Auckland is New Zealand’s commercial engine, and its cybersecurity bench reflects that. The super city hosts the country’s largest company, its most global software firm, its biggest construction group, the electricity lines network for the region, the council and transport agency serving 1.7 million people, and the country’s largest university. The seven leaders below defend that spread, several of them carrying global mandates from a city at the bottom of the world.
Catherine Buhler – Global CISO, Fonterra
Catherine Buhler became Global Chief Information Security Officer of Fonterra in October 2025, taking security ownership of New Zealand’s largest company and one of the world’s biggest dairy exporters. The cooperative’s reach runs from farm collection systems through global supply chains into more than a hundred markets, which makes it an international security job run from an Auckland office. Buhler came up through technology leadership roles. She is a graduate of the Australian Institute of Company Directors and a fellow of the Australian Information Security Association.
Suzy Clarke – Group CISO, Xero
Suzy Clarke has been Chief Information Security Officer of Xero since April 2019, more than seven years in one of the country’s most visible security seats. Xero’s cloud accounting platform serves millions of small-business subscribers worldwide, which puts financial trust on several continents inside her programme. Her path ran through technology operations leadership, including heading IT operations at Lotto New Zealand, and that operator’s grounding shows in a programme built to run at SaaS scale.
Duncan Hills – General Manager (CISO), Cyber Security, Fletcher Building
Duncan Hills has led cybersecurity at Fletcher Building since November 2024, closing in on nine years with New Zealand’s largest construction and building-products company. The company’s footprint spans manufacturing plants, major construction sites, and retail distribution, which gives the role a converged physical and digital estate that few enterprise security leaders encounter. Hills earned the top job after years inside the company, and he pairs it with advisory board work in the wider security community. Operational technology and job-site connectivity have made construction a rising target, and he has spent most of his career inside that environment.
Joshua Reedy – Head of Security Operations, Vector
Joshua Reedy joined Vector as Head of Security Operations in December 2025 and spent much of 2026 also carrying the company’s acting GM Cyber mandate. Vector owns and operates the electricity lines network powering greater Auckland, placing his team on the front line of critical infrastructure defence for the country’s largest city. Before Vector, he spent nearly three years as Chief Information Security Officer of Kordia Group, the state-owned communications company whose networks serve emergency services and broadcasters nationwide. Reedy holds CISSP and CISM certifications, and the move from telecommunications to energy gives him CISO-level experience in two critical infrastructure sectors.
Simon Burson – CISO, Auckland Council
Simon Burson has been Chief Information Security Officer of Auckland Council since October 2023, defending the largest local government in New Zealand. The council and its family of organisations deliver everything from libraries and parks to water regulation and building consents for a region of 1.7 million people, which means its systems hold the civic data of one in three New Zealanders. Burson arrived with a strategy-first mandate and has spent three years implementing a security strategy and policy framework sized for one of the southern hemisphere’s largest municipal governments.
Roneel Ram – Proactive Cyber Security Manager, Auckland Transport
Roneel Ram spent more than four years on Auckland Transport’s security team before becoming Proactive Cyber Security Manager in November 2025. The agency runs the buses, trains, ferries, and traffic systems that keep the super city moving, and its control networks are the kind of operational technology target that transport security leaders watch closely. Ram’s work building the agency’s proactive defence posture has drawn outside attention: Auckland Transport’s security programme has been featured as a Microsoft security case study.
Michael Karich – Deputy CISO, Engagement, University of Auckland
Michael Karich has served as Deputy Chief Information Security Officer for engagement at the University of Auckland since May 2023. The country’s largest university enrols tens of thousands of students and maintains a research portfolio spanning medicine, engineering, and the sciences, a security surface closer to a small city than a campus. Karich, a CISSP, has spent three years co-leading the creation and delivery of new security capabilities, including the engagement work that turns policy into practice across hundreds of departments and research groups.
Every Job Is Bigger Than It Looks
Auckland’s cybersecurity leaders work at a scale their city’s size does not suggest. Buhler and Clarke run global programmes from Queen Street, one defending a dairy exporter operating in more than a hundred markets, the other a platform serving millions of small businesses worldwide. Hills and Reedy protect the physical infrastructure the region is built on, from construction sites to the electricity lines feeding the city. Burson, Ram, and Karich defend the public institutions a third of the country depends on. Several have spent the better part of a decade inside the organisations they now protect, in a security community small enough that reputations are built in person.
Discover more CISOs securing their organizations:
- The Yarra’s Quiet Defenders: Melbourne’s Cybersecurity Leaders to Watch
- The River City’s Watchtowers: Brisbane’s Cybersecurity Leaders to Watch
- Tucson’s Cybersecurity Leaders to Watch
- Calgary’s Cybersecurity Leaders to Watch
- Edmonton’s Cybersecurity Leaders to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.