When a cyber incident disrupts normal operations, there is little time to work out who decides what, which systems come back first and how the organisation keeps serving people in the meantime. The five leaders below work on those questions before they become urgent, across energy, fibre, telecommunications, entertainment and higher education. Their focus areas differ, from crisis leadership and incident playbooks to monitoring and assurance, but each is concerned with what an organisation needs to practise before something goes wrong.
Jon Edney – Head of Cybersecurity & Privacy, Tuatahi First Fibre
Jon Edney brings Civil Defence experience to cyber security, including crisis leadership, critical infrastructure and coordinating multiple agencies through high-pressure incidents. In a practical guide to incident management, he has set out the difference between incident playbooks, crisis plans and continuity planning, and the importance of clear escalation paths and leadership responsibilities. Since 2019 he has led cyber security and privacy at Tuatahi First Fibre, covering its business systems and wholesale fibre network, advising the CEO, board and Audit and Risk Committee on cyber risk, privacy and resilience, and serving as company privacy officer. He started as a software developer in the UK, working for Essex County Council, BT and Freshfields, before moving to New Zealand, where he spent 12 years at Bay of Plenty Regional Council, progressing from software development into ICT operations and then leading its security and infrastructure team.
Jenni McNeil – Head of Security and Infrastructure, Contact Energy
As a principal security specialist at Contact Energy, Jenni McNeil developed and maintained the company’s key incident response procedures and playbooks. Today, as head of security and infrastructure since February 2025, she is accountable for cyber security, core infrastructure and technology resilience, and leads incident and disaster recovery readiness. Her 15 years at Contact Energy have taken her from ICT coordinator to security operations lead, information risk and security specialist, and head of information security. She was listed to discuss nation-state threats and their implications for New Zealand at Forefront’s 2026 Cyber Resilience Summit. Before moving to New Zealand, she worked in the UK as a security consultant and as a security solutions architect at Siemens, designing security for communications systems connected to government restricted networks.
Laura Ross – CISO, One New Zealand
Laura Ross learned incident management in UK government. As network security officer at the Department for International Development, she worked with government bodies including CPNI and CESG on security policy and incident management, and led a global secure laptop and document management rollout. She went on to security assurance and architecture work for the Home Office, the Bank of England and Deloitte, with a focus on intelligence agencies and critical national infrastructure, and ran her own consultancy, InformAssure. In New Zealand, she has led cyber security risk, threat and compliance and then cyber strategy, architecture and risk at One New Zealand and its predecessor, before becoming CISO in July 2025. She was scheduled to join a discussion on incident response and crisis readiness at Forefront’s 2026 summit, and is an advocate for women in technology and the NZ Mana Wahine Network.
Cristian Ares – Head of Cyber Security Governance and Compliance, SkyCity Entertainment Group
Monitoring runs through Cristian Ares’s career. Originally from Argentina, he specialised in SIEM and identity and access management, implementing IBM security tools for banks, government and military agencies across Spanish-speaking South America, and building identity, SIEM, DevOps and patch management capabilities from the ground up at Sociedad Militar, a mutual bank serving Argentina’s security and military agencies. After managing IT risk for EY Global, he moved to New Zealand, where he led security design and infrastructure teams at Spark and served as principal cyber security and network architect at CCL, designing proactive monitoring and alerting so problems could be resolved before they affected services. Since July 2025 he has been head of cyber security governance and compliance at SkyCity Entertainment Group, and he was listed for a 2026 session on monitoring, assurance, data context and security operations readiness.
Aram Raof-Karim – CISO, University of Otago
Aram Raof-Karim has served as a New Zealand Army officer since 2012, seven years in the regular force and since 2019 in the reserves. That military career runs alongside a path through cyber security: as engagement manager and then team lead at the NCSC, as a security consultant at Computer Concepts, and as information security manager at the University of Canterbury. Since October 2024, Raof-Karim has led cyber security at the University of Otago, where the role covers protection, detection, response and controls, and is credited with contributing updates to the university’s security framework in 2025.
Practice Before Pressure
Edney brings crisis leadership from Civil Defence, McNeil wrote the playbooks before she led readiness, Ross learned incident management in government, Ares has spent his career on monitoring, and Raof-Karim combines military service with security leadership. Each, in a different way, is focused on making sure their organisation has practised its response before it needs it.
Discover more CISOs securing their organizations:
-
- Protecting the Mission: Australia’s Not-for-Profit Cyber Leaders to Watch
- Behind the Deputy Title: The Deputy CISOs to Watch
- More Than Security: The CISOs Whose Titles Include Privacy, Identity and Technology Risk
- When Customers Depend on You: The Security Leaders Protecting the Services Businesses Run On
- Running It and Securing It: The Cyber Leaders Who Own Both Infrastructure and Security
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.