Ottawa defends Canada twice over. The city houses the federal institutions that set national cyber defense posture, and it hosts technology companies whose platforms carry Canadian commerce worldwide. The cybersecurity leaders below work at the central bank, the national cyber security centre, an export credit agency, a police service, the .ca domain registry, and two of the best-known names in Canadian tech. Several spent a decade or more inside the organizations they now protect.
Hisham El-Bihbety – CISO & Deputy CIO, Bank of Canada
Hisham El-Bihbety has spent more than 14 years at the Bank of Canada, serving as Chief Information Security Officer since June 2018 and also carrying the Deputy CIO title. His program covers systems that underpin the national financial system, from monetary policy operations to payment infrastructure. He describes his approach as people-centric security leadership, building the program around the teams who run it rather than around tooling. Eight years in the role at a central bank puts him among the longest-tenured security executives in Canadian finance.
Andrew Dunbar – CISO, Shopify
Andrew Dunbar has been at Shopify for more than 14 years, rising through the company before becoming Chief Information Security Officer in June 2023. He previously spent four and a half years as VP of Security Engineering and IT, working from the Greater Ottawa area where Shopify was founded. The platform powers millions of merchants worldwide, and storefronts, payments, and merchant data all sit inside the perimeter his teams defend. His path from engineering leadership into the CISO role reflects how the company treats security, as an engineering discipline embedded in the product rather than a compliance layer on top of it.
Jean-Claude Lemonde – CIO, Ottawa Police Service
Jean-Claude Lemonde spent nearly eight years leading information security at The Ottawa Hospital, one of Canada’s largest academic health sciences centres. His work there included planning digital health record systems with the Centre d’expertise du Dossier Santé Numérique. He later served as a strategic advisor on technology and information security at the consultancy Cofomo. Lemonde became Chief Information Officer of the Ottawa Police Service in June 2024, where he now oversees the systems supporting front-line policing, investigations, and the custody of justice data. He brings more than 20 years of IT and security experience to the role.
Richard Kimball – VP Information Security, BlackBerry
Richard Kimball has led enterprise information security strategy and execution at BlackBerry since July 2023, working from Ottawa. The company now sells cybersecurity software and embedded systems technology to governments and enterprises worldwide, which means its internal security program doubles as a reference point for what it markets. Kimball’s remit covers cybersecurity strategy and executive risk governance across that business, including protection of technology used by critical infrastructure operators.
Jason Gallaugher – Chief Technology & Security Officer, CIRA
CIRA operates the .ca domain registry and runs Canadian Shield, a protective DNS service used by millions of Canadians. Jason Gallaugher joined as Chief Technology and Security Officer in May 2026, taking a seat on the executive leadership team reporting to the CEO, with accountability for both the technology and security agendas. He founded ThreeNorth Consulting in January 2021, an advisory practice serving clients across North America.
Atul Deut – VP & CISO, Export Development Canada
Atul Deut has spent nearly nine years at Export Development Canada, all based in Ottawa. He served more than four years as Director and Head of Enterprise Information Security Operations, Engineering and Transformation before becoming Vice President and Chief Information Security Officer in April 2024. EDC is Canada’s export credit agency, providing financing, insurance, and market intelligence to companies trading abroad, and its systems carry commercially sensitive data across most sectors of the economy. Deut’s progression from running security operations into the VP-CISO office gives him an operator’s view of the program he now directs.
Rajiv Gupta РHead Canadian Centre for Cyber Security, Communications Security Establishment Canada | Centre de la s̩curit̩ des t̩l̩communications Canada
Rajiv Gupta joined the Canadian Centre for Cyber Security’s leadership in July 2021 and spent three years in senior roles before becoming its head in September 2024. The Cyber Centre is Canada’s technical authority on cyber security, operating within the Communications Security Establishment. It protects Government of Canada systems and issues the guidance, alerts, and defensive services that critical infrastructure operators and Canadian businesses depend on. Gupta directs that work from threat assessment through incident response coordination, based in Ottawa at the centre of the national security community the organization serves.
The Capital Advantage
Ottawa concentrates an unusual amount of national cyber responsibility in a single labour market. The Cyber Centre publishes guidance a short drive from the federal institutions that must follow it. El-Bihbety, Deut, and Gupta all work within that public mission culture, while Dunbar and Kimball run security at companies whose products reach far beyond Canada. Lemonde and Gallaugher occupy the layers in between, municipal policing and internal infrastructure. Careers here tend to cross sectors: hospital security into police technology, consulting into infrastructure leadership, security operations into the CISO chair. That movement gives the city’s security community a shared vocabulary that few other places can match.
Discover more CISOs securing their organizations:
- Quebec City’s Cybersecurity Leaders to Watch
- Richmond’s CISOs to Watch
- From the Plains: Wichita’s Cybersecurity Leaders to Watch
- Oklahoma City’s Cybersecurity Leaders to Watch
- From the Tennessee Valley: Knoxville’s Cybersecurity Leaders to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.