to the formation of the DCJ Flood Recovery

services and nationally dispersed public-facing

Taskforce. It is the kind of achievement that can

organisations, Lacey has repeatedly stepped into

look tidy in a report afterwards, but in the moment

complex environments where security capability

it means creating clarity amid pressure, competing

needed strengthening. She has a knack for getting

information and urgency.

beneath the surface quickly, building trust with operational teams, and turning big recommendations

In her current work across the disability sector, Lacey

into work that actually changes things on the ground.

has continued to reshape how protective security operates. She has led major security reform, built a

At the NSW Department of Communities and Justice,

national coordination capability, and introduced more

she managed major infrastructure and security

consistent approaches to site risk assessments,

programs across courts, correctional centres and

critical incident response and intelligence sharing.

youth justice facilities. Her work included more

Security is not treated as a separate function

than $100 million in security projects delivered over

sitting off to the side. It is connected to service

two years, alongside responsibility for high-value

delivery, people, property, communications and

infrastructure and service portfolios. The outcomes

organisational resilience.

were practical: safer environments, reduced risk of

238

inmate self-harm, and stronger incident response

That matters in an organisation serving

across some of the state’s most sensitive settings.

vulnerable Australians.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Lacey’s leadership style is collaborative rather than

Her own path gives that commitment added weight.

performative. She brings different disciplines into

Having left school before completing it, Lacey went

the same conversation and gives people room

on to earn a postgraduate degree in Security Studies

to challenge assumptions. Her multidisciplinary

and Criminology in 2021. It is a powerful reminder

incident-response model recognises that an incident

that capability is not always obvious on a CV at the

rarely affects only one part of an organisation. There

beginning. Sometimes it is built through persistence,

may be safety concerns, staff wellbeing issues,

curiosity and the decision to keep going.

reputational consequences and operational impacts all at once. She is also deliberate about who gets opportunities. In a sector still shaped by traditional ideas of what a security leader looks like, Lacey has worked to create leadership pathways for women and non-binary professionals. Her current leadership cohort reflects that intent, and she actively mentors emerging practitioners through formal programs and day-to-

Lacey Shields is an outstanding leader because she delivers under pressure, makes security more human, and leaves organisations stronger than she found them. That is leadership worth recognising.

day support.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

239

JODEE POLLARD: CALM LEADERSHIP WHEN IT COUNTS There are security leaders who are excellent at managing risk on paper. Then there are people like Jodee Pollard, who can walk into a complicated room, bring the right people together and make the work move forward.

Named Australia’s Most Outstanding in Protective

As Regional Security Director ANZ at Macquarie,

Security at the 2026 Women in Security Awards,

Jodee has helped lead some of the organisation’s

Jodee is recognised for a body of work that is

most demanding protective security work. One

substantial in scale but, more importantly, grounded

defining project was the relocation of around

in Within Bupa, Jeanine has actively championed

9,000 staff into Macquarie’s new 37-storey Sydney

Women in Security Excellence (WISE), helping create

workplace above a major transport interchange.

greater visibility, connection and opportunities for women working across cybersecurity

It was never going to be a straightforward

and technology.

office move.

She has also contributed to the ongoing development

The site sits within a busy, high-density environment,

of the Security Influence and Trust (SIT) community,

with thousands of staff, visitors, commuters and

supporting opportunities for collaboration,

service providers moving through the precinct.

knowledge sharing and connection across the

The challenge was to create a workplace that

security profession.

felt seamless for users while maintaining strong physical and electronic security from the first day

Her broader work reflects her passion for making

of operation.

cybersecurity more human, engaging and accessible, using creativity, connection and meaningful

Jodee led the operational security design and delivery

conversations to inspire positive security behaviours

workstream, coordinating building management,

and build a stronger security culture.

security integrators, guarding providers, Corporate Real Estate and internal stakeholders. The final

How people actually experience security every day.

240

W O M E N I N S E C U R I T Y M A G A Z I N E

model brought together base-building and enterprise

N O V E M B E R • D E C E M B E R 2026

access-control systems, alongside advanced technology including facial recognition. It was a major undertaking, delivered under fixed deadlines, late design changes and the usual pressures that come with a landmark construction project. Her response was characteristically steady. Jodee remained close to the detail, made decisions when they needed to be made and kept the focus on safety. There were no delays to the critical move-in date and no compromise on the security outcome. But her impact reaches well beyond a single tower. As Chair of the Martin Place Precinct Emergency Management Committee, Jodee has worked with NSW Police, emergency-management agencies, the City of Sydney and Metro Trains Sydney to shape and test precinct-wide emergency plans. These are living arrangements, not documents filed away after a meeting. Through shared planning and scenario testing, the group has clarified response roles and strengthened coordination across one of Sydney’s busiest commercial and transport precincts. Within Macquarie, Jodee has also driven broader operational uplift. She has helped introduce a global incident-reporting platform, standardise guarding practices, strengthen crisis-management playbooks and support the development of a Security Operations Hub model. Her large-scale active-threat

She is equally committed to making the industry

exercises have tested teams in realistic conditions,

more inclusive. Jodee supports women coming

giving people the confidence to respond rather than

through the profession with practical advice,

freeze when a situation becomes serious.

encouragement and opportunity.

What stands out most, though, is the way she leads people. Jodee creates an environment where staff can raise concerns, challenge decisions and contribute ideas without feeling they are taking a risk by speaking up. That matters in protective security, where a small observation can become the difference between an

Her leadership is visible in the outcomes she delivers. It is also visible in the people who leave a meeting with more clarity, more confidence and a stronger sense that security is everyone’s business.

avoided issue and a major incident.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

241

AUSTRALIA’S MOST OUTSTANDING IN IT SECURITY Proudly Sponsored by

Winner

Highly Commended

Special Recognition

Jacqueline Ryder

Nicole Allen

Christina Keing

NAB

Insurance Australia Group

Deloitte

FINALISTS Maryam Shoraka

Associate Director, Cybersecurity (IT & OT) at AirTrunk

Jacqueline Ryder

Manager, Threat & Vulnerability Intelligence at NAB

Nicole Allen

Manager, Strategy, Planning And Engagement At Insurance Australia Group

Anya Avinash

Head of Cyber Security at Bank First

I S S U E 32

Christina Keing

Global and APAC Cloud Security and Security Architecture Lead at Deloitte

Jessica Jones Head of Cyber Security at Grant Thornton Australia

Arti Kumar

Cybersecurity Program Manager and Security Awareness Lead at Zurich Cover-More

Lucy Mannering Partner at Deloitte

Erica Hardinge Tribe Lead Cyber Services at ANZ

NOMINEES Tessa Bowles Senior Consultant, Security Culture & Advisory at NAB

Pramiti Bhatnagar

Principal Product Manager at Microsoft

Radha Ramadev Manager – Attack Surface Management, Cyber Threat Management at TAL

Rakshita Upadhyayuka Technical Lead at Securoak

Maryam Shoraka

Pallavi Phadke

Joanne Denaro

Juliana Bachtold

Arti Kumar

Rakshita Upadhyayula

Jelika Pahwa Natasha Nathan Anya Avinash Mandy Stanbridge Susanna Chan Bahar Fardaran Sowmya Sripathi Kathryn Jepsen

Nicole Allen Erica Hardinge Tessa Bowles Christine Buntat Venessa Smith Pramiti Bhatnagar Radha Ramadev

Gergana Winzer

Priya Gnanasekaran

Chhaya Mathur

Rabeel Hassan

Keerthana Kumar

Sandra Grima

Laura Hartley

Shannon Gibb

Jacqueline Ryder

Fiona Long

Candice Smith

Nora Fusiyao

Lucy Mannering

WOMEN IN SECURITY MAGAZINE

243

JACQUELINE RYDER: INTELLIGENCE WITH A WIDER PURPOSE In cyber security, the most valuable people are not always the loudest voices in the room. Often, they are the ones able to take a flood of uncertain information, work out what matters, say plainly what they do not yet know, and help others decide what to do next.

That is where Jacqueline Ryder has made her mark.

She led a strategic review of NAB’s external threat intelligence providers, consolidating and uplifting

Named Australia’s Most Outstanding in IT Security

the capability so the bank could extract greater

at the 2026 Women in Security Awards, Jacqui leads

value from the intelligence it receives. That work

NAB’s Threat and Vulnerability Intelligence function.

strengthened the foundations of the function, while

It is work that sits in the background when things

ensuring effort was directed towards the information

are going well, but becomes very visible when a

and insight that could genuinely support decisions.

serious threat emerges: ransomware activity, a new vulnerability, geopolitical escalation, or intelligence

Jacqueline has also pushed the team forward on

suggesting that Australia’s financial sector may be in

the use of agentic AI to automate and scale threat

the crosshairs.

intelligence production. It is not technology for technology’s sake. The goal is to give analysts more

Her team’s role is to help protect NAB, its

room to do the work machines cannot do well:

subsidiaries, colleagues and customers by making

assess context, identify patterns, test assumptions

sense of the threat landscape before it becomes an

and make sound recommendations under pressure.

incident. Under Jacqui’s leadership, that capability has grown into one of the more mature threat

One of the more distinctive parts of Jacqueline’s

intelligence functions in Australian banking, operating

approach is her belief that intelligence should not

across the tactical, operational and strategic levels.

stay tucked away inside the cyber team. She has helped bring cyber threat intelligence into NAB’s

244

It is a discipline that can easily become overwhelmed

customer engagement, giving clients a clearer view

by data. Feeds, alerts, reports and indicators arrive

of the risks affecting the wider environment. It is a

constantly. Jacqui has been deliberate about cutting

practical shift from intelligence as an internal service

through the noise.

to intelligence as shared value.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Her influence also reaches far beyond NAB. As Deputy Chair of the FS-ISAC APAC Threat Intelligence Committee, Jacqui helps support intelligence-sharing between financial institutions across the region. She represents NAB on the International Counter Ransomware Initiative Advisory Panel, adding industry insight to international efforts aimed at disrupting the ransomware ecosystem. In a sector where organisations can be tempted to hold information close, she understands that collective defence depends on people being prepared to share what they know. Jacqueline is just as committed to the people coming through the industry. She speaks at Australian Women in Security Network events, has delivered the keynote at Go Girl, Go for IT, and regularly contributes to conversations about STEM careers and inclusion. Inside NAB, she is known for coaching her team and creating the space for others to grow into future intelligence leaders. The past few years have demanded a lot from cyber teams: geopolitical conflict, persistent ransomware campaigns and the continued rise of nation-state activity targeting financial services. Jacqueline has led through that pressure with calm judgement and a clear sense of purpose. She does not overstate the threat. She does not pretend uncertainty does not exist. And she does not lose sight of why the work matters.

For Jacqueline Ryder, threat intelligence is not simply about knowing more than the adversary. It is about helping people make better decisions before the moment gets away from them.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

245

NICOLE ALLEN: MAKING SECURITY MAKE SENSE There is a difference between writing a cyber security strategy and getting people to understand what it means for their work. Nicole Allen has built her career around closing that gap.

At IAG, where she manages Strategy, Planning and

technology sit alongside more than a decade of

Engagement within Cyber & Protective Services,

experience across cyber delivery, audit, governance

Nicole works between technical teams and the

and strategy.

leaders making decisions about the organisation’s future. Her contribution has earned her recognition

Today, her work is less about building software

as a Women in Security Awards winner. But the

and more about helping a large organisation put its

nomination tells a more interesting story than the

security ambitions into practice. That means making

title alone.

priorities understandable, giving teams a clearer view of progress and ensuring decisions made at

It starts with someone who liked building things.

leadership level translate into something useful on the ground.

Nicole’s interest in software development began at secondary school. She built a customer relationship

In 2024, Nicole led CPS’s cyber response to the

management system in Visual Basic, later developed

APRA Technology Prudential Review. She brought

a learning management system for St Vincent’s

together colleagues across cyber, technology and

Hospital, and undertook a university research project

risk, coordinating the evidence and helping articulate

with Amazon, developing algorithms to turn written

IAG’s security capability during a demanding

book reviews into star ratings.

regulatory process. It was work that required technical understanding, but also the patience to get

Those details matter. When Nicole talks with

different people moving in the same direction.

engineers about a difficult security problem, she

246

brings an understanding of the work behind it. Her

Her redesign of the FY27–30 cyber strategy carries

computer science degree and master’s in information

that thinking forward, connecting security more

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

closely with business outcomes and customer

Within IAG, that contribution has attracted 13

trust. Yet some of her most telling work happens in

individual recognition call-outs in nine months and an

a less formal setting: quarterly strategy ‘lunch and

Ovation award, the organisation’s highest recognition.

learn’ sessions, where colleagues can ask questions, contribute ideas and understand where their work fits. A strategy has little value if it stays in a presentation. Nicole makes room for people to engage with it. She brings a similarly personal approach to developing others. Through Girls@IAG, she helped introduce students to cyber security careers. Her mentoring of graduates goes beyond general encouragement; she identifies individual strengths

What emerges from her nomination is trust: earned through knowing the technical details, doing the difficult coordination and helping others find their place in the work. Nicole’s impact is felt well beyond the strategy document.

and connects people with opportunities to grow.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

247

CHRISTINA KEING: MAKING ROOM FOR OTHERS For years, Christina Keing has been the person putting other people’s names forward. Organising nominations, championing colleagues and making sure their work receives recognition. Her own achievements have tended to sit behind the people she has helped bring into the spotlight. Now, as a Women in Security Awards winner, it is Christina’s turn.

Across 25 years in cyber security, she has built

It is a practical example of a rare executive capability:

a career that reaches from engineering into

Christina inherently understands the language of

entrepreneurship and global leadership. She had

the business, the strategic oversight required by

been serving as Deloitte’s Global and APAC Cloud

the board, and the granular complexity of technical

Security and Security Architecture Lead, where

security controls. She bridges the gap between

she built the firm’s cloud security practice from the

risk governance and engineering reality with

ground up.

complete credibility.

That foundational achievement tells part of the story.

Her work has taken her into Australia’s major banks,

The more revealing detail is how she operates when

superannuation funds, health insurers and energy

organizations face critical security turning points.

networks. Earlier roles included advising financial institutions at KPMG in Hong Kong and establishing

When stepping into complex programs that had

the security function at The Chinese University of

stalled or lost momentum, Christina has consistently

Hong Kong. She also co-founded KeptMe, a cloud-

refocused initiatives around actual organizational

based platform whose business has spanned

risks and critical assets—rebuilding trust between

multiple jurisdictions, including Australia, Singapore,

business leaders and technical teams. Her leadership

Hong Kong, Japan, and the UK.

in these high-stakes environments frequently

248

earned extended partnerships and restored

Yet this was not a career built with

operational confidence.

automatic acceptance.

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

Entering a technical field where women were scarce,

There are substantial technical credentials behind

Christina also navigated the experience of being

Christina’s work, alongside research publications and

an Asian immigrant establishing her authority in

a patent.

Australian enterprise. Her nomination describes credibility that often had to be earned before it

But her nomination’s most personal thread is

was granted.

generosity: the sustained effort to help others become visible, capable and recognised.

Mentors made a difference. She has not forgotten that. Today, Christina supports younger women, particularly those arriving in Australia and finding their feet professionally while navigating unfamiliar cultural expectations. Her mentoring acknowledges that knowing your subject does not necessarily make walking into the room easy. In 2020, the Australian Women in Security Network recognised that commitment, naming her Best

For someone who has spent so much time advocating for colleagues, this award offers a welcome change of perspective. The attention is on Christina, and on the years of work that made this recognition possible.

Mentor in Security and Resilience.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

249

MVP IN THE SECURITY INDUSTRY Proudly Sponsored by

Winner

Marina Toailoa

Some careers are measured in positions held. Marina Toailoa’s recognition as this year’s MVP asks us to look instead at where professional experience can lead, and who benefits when someone chooses to share it.

250

W O M E N I N S E C U R I T Y M A G A Z I N E

N O V E M B E R • D E C E M B E R 2026

MARINA TOAILOA: AN MVP WITH COMMUNITY AT HEART For Marina, that experience includes more than

SHOWING UP BEYOND THE CLASSROOM

a decade in frontline law enforcement and high-

Marina’s leadership also includes speaking at

security operations. It now informs the Mummy

NSW Parliament and delivering industry keynotes.

Safety Security Project, bringing evidence-based child

These are public opportunities to contribute to

safety education to children, educators and families

conversations about security.

across Australia. Alongside them is work with a different rhythm: The connection between those settings is protection.

monthly contributions to Women in Security,

The difference is the audience.

youth education through the Australian Women in Security Network, mentoring and long-term

Through the project, Marina makes protective

community volunteering.

security relevant beyond the environments where it is usually discussed. Children and the adults

Regular readers of this magazine will know Marina

around them sit at the centre of the work. Her

through those monthly contributions. This award

award recognises that contribution, alongside a

offers a chance to see that writing within the wider

commitment to education and community that

picture of her work.

extends well beyond one initiative. The mentoring and volunteering deserve attention,

MAKING EXPERIENCE COUNT

too. They are part of the recognition, not incidental

There is a distance between having specialist

details added after the headline achievements.

knowledge and making it useful to someone outside

They show how broadly Marina’s commitment is

your profession. Crossing it takes work.

expressed, across professional audiences and community settings.

The Mummy Safety Security Project gives Marina’s operational experience a different purpose: helping

WHAT THE MVP RECOGNISES

people engage with child safety through evidence-

An award brings separate contributions into focus.

based education. Its national significance forms a

A project, a speaking engagement, an article, time

central part of her MVP recognition.

given to someone else: viewed together, they tell a fuller story.

For a security industry audience, this is worth considering. Protective security is not confined to

Marina’s MVP recognition honours both her

workplaces, facilities or formal responsibilities.

experience and the ways she continues to put it to

Marina’s work brings children, families and educators

use. It acknowledges leadership that reaches beyond

into the conversation, making the subject less remote

a job description and into the lives of others.

from everyday life. At the heart of it is the Mummy Safety Security That focus gives her contribution its character. The

Project, turning frontline knowledge into education

project is grounded in professional experience, but its

for the people whose safety is everyone’s concern:

purpose reaches into the community.

our children.

I S S U E 32

WOMEN IN SECURITY MAGAZINE

251

SAVE THE DATE 1 SEPTEMBER 2027

Women in Security Magazine Issue 32