COSAC 2024 – Speakers

Ghariba is a dreamer, sensitive and unconditional coffee lover. She is currently working as Cybersecurity Transformation Consultant providing services in CyberSecurity Culture and giving deeper experiences advice in Security Awareness, two main topics which drive her passion for the field. Previously, she worked as Deputy CISO of an insurance group by managing the Third-Party Security, IT project security, responsible for IT-Security communication and becoming a security awareness specialist. She has two degrees in Business Sciences and in Business Financial Engineering.

Recently volunteering as TSI Community Manager, she previously worked as Deputy CISO of an insurance group by managing the Third-Party Security Risk concept, dealing with IT project security aspects, being responsible for IT-Security communication and becoming a security awareness specialist. She has completed two university degrees in Business Sciences and in Business
Financial Engineering.

Stephen cut his teeth in the financial services industry working his way up the technology stack from mainframe programmer (he wrote the code for the left-handed cheque book for AIB) through to Head of Technical Delivery with companies such as AIB, ACCBank, Anglo Irish Bank, IBRC and Bank of Ireland. Following the fallout of the banking inspired financial crash Stephen has spent the last 10 years on the other side of the fence with BSI Group Consulting Services engaging with dozens of clients across UK, Ireland, and Europe to assist them meet their digital, regulatory and security objectives.

Hugh Boyes is a security adviser and an Honorary Fellow at Loughborough University. He is a Chartered Engineer, Chartered Cyber Security Professional and a Principal member of the UK NPSA-sponsored Register of Security Engineers and Specialists (RSES). Hugh has been the technical author for several standards issued by BSI and is a regular standards reviewer and contributor.

As a security adviser Hugh works across a range of information intensive public sector initiatives, particularly those involving infrastructure and complex geospatial data. His research interests relate to the security of cyber-physical systems, industrial IoT and digital twins, particularly those in the
built environment and the critical national infrastructure.

Steven is a Belgium-based independent security consultant at Cyber Enterprise Modelling (CEM) and has been a regular presenter at COSAC since 2018 on the topic of security by design through automation and modelling. He is the principal author of the SABSA Institute / Open Group paper “Modelling SABSA with ArchiMate” and chairs the associated SABSA Working Group. He holds several security, architecture and privacy certifications including SABSA Chartered Practitioner and ArchiMate.

In his 50+ years of in-depth experience in IT and security consulting, systems management and technical implementations, Glen Bruce has focused on Security Frameworks, Strategies, Architectures, PKI and Governance supporting business and governments in their approach to managing information and cybersecurity risk. He has led many information/cyber security engagements, where he has helped clients establish effective strategies, governance, architectures, frameworks, policies, PKIs and infrastructure implementations in support of a wide range of business and technical requirements. Glen is the leader of the SENC workgroup project.

Jonathan is a Senior Manager in the PwC Cyber Security practice with diverse experience across both public and private sectors helping organisations tackle some of their most complex security challenges. He is also leads our Secure-By-Design proposition and works with a number of clients to securely delivery solutions.

Jonathan has proven delivery capability and offering real value to businesses with experience that covers a broad range of areas including, strategy, architecture, policy and procedures and training, with particular focus on security architecture

John Ceraolo, an internationally recognized author, and speaker on multiple security topics including social engineering, security services and awareness, brings more than 30 years of experience in the information security industry. Ceraolo is currently the Head of Information Security at Skilljar, a Seattle-based customer education SaaS platform provider.

As the Enterprise Cloud Security Architect for Admiral Insurance in the UK, I bring more than a decade of cloud computing expertise to the table. In the last 7 years, I have worked with Fintech companies of all sizes, from startups to FTSE 100 Giants. I shape the vision and strategy for cloud security at Admiral, and I have shared my insights and hosted events in the industry as a security Architect.

Prof Clark is an acknowledged expert in Cryptography, I.S. Security, Systems Engineering, Information Forensics & Cyber Security. He has worked in the field of Computer and Information Systems Security and Cryptology since 1984 and is a registered expert witness with 20+ years’ experience of presenting computer and information systems evidence in a wide range of criminal & civil cases. He is a co-author of the SABSA Blue Book & was the first recipient of the COSAC award.

Paul Dorey is facilitator for the UK Energy Emergencies Executive Cyber Security Task Group (E3CC), the UK Aviation Cyber Security Forum and is co-lead for the UK NCSC ICS Community of Interest Supply Chain Expert Group. His leadership roles have included Global CISO at BP and Barclays and other CISO roles in financial services, technology and pharmaceutical sectors. He currently advises security leaders, business executives and governments on cyber security strategy and risk reporting and acts as an expert witness. He is a Visiting Professor in Information Security at Royal Holloway, University of London.

Rob believes that security architecture should be designed to support business goals and objectives. Making new solutions and technologies possible with a risk-based approach. With a reliance on digital technologies, and an evolving landscape, there is a need for a more strategic integration. Flexibility and adaptability are necessary to quickly adjust security measures in response to emerging threats. Agility is essential to respond to new challenges. Close collaboration with security teams and other business units will ensure that security measures are aligned with business priorities.

Clara Grillet holds political science and law degrees but quickly found herself drawn to cybersecurity for its intersection of IT, economics, strategy and (geo)politics. As a cyber threat intelligence analyst, she enjoys delving into complex and dynamic situations. Clara is a keen public speaker on matters related to cyber threat intelligence and ransomware. She is also a teacher with Cyberwayfinder, a Benelux-based cybersecurity school for adults looking to transition professionally into cybersecurity. Prior to this, Clara worked in the financial and data protection sectors.

I have been teaching Governance and Compliance at Boise State since 2022 and have been working in the Cyber Security and Information Operations career field for over 35 years. I have been a Fellow at Lockheed Martin since 2008, where I lead cyber security architecture and integration efforts for the 5G.MIL(TM) program. I have also led a number of certification and accreditation efforts for customers in the law enforcement and intelligence communities.

G. Mark Hardy serves as President of National Security Corporation and co-host of the award-winning CISO Tradecraft podcast. He has been providing cyber security expertise to government, military, and commercial clients for over 35 years, and is the author of over one hundred articles and presentations on security, privacy, and leadership. A graduate of Northwestern University and Loyola University, he holds a BS in Computer Science, a BA in Mathematics, a Masters in Business Administration, a Masters in Strategic Studies, and is designated as a Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM).

Lynette Hornung is a Principal Security Architecture Manager at Iowa State University. She has her MS in Information Assurance from Iowa State University, CIPP-US and SABSA security architecture certifications.  Senior Member of IEEE. She enjoys researching a variety of topics in information security, such as Artificial Intelligence and its many complexities, such as ethics, privacy and security.  She likes to study and analyze the many aspects of security architecture, cybersecurity, financial technology and the intersection with the legal landscape and geo political events.

Dr Gordon Jenkins heads up the security architecture team at Admiral Insurance in the UK. He has 25+ years’ experience in IT and security for large financial services organisations in the UK and US, across investment banking, life & pensions, asset management, and general insurance. He has worked as a security architect for the last 14 years, providing guidance to dozens of major business and infrastructure projects and helping to shape enterprise security functions.

Dr. Connie Justice is Professor Emeritus at Indiana University. Dr. Justice has an extensive background in cybersecurity education and research where she built and maintained the Indiana Cybersecurity Living Lab where she taught students in a hands-on integrated environment in both building and attacking cybersecurity solutions. Dr. Justice has research interests in education, fake news and Artificial Intelligence

Steven is a cyber security professional with a career spanning over 21 years of experience across a range of industries including finance, energy & utilities, resources, transport, manufacturing, government, health, education, and telecommunications.

As a Lead Security Architect at Astralas, Steven is a practitioner and leader focused on building trust. In providing business-driven and outcome-based value to manage risk effectively, Steven has contributed to the improvement of cyber risk management across many ASX-listed companies and some of Australia’s largest organisations in fields such as security architecture & strategy, managed services, incident response, research and development, and technical solutions and controls.

Previously a Director and sector leader within Deloitte Australia’s Cyber practice, he has also held various leadership and technical positions at Computer Associates, CGI, Fujitsu Australia, Dimension Data, and Zimbani. Steven’s post-nominals include: SCF, CISSP, CISM, CCSP, CDPSE, and is the Board Secretary of the ISACA Melbourne Chapter.

Previously lead investigator for Microsoft’s detection and response team (DaRT), Lesley has spent 16+ years responding to Microsoft customers’ largest and most impactful cybersecurity incidents. As Chief Security Advisor, she now provides customers, partners and agencies around the globe with deep insights into how and why security incidents happen, how to harden defences and more importantly, how to automate response and contain attacks with the power of the cloud and machine learning.

Rosanna runs a rapidly expanding European platform growing next-generation diverse cyber security professionals. She consults and leads design think, corporate innovation and coding seminars to corporates and individuals (e.g. BNP Paribas, Salesforce.com, the 27 EU Director Generals as individuals). An accomplished public speaker, she emphasizes the doing of things. A native of the Philippines, via formal architecture education in Japan she now identifies as German and Belgian.

Mikko has over 20 years of experience in building and assessing security for continuously digitalizing business. Latest assignments relate to a world-class automated recovery requirements management for businesses in fields of energy, media, government, national security, health, and finance business. Mikko has a solid background: he started as in intern at Nixu in the early 00’s and worked with Active Directory, Symantec Enterprise Security Architecture, Digital Services Development and Security Operations Center related assignments as Solution Specialist and Project Manager.

Anne Leslie is the Cloud Risk and Controls Leader for EMEA at IBM. With 18+ years of experience spanning financial services and technology, she is a distinguished expert at the intersection of AI, cloud, operational resilience, and cybersecurity.

Since joining IBM, Anne has been instrumental in guiding clients worldwide in securely accelerating their adoption of public cloud and AI technologies, while also preparing them for the future landscape shaped by quantum computing. Her work ensures these organisations can adapt their operating models and enhance their resilience in a rapidly changing digital environment.

Co-editor of The AI Book and co-author of The RegTech Book, Anne excels at facilitating outcome-oriented dialogue on complex industry issues, building positive relationships across diverse stakeholder groups. She is actively driving industry momentum around post-quantum readiness by advising clients on strategies to mitigate risks and embrace quantum-resistant solutions. Well-established as a trusted voice in the industry, Anne regularly contributes her thought leadership to C-level conferences and working groups convened by public authorities.

Irish by nature and French by design, Anne lives with her family in Paris, France, which has been her home for almost 30 years.

Genevieve is Professor of Classics and Turing Fellow at the University of Bristol. As a narratologist, she has particular research interests in stories and their impact on futures thinking – especially in the context of emerging technologies and cyber security. She is the Futures Challenge Fellow for the UKRI’s Digital Security by Design (DSbD) Discribe Hub+ programme, and is Director of RISCS – the UK’s Research Institute for Sociotechnical Cyber Security.

Ashling Lupiani, SABSA SCF is a Cognitive Solutions Developer at City of Hope. She is a neuroscientist and biomedical engineer with experience in speech and gait research. She spent 5 years running neurorehabilitation engineering studies with human participants and conducting data analysis to investigate sensorimotor systems. She co- authored 5 papers and presented at conferences in Toronto and Boston, USA, COSAC APAC 2023 & 2024, and COSAC 28, 29 & 30.

Sophia is a Senior Associate at the Cyber Security Practice at PwC UK with a keen focus in architecture and engineering. Her main experiences and interests lie in cloud security working with a range of different cloud specific technologies such as kubernetes. Her work spans across different industries such as private sector, public sector and governmental bodies.

Sophia has a strong technical background with a MsC in Cyber Security. Her focus within architecture lies with threat modelling where she has focused on a range of systems such as Cloud to Operational Technology. Asides for this, Sophia has a wide range of knowledge of various cloud platforms such as Google, AWS and Azure.

Sophia is an avid speaker at various security/technology conferences and aims to continue to spread her knowledge in cloud security and threat modelling.

Kathleen Mullin is an influential information security practitioner and international speaker with over twenty-five years of experience. She started her career in Accounting and Internal Audit before moving into Information Technology and Cybersecurity. She has been CISO at various organizations, focusing primarily on healthcare. Most recently, she is CIO|CISO for MyCareGorithm a SaaS startup focused on transforming the Doctor/Patient experience.

Throughout her career, Kate has volunteered and contributed to information security as a profession, including serving on multiple board and advisory positions. Currently she is a Board member of the SABSA Institute (TSI) and
Chair of the TSI EMEA-NA Liaison Group.

Kirk is a security advisor with a focus on disaster and incident response exercises. He develops and manages exercise programs through the discipline of serious games, using research-based practice. Through the lens of serious games, simulation and a military background he enables clients to gracefully handle the unexpected.

Muhammed Zubair (MZ) Omarjee, is a former Enterprise Security Architect providing advisory to leading banking institutions in South Africa and abroad. He is instrumental in crafting technology strategies as it relates to digital transformation, mobile banking and cyber security. He plays a pivotal role in shaping information technology practices as a transformative business driven and risk-oriented discipline.