In some organisations, a cyber incident means lost files and locked laptops. In others, it can reach a hospital’s building systems, an energy company’s assets, or the operational technology around a research reactor. The six cyber leaders below work where security decisions extend into physical operations, across healthcare, energy, nuclear science, mining and the built environment. Some started on the engineering side of those operations, and all of them now spend their days making sure essential services keep running when something goes wrong.
Colin Renouf – CISO, Healius
Before he secured healthcare systems, Colin Renouf was a senior stress analyst at Rolls-Royce, and he still credits his aeronautical engineering background for how he approaches defence, critical infrastructure and operational technology. He has been CISO of Healius since April 2022, having earlier worked there as an information security and pathology solutions architect. Alongside that role, he describes consulting with government, large vendors and industry bodies on critical infrastructure security and resilience, including threat intelligence and ISAC integration, and a resilient distributed cloud model designed so organisations can recover key services locally if a region is lost. He arrived at Healius after more than two decades as an architect at Lloyds TSB and senior roles at Travelex, Mastercard and Commonwealth Bank. He is also a published author, from the book Pro WebSphere Application Server 7 Internals to articles in Hakin9 and Pen Testing magazines, and is referenced on an industry patent.
Lauren Veenstra – Chief Security Officer, Iberdrola Australia
What separates critical infrastructure from the rest of the economy? “Consequence,” according to Lauren Veenstra. When the systems behind electricity, water, transport, fuels or health are disrupted, she has written, the effects reach far beyond the organisation that runs them. She knows those systems from the plant floor up. Over 17 years at Orica, she was control engineering lead for a new $100 million chlor-alkali facility and a $100 million groundwater treatment plant, before leading ICS cybersecurity at IXOM and IT and OT at bulk liquid storage company QUANTEM. She also served as deputy chair of the Trusted Information Sharing Network’s bulk liquid fuels sector group. Veenstra joined Iberdrola Australia in December 2023 to lead its cyber function and became Chief Security Officer in April 2025, responsible for protecting its digital, physical and human assets with a focus on operational continuity. She has spoken at CISO Sydney and OT Security Sydney and was named chair of CISO Critical Infrastructure Melbourne.
Nick Howarth – General Manager, Cyber Security and Operational Technology, ANSTO
Sixteen years ago, Nick Howarth started at ANSTO as a systems administrator in reactor operations at Lucas Heights. He worked his way through IT systems engineering roles in nuclear operations to become operational technology team leader for the OPAL research reactor, leading engineers responsible for the engineering, operation, maintenance and security of its OT systems. He became cyber security and OT manager in 2019 and has served as General Manager, Cyber Security and Operational Technology since November 2021. His expertise reaches beyond Australia: at an International Atomic Energy Agency conference in May 2026, he chaired a technical session on threats and risks, covering practical risk management strategies and the role of the design basis threat. He holds a Bachelor of Technology from Western Sydney University and is a CISSP.
Ovais Ahmed – Cyber Security Manager, Evolution Mining
Ovais Ahmed came to mining from transport. Before joining Evolution Mining as Cyber Security Manager in Sydney in March 2026, he spent nearly a decade securing New Zealand’s transport systems, rising from DevOps and security engineering roles to information security manager at Auckland Transport, then serving as security platform manager at Waka Kotahi NZ Transport Agency. His career began in network engineering for banks and large enterprises in Karachi and Dubai, including setting up SWIFT connectivity and a disaster recovery site at Bank Al Habib. With more than 18 years in security across transport, government, finance and critical infrastructure, his work has ranged from upgrading SIEM and endpoint detection platforms to implementing OT monitoring. He is listed as a speaker at OT Security Sydney.
Jenny Botton – Senior Manager Cyber Security, ABN Group
Jenny Botton compares running a security function to a home renovation: keep the costs on budget, make sure the result matches the vision, and keep the team on track and proud of the outcome. It is an analogy shaped by an unusual background. A former Chartered Accountant, she uses that financial grounding to build security business cases a CFO and board can engage with, while her Honours degree in psychology informs how she understands why people make poor security decisions and how to design awareness programmes that change behaviour. With more than 20 years’ experience and expertise as a Senior Lead Implementer of ISO 27001, she leads cyber security at ABN Group, having moved to Melbourne in 2025 after 11 years in New Zealand. She is scheduled to speak at OT Security Melbourne in July 2027 on how to get engineers, who instinctively prioritise physical safety, to give cyber security the same weight as health, safety and environment.
Muhammad Umair Zia – Acting Director, Infrastructure and Service Delivery, Sydney Local Health District
Muhammad Umair Zia arrived in Australia without a professional network. He joined Sydney Local Health District as cyber security manager, became its head of cyber security, and has since stepped up to acting director of infrastructure and service delivery, with a remit spanning infrastructure, cloud, networks, service management, architecture and cyber security for around 18,000 users and more than 500 clinical and business applications across five major hospitals. In August 2026 the district ran its cyber security tabletop exercise around an incident affecting the building management system that supports hospital operations, bringing together board members, executives, clinical governance, disaster management, communications and vendor representatives. “Cyber incidents in healthcare are no longer technology problems,” he wrote afterwards. “They are clinical problems.” Before Australia, he led cyber security at the University of Otago and worked on security for NZ Post, Spark and KPMG New Zealand clients.
Where Security Meets the Physical World
Two of these leaders began their careers designing and commissioning physical systems, and two more built theirs inside operational environments, from a research reactor to a transport network. Their organisations differ, but the question they work on is the same: how to keep essential operations running safely when a cyber incident reaches beyond the office network.
Discover more CISOs securing their organizations:
-
- From Molecule to Pharmacy: The Swiss CISOs Securing the Medicine Supply
- Shared Defence: Cybersecurity Leaders Protecting Research and Education
- Protecting Member Trust: Cybersecurity Leaders Behind America’s Credit Unions
- On the Right Track: Europe’s Rail Cybersecurity Leaders to Watch
- Keeping Public Life Running: Europe’s Public-Trust Cyber Leaders to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.