A club of 1,200 French security executives. An ISACA chapter running seminars and workshops across Ireland. A German journal on IT governance. A Spanish association that certifies data protection officers. The five leaders below run or help shape organizations like these, and each also holds a role that informs that community work, from securing rail franchises to auditing a global manufacturer’s IT across 140 countries.
Fabrice Bru – President, CESIN
Fabrice Bru co-founded CESIN, the Club of Information and Digital Security Experts, served on its board from 2018, and was elected president in January 2025, taking charge of an association of 1,200 members with the stated aim to “make cybersecurity a lever for trust and resilience for our organizations.” He brings more than two decades of security leadership to the role: he led information systems security at Danone, served as CISO of Louis Vuitton for a decade, and spent eight years leading cybersecurity and architecture at Stime, the IT department of the Les Mousquetaires group. In October 2026 he joined France Travail, the French public employment agency, as Deputy Director General for Governance, Responsibility and Security. He joins an agency that France’s data protection authority fined €5 million in January 2026 over a 2024 breach affecting 36.8 million people, and which must demonstrate corrective measures on a set timetable.
Arinder Badyal – Group Head of Information Security, Transport UK Group
Arinder Badyal has made rolling stock part of her security remit. As group head of information security at Transport UK Group since July 2023, she oversees security for a group that owns franchises across four train operating companies, with a focus on assessing operational technology cyber risk in rolling stock and building security training and awareness programs. Beyond her own group, she has chaired the Rail Information Exchange, which brings rail organizations together on cyber resilience. Badyal came to rail from eight years at PwC, where she moved from client accounts into cross-sector cyber security consulting, followed by security roles at West Midlands Trains and Abellio.
Martin Cullen – Global ICT Audit Senior Manager, Kerry
At Kerry, Martin Cullen has sole responsibility for auditing the company’s global IT environment, which spans 140 countries and more than 150 manufacturing sites, with a team of one other auditor. He has worked in all three lines of defense: after starting as a software engineer at ESB in 1990, he moved into IT audit at daa, led IT audit at ICON and MUFG Investor Services, headed risk assurance for IT, data, and outsourcing at AIB, and managed technology risk at permanent tsb. He is president of the ISACA Ireland Chapter, which provides seminars, workshops, and professional meetings for audit, control, and security professionals across the country. An ISACA-accredited trainer in CISA, CDPSE, CGEIT, COBIT 2019, and cybersecurity fundamentals, he has also delivered global webinars for ISACA International and presented on cybersecurity at EuroCACS.
Matthias Goeken – Professor, Deutsche Bundesbank
Matthias Goeken founded and co-edits the journal IT-Governance, and at the Frankfurt School of Finance & Management he founded and led the IT-Governance-Practice-Network while managing funded research projects on governance, risk, and compliance. As vice president for publications at the ISACA Germany Chapter, he applies that editorial experience to the chapter’s publishing work. Goeken is professor of business informatics at the Deutsche Bundesbank’s University of Applied Sciences, where his research covers IT governance, including IT security management and IT risk management. An economist by training, he earned his PhD at Philipps University of Marburg and serves as an accreditation expert for FIBAA.
Daniel García Sánchez – Managing Director, ISMS Forum
Under Daniel García Sánchez, ISMS Forum, the Spanish Association for the Advancement of Information Security, became a certification authority for data protection officers under the Spanish Data Protection Agency’s scheme. He directs that certification body and has led the association as managing director since 2016, after five years running its events, communications, and institutional relations. Under his leadership, the association has held 20 editions of its international information security conference, published guides on data breach notification and big data protection, and runs annual cyber crisis management and CyberEx simulations. He also sits on the board of the CyberMadrid Business Cluster, and in April 2026 led a conversation with a bank CISO in Valencia on how the CISO role is changing.
The Day Jobs Behind the Community Work
Of the five, only García Sánchez leads a professional association as his full-time role. The other four do their community work alongside roles securing rail franchises, auditing a global manufacturer’s IT, teaching and researching IT governance, and, in Bru’s case, a new governance and security post at a public agency under a regulatory order to strengthen its security.
Discover more CISOs securing their organizations:
-
- Honored in 2026: Europe’s Award-Winning Cybersecurity Leaders to Watch
- Protecting the Services Canadians Rely On: The Cyber Leaders to Watch
- 10 ORBIE Award-Winning Cybersecurity Leaders to Watch in 2026
- 10 Cyber Leaders Bringing Local Experience to MS-ISAC’s Next Chapter
- No Organization Left Behind: Canada’s Community Cyber Leaders to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.