Speakers

Rodney is an accomplished information security professional with more than two decades of experience across diverse industries including large corporate, telecommunications, energy, healthcare, and major financial sectors. Currently, he is dedicated to giving back to society, as the Head of Information Security & Compliance (aka CISO) at Barnardos Australia. There, he exercises thought leadership by crafting practical, risk-appropriate security visions and roadmaps through a commitment to continual improvement.

Bharat Bajaj is a highly accomplished Technology Risk leader with two decades of experience navigating the complex landscapes of Artificial Intelligence, Cybersecurity and Privacy.

I have partnered with three of the “Big Four” Australian banks, delivering large-scale, transformative projects with robust technology risk mitigation strategies that enabled customer-focused outcomes. My approach blends deep industry expertise with strategic thinking, consistently delivering business value.

Currently, Bharat is leading the implementation and governance of Generative AI and AI Agentic systems. Bharat’s responsibilities cover the identification of technology risks and evolving compliance requirements, as well as the development and implementation of comprehensive guardrails.

As a dedicated Board Director at the ISACA Melbourne Chapter, Bharat is committed to enhancing the professional capabilities of our Melbourne technology community.

Andrew is a cybersecurity leader at Australian Payments Plus, specialising in security architecture, secure-by-design practices, and the safe adoption of emerging technologies.

He works closely with engineering, risk, architecture, and business teams to translate complex security challenges into practical controls that support innovation and delivery. His areas of focus include AI security, DevSecOps, software supply chain risk, cloud and API security, and embedding security throughout the technology lifecycle.

Andrew is particularly interested in improving how security teams collaborate with delivery teams, moving security beyond traditional governance gates and positioning it as an enabler of resilient products and services. He brings a pragmatic perspective shaped by the realities of operating in complex, highly regulated environments.

Steven is a Belgium-based independent security consultant at Cyber Enterprise Modelling (CEM) and has been a regular presenter at COSAC since 2018 on the topic of security by design through automation and modelling.

He is the principal author of the SABSA Institute / Open Group paper “Modelling SABSA with ArchiMate” and chairs the associated SABSA Working Group.

He holds several security, architecture and privacy certifications including both SABSA Chartered Practitioner certifications and a contributor to the forthcoming ArchiMate Next.

Andra Cimpean works as Senior Cyber Security Specialist at Department of the Premier and Cabinet – Office of Digital Government of WA, supporting cyber security transformational programs across State Government in alignment with the WA Cyber Security Policy.

Andra volunteers with SABSA World Australia and is the Deputy Chair for the Australian Information Security Association (AISA) WA Branch. As a former professional chess player, she brings in a unique perspective with her strategic and problem-solving skills. She holds a Master’s degree in Cyber Security and a Bachelor’s in Psychology along with accreditations such as CISM, SABSA Chartered Security Architect and ITILv4.

Prof Clark is an acknowledged expert in Cryptology, Systems Engineering, Information Forensics and Cyber Security. He has worked in the field of Computer and Information Systems Security and Cryptology since 1984 and is a registered expert witness with more than twenty years’ experience of presenting computer and information systems evidence in a wide range of criminal & civil cases. He is a co-author of the SABSA Blue Book and was the first recipient of the COSAC award.

Reshma is an AI & Data Risk specialist with experience in Security and Technology. She holds a Master’s Degree in Information Technology, is a Certified Data Privacy Solutions Engineer (CDPSE), and is a Graduate of the Australian Institute of Company Directors (GAICD).

With a passion for Data, AI, and emerging technologies, Reshma brings over 20 years of experience working in Australia and New Zealand. She is deeply committed to Data Security and addressing emerging AI challenges. Currently, Reshma serves as a Director at ISACA Melbourne and sits on the Advisory Board for other not-for-profits. Additionally, she contributes as a Subject Matter Expert Reviewer for ISACA’s CDPSE Manual and regularly writes for blogs, podcasts, and security magazines.

Nigel is a cybersecurity engineer specialising in OT/ICS product security for heavy machinery. He has over 20 years’ experience across product, systems engineering and security roles within the Trimble family; a path that runs from developing some of the world’s first machine guidance systems in the 1990s to securing the autonomous machines of today. He is a specialist in Software Composition Analysis, SBOM generation and management, and the practical application of the EU Cyber Resilience Act. He serves on a number of AppSec product advisory boards and is a founding member of the Digital Safety initiative (digitalsafety.org), which prioritises the remediation of vulnerabilities capable of causing physical harm.

Francine Hoo has more than 20 years’ experience across AI, data, governance, compliance, risk and transformation in highly regulated organisations. Most recently, as a Director at KPMG Australia, she co-created its Local Government AI Marketplace and designed Responsible AI, data and AI governance, and assurance approaches across superannuation, government, energy, mining, financial services and retail, including work with a multilateral development institution. Previously, Francine held enterprise data governance responsibilities and was a senior regulatory manager at ASX, leading major regulatory framework and transformation programs. She has also served as Head of Trustee Risk & Compliance and as a Board Director.

Her work now focuses on how organisations can realise the capabilities AI enables while redesigning the governance, operating models and controls needed to support them.

Jade Hughes is a BISO at The Lottery Corporation, with a background in security engineering and architecture, across financial services and consulting and now gaming. His current focus in his BISO role is working on bringing security to the table for the digital business unit, supporting and guiding their decision making from a risk and security perspective.

Ravneet Kaur, CISM, Oxford-certified AI professional, is a senior technology, cybersecurity, and transformation leader with expertise in AI governance, risk management, cyber resilience, and secure enterprise delivery across regulated environments. Her experience spans government, banking, energy, telecommunications, and sovereign cloud. Drawing on work in cybersecurity uplift, enterprise governance, and quantum-safe encryption initiatives for critical infrastructure, Ravneet brings a practical, strategic perspective to governing innovation responsibly. She is recognised for translating complex technology and assurance challenges into business-aligned outcomes that build trust, resilience, and operational readiness.

Steven is a cyber security professional with a career spanning over 24 years of experience across a range of industries including finance, energy & utilities, resources, transport, manufacturing, government, health, education, and telecommunications.

Practice Lead of security architects at Astralas, Steven is a practitioner and leader focused on building trust. In providing business-driven and outcome-based value to manage risk effectively, Steven has contributed to the improvement of cyber risk management across many ASX-listed companies and some of Australia’s largest organisations in fields such as security architecture & strategy, managed services, incident response, research and development, and technical solutions and controls.

Previously a Director and sector leader within Deloitte Australia’s Cyber practice, he has also held various leadership and technical positions at Computer Associates, CGI, Fujitsu Australia, Dimension Data, and Zimbani.

A Deakin University alumnus, having double-majored in computer science and information systems, Steven’s post-nominals include: SCF, CISSP, CCSP, CISM, CISA, and CDPSE.

Steven is Vice President of the ISACA Melbourne Chapter, a return speaker to the COSAC conference having previously presented in Ireland & Melbourne, and a regular speaker at AISA’s Australian Cyber Conference.

An avid supporter and member of the Geelong Football Club, he is passionate about enjoying good food & drink (in particularly wood-fired cooking) with his family and friends.

Christian Kissane is Head of IT and Cybersecurity at Hypersonix Launch Systems, an Australian aerospace and defence company. He holds CISM and CISSP, is completing a Master of Information Technology at QUT, and is responsible for cybersecurity governance, IT operations, and compliance across a defence environment with NIST 800-171, DISP and ITAR obligations. Before Hypersonix he was IT Infrastructure Manager at Pareto Phone, where he was on the ground during the 2023 LockBit ransomware attack and the data breach that followed, affecting more than 70 Australian charities. His background spans incident response under pressure, third-party data governance, and building security capability in growing organisations.

Marcel Krawczyk is a Defence-aligned cyber security professional, security assessor, and architecture practitioner with extensive experience in delivering risk management, assurance, and accreditation outcomes across Australian Government and complex Defence environments. He currently works as a Cyber Security Principal at Bastion Defence Consulting, where he helps translate risk appetite, policy requirements, and mission priorities into practical security requirements and develop uplift strategies aligned with business outcomes.

Marcel has worked across some of Australia’s most sensitive and strategically significant environments, including Defence Cyber Command, Defence Digital Group, the Future Submarine Program, and the Australian Criminal Intelligence Commission. His experience includes producing security artefacts and authorisation briefs, conducting independent security assessments, guiding and advising system owners through an Authority to Operate process, and providing security architecture support through design assurance, control intent mapping, and risk acceptance. He has supported critical capabilities across cloud systems, Enterprise Resource Planning programs, Navy communications, Army operational simulations, drone development and Defence exercises.

A SABSA Chartered Architect with IRAP, CISSP, CISM, CRISC, and ISO 27001credentials, Marcel is recognised for translating complex cybersecurity concepts into practical, relatable insights for executives, engineers, and delivery teams alike. His work is grounded in real-world implementation, secure-by-design principles, and the challenge of embedding meaningful architecture and assurance into programmes where cyber maturity is still developing.

Abbas Kudrati is the Regional CISO for Asia Pacific and Japan (APJ) at F5, where he serves as a trusted advisory partner to boards, CISOs, and executive leadership teams on securing modern application architectures, APIs, and AI systems. With over two decades of global cybersecurity experience—including past roles as the Regional Chief Identity & Security Advisor at Silverfort and Chief Cybersecurity Advisor at Microsoft Asia—Abbas has spent his career translating complex technological disruptions into secure, business-enabling strategies.

Abbas is a widely recognized expert in Zero Trust Architecture (ZTA), Security Architecture, and Governance, Risk, and Compliance (GRC).

He is deeply engaged in steering the industry through its next structural hurdles: the security of autonomous AI agents (establishing AI Trust Fabrics to govern inline prompt, API, and model interactions) and enterprise readiness for Post-Quantum Cryptography (PQC) (operationalizing cryptographic agility and hybrid-PQC to mitigate Q-Day risks)

A bestselling author, Abbas has published several industry-defining books with major publishers like Wiley and CRC Press. His titles include:

• Threat Hunting in the Cloud: Defending AWS, Azure and Other Cloud Platforms Against Cyberattacks
• Zero Trust Journey Across the Digital Estate
• Securing Cloud Containers: Building and Running Secure Cloud-Native Applications
• Managing Risks in Digital Transformation

Alongside his executive role at F5, Abbas serves as a Professor of Practice at La Trobe University and is an active advisor to HITRUST Asia, EC-Council Asia, and emerging cybersecurity startups.

A Fellow of the Australian Information Security Association (AISA) and a passionate neurodiversity advocate, he brings a unique, cognitive-led perspective to solving the industry’s most asymmetric defense challenges.

Robert is an experienced Enterprise Security Architect with an information security career spanning more than 20 years in cyber security roles. Robert has a great deal of experience working with medium to large organisations in Government, Higher Education and Critical Infrastructure sectors.

Rob’s recent experience involves successful delivery of security projects with organisations in the education, finance, utilities and petrochemical sectors in Australia, Saudi Arabia, UAE, Vietnam and the United States.

Rob’s experience also includes high-profile roles such as Chief Information Security Officer (CISO) at the University of New England, leading multiple pivotal cyber security projects.

Rob is highly experienced in defining information security risk strategy, security architecture design and alignment with business processes, transformation and automation of security and architecture processes, as well as planning and integration of security services and mechanisms to clearly support business goals.

Rob is a certified SABSA, ISACA and (ISC)2 instructor and is committed to contributing to the wider information security community, currently sitting as the Chair of the Western Australia branch of AISA (Australian Information Security Association), Founder/Treasurer of the ISC2 Western Australia Chapter and Deputy-Chair of the ISC2 Chapter Regional Management Committee (CRMC) APAC.

Ross MacKenzie has over 25+ years of cybersecurity experience, which has included roles across security architecture & design, security governance and cybersecurity risk.

Ross is currently the Head of Security Controls Assessment within the Information Security Group at Westpac. This role is responsible for security consulting (secure by design), application security, penetration testing, and cyber hygiene (vulnerability and patch management). Prior to this role, Ross led the Security Architecture & Design function at Westpac that was accountable for both enterprise and solution security architecture across Westpac Group.

Muhammed Zubair (Mz) Omarjee, is a former Enterprise Security Architect providing advisory to leading banking institutions in South Africa and abroad. He is instrumental in crafting technology strategies as it relates to new digital assets adoption, digital transformation, mobile banking and cyber security. He plays a pivotal role in shaping information technology practices as a transformative business driven and risk-oriented discipline.

Enzo Peperkamp heads UpGuard’s A3 function, covering AI enablement, workflow automation, and internal analytics across the business. His team owns UpGuard’s automation platform, agentic AI infrastructure, and AI vendor risk review programme, giving him a practitioner’s view of governing both deterministic automation and non-deterministic agentic workflows at enterprise scale. Recent work includes policy-driven access and certification frameworks for AI tooling, MCP gateway governance controls, and embedding continuous verification into vendor AI risk assessment.

Samuel Pinzon is the Principal Cyber Security Architect at Western Power, a critical infrastructure provider in Western Australia’s energy sector. With almost two decades of experience in cybersecurity and enterprise architecture, Samuel specialises in aligning security strategies with business transformation initiatives, regulatory compliance, and operational resilience.

At Western Power, Samuel leads the development of a SABSA-based Enterprise Security Architecture, enabling the organisation to navigate the complexities of digital transformation while maintaining a risk-informed cyber security posture. His work focuses on creating reusable, interoperable cybersecurity artefacts that bridge the gap between business objectives and technical implementations.

Prior to join Western Power, Samuel worked for about 15 years in the Oil & Gas sector, where he supported the implementation of multiple cybersecurity solutions across both upstream and downstream operations as security architect. He also led programs to implement cybersecurity practices in operational technology (OT) environments, applying the standard IAS/IEC62443 standard.

Samuel holds industry-recognised certifications, including SABSA Chartered Foundation (SCF), ISA/IEC62443 Cybersecurity Expert, and TOGAF Foundation. He brings a pragmatic, business-aligned perspective to security architecture and is an advocate for using SABSA as a strategic enabler in complex environments.

Joshua Qwek is a cybersecurity executive and independent advisor with more than 20 years of experience across government, financial services, higher education, and industrial environments.

He brings deep expertise in security architecture, cyber strategy, and executive advisory, alongside Governance, Risk, and Compliance (GRC) — with hands-on experience implementing and building cyber capabilities and developing architecture functions.

Through his independent advisory practice, he currently advises clients on security architecture, strategy, cyber capability uplift, and cyber operations.

Dr Ahmad Salehi Shahraki is a Lecturer in Cybersecurity at La Trobe University, where he chairs the Cybersecurity Industry Advisory Board and leads industry engagement in cybersecurity. He works at the intersection of academic research and industry practice, with a focus on privacy-preserving access control, digital identity, decentralised security, blockchain and Internet of Things security, and post-quantum readiness.

He has published more than 40 peer-reviewed works in leading cybersecurity journals and conferences. His current work addresses a practical challenge facing modern organisations: how to securely authorise employees, machines and autonomous AI agents across organisational boundaries without collecting or exposing more identity information than necessary.

His work translates formal security and privacy concepts into practical architectures, governance approaches and risk-based decision-making methods that can support organisations operating across cloud, digital ecosystem and multi-party environments.

Dr Malcolm Shore retired from the New Zealand Air Force to take on the role of Director of Infosec for the New Zealand Government, where he developed and managed the national information security programme. He has subsequently held a number of CISO and Technical Director roles in the telecommunications industry. As a part time academic, Malcolm developed and lectured in the Post Graduate Diploma in Forensics and Security at Canterbury University in New Zealand, helped launch the Certificate IV in Cybersecurity in Australia, and is now an Visiting Researcher at Deakin University in Melbourne. He is the author of numerous online cybersecurity and programming courses published through Linkedin Learning and Offsec.

Malcolm is currently Chief Architect at David Lynas Consulting.

Luke has been working in the Australian mining industry since 2015.

He is an accredited Functional Safety Engineer (TÜV Rheinland, SIS) where his career has seen him work across autonomous and traditional surface and underground
mining operations, ports, rail environments, utility and power (LV + HV), as well as water pipeline networks. Since 2020 he has focused on supporting critical infrastructure and major hazard facilities; where he is solving problems related to automation, edge compute, hybrid loud, and industrial data centers.

Luke frequently rides the Architect’s Elevator from the “engine room” to the “executivesuite”, is a firm believer in solving business problems with technology instead of
technical issues with products and tooling and is quite cheeky about challenging the norm.

Outside of technology you’ll find him engaging in all sorts of creative shenanigans be that improv theatre or trying to find unsuspecting people to indoctrinate into his
Dungeons & Dragons campaigns. He also co-coordinates SABSA World Perth.

Concept definition and early-stage acquisition for secure information and communications systems have been the focus of Carol’s career. Particularly in military aircraft platform acquisition, Carol has specialized in supporting systems such as command and control, training as well providing guidance on system security requirements for a range of other platforms.

With innovation in technologies, the need to be smart about how security is defined and implemented, Carol has taken the lessons identified earlier in her career to help develop holistic solutions including people, processes, data and infrastructure. This approach led to the successful implementation of a new specialist cell within Australia’s Air Operations Centre. Carol’s responsibility within the implementation team was the development of the security artefacts for certification of the systems.

Subsequently Carol was invited to create a ‘green field’ Operational Command and Control Centre for the fifth and future generation Royal Australian Air Force. Currently awaiting acquisition related information from a major ally, the capability management office is working to create an environment for a successful implementation and transition into service. Although in the early stages of the ADF’s capability lifecycle model, Carol’s legacy is a design that is secure, resilient and operational.

Pierre Tagle, Ph.D., is an esteemed Information Technology and Cybersecurity professional with over 20 years of experience encompassing extensive consulting, executive
management, and 24×7 operational roles across diverse sectors including government, financial services, manufacturing, not-for-profit and academia. Dr. Tagle is adept at
translating complex security concepts into actionable strategies for both business and technical stakeholders, and is recognized for his analytical acumen and innovative approach to cybersecurity. He holds a Ph.D. in Computer Science and numerous prestigious certifications such as CISA, CISM, CRISC, ISO 27001 Lead Auditor, PCIP, and CDPSE.

In his current role as DXC Technology’s Head of Digital Identity and Zero Trust for Australia and New Zealand, Dr. Tagle leads a team that expertly balances business needs with risk mitigation and cost-effective security solutions. He leads team of close to 50 SMEs covers all four of DXC’s Security service pillars. This includes Cyber Risk & Compliance, Digital Identity, Infrastructure, App & Data Protection, and Cyber Transformation & Operations. Prior roles includes leading advisory and consulting teams in Secureworks and Sense of Security (now part of CyberCX).

His own direct work spans several critical areas including security strategy and roadmap development, compliance and maturity frameworks management, IT and OT security, and business continuity planning. Dr. Tagle’s leadership not only drives the strategic direction of security practices but also fosters a culture of accountability and continuous improvement within his teams.

Sandeep Taileng is an accomplished cybersecurity executive and strategist with over 20 years of experience across finance, critical infrastructure, and government sectors. Currently, he serves as the Information Security Leader and CISO at State Trustees Limited in Victoria, Australia.

Recognized as a Top 50 CISO in 2024 and 2025 and a finalist for the Australian CISO of the Year in 2025, Sandeep’s career is defined by his commitment to technology risk management and information security. Previously, he held leadership roles at major organizations including EnergyAustralia, AMP, and Telstra.

Sandeep is a recognized specialist in space cybersecurity, focusing on the security of satellite constellations, ground systems, and orbital infrastructure as matters of global digital sovereignty. He is the founder and non-executive chair of CyberInSpace, a boutique consultancy bridging the gap between Australian space security and international defense markets.

Beyond his corporate leadership, Sandeep is a dedicated advocate for cybersecurity standardization, chairing key initiatives within the IEEE Standards Association, including the IEEE Global Hackathon. He holds honorary academic positions at the University of Melbourne and Monash University and is a passionate advocate for community-based cyber awareness, particularly through digital safety programs for senior citizens. Sandeep holds an educational background in electronics engineering and qualifications in enterprise risk management.

Prapurna Uppuluri is a cybersecurity practitioner with more than 17 years of experience spanning security architecture, cloud security, Secure-by-Design, governance, DevSecOps, and enterprise security transformation within complex technology environments.

Her work focuses on evolving security from static review-driven models toward more adaptive and engineering-aligned approaches capable of scaling within modern cloud-native ecosystems. She has a strong interest in APIs, Kubernetes, AI-assisted development, context-aware security controls, policy-as-code, CI/CD assurance, and practical security engineering patterns that can be operationalised by developers, architects, cloud teams, and security practitioners.

Prapurna is particularly passionate about bridging the gap between architectural intent and deployed reality, and exploring how AI and automation may help security teams better understand implementation context, prioritise threats, and improve assurance outcomes in increasingly automated engineering environments.

She regularly works across architecture, engineering, cloud, and security teams to help drive practical and scalable Secure-by-Design initiatives.

Areas of Expertise:

• Secure-by-Design
• Cloud & Kubernetes Security
• API Security
• Security Architecture
• DevSecOps & CI/CD Security
• AI-Assisted Security Engineering
• Policy-as-Code & Control Automation
• Threat-Informed Security Engineering
• Context-Aware Security Assurance.