New Zealand’s banks, insurers, and wealth managers hold the savings and financial lives of millions of people, and the five cyber leaders below protect some of the country’s most important financial institutions, from the central bank to its largest non-government money manager. Their careers span four decades and several continents. One started as a security administrator at Trust Bank New Zealand in 1983 and has worked on mainframe security ever since. Another assembled clone PCs in Henderson in the mid-1990s before building his own IT business. A third managed Macquarie Bank’s IT across London, New York, and Munich, and a fourth helped integrate an early version of the Symbian mobile operating system.
Richard Boxall – CISO, Bank of New Zealand
Richard Boxall spent more than 14 years at Macquarie Bank, rising to division director and managing IT for its northern hemisphere operations across London, New York, and Munich. He went on to lead IT infrastructure and technology support at BT Financial Group, IT operations for the Woolworths group of companies across Australia and New Zealand, and IT operations including cybersecurity at Boral. At Suncorp Group he led IT infrastructure, oversaw the technology programme to divest its life insurance business to TAL, delivered on time in 2021 after three years, and then led cyber and physical security and later cyber security and technology risk as executive general manager. After a career break and consulting work across Australia and the Pacific, Boxall became CISO of Bank of New Zealand in January 2025. He also served on the eHealth NSW advisory board.
Paul Macpherson – CISO, Reserve Bank of New Zealand
Paul Macpherson began as a senior security administrator at Trust Bank New Zealand in 1983, spending 12 years there before taking the same role at New Zealand Police. His specialty is security controls on IBM mainframes using RACF, ACF2, and TopSecret. He spent a decade at KPMG, rising to senior manager in risk advisory services, then worked as a senior information security consultant and information security officer at Westpac New Zealand. After four years as head of security at Xero, Macpherson joined the Reserve Bank of New Zealand in 2019 as manager of cyber security and became its CISO in May 2020.
Paul Manson – CISO, FirstCape
Paul Manson started out assembling clone PCs at Henderson Computers in the mid-1990s and founded his own IT business, Compusol, in 1998. He spent a year in a chartered accountancy practice, preparing statutory accounts and automating GST returns against bank feeds, then joined The Instillery as a field engineer on a three-month contract and stayed more than 11 years. There he created and led the field services and service delivery functions, grew client net promoter score by 40 points, directed the response to a ransomware attack at a large construction client, and designed a disaster recovery platform for JBWere that passed every annual test with a recovery point under ten seconds. He moved to JBWere as information security officer in 2022, building its third-party risk programme and driving repeat phishing victims to zero for two years. Manson became CISO of FirstCape in April 2025, leading security across JBWere, Harbour Asset Management, and Consilium at New Zealand’s largest non-government manager of money. He also works to help people, including his own sons, become harder to hurt online.
Mark Atherton – Head of Infrastructure and Cybersecurity (CISO), Suncorp New Zealand
Mark Atherton began as a Unix system administrator at Sun Microsystems in Edinburgh, later managing its worldwide engineering support operations. He moved to Sydney to lead situation and incident management for EDS across Asia Pacific and Japan, then managed service delivery and platform engineering for Commonwealth Bank. Over more than a decade at Hewlett-Packard and DXC Technology, he led delivery for clients including Bank of Queensland and public sector and global accounts across New Zealand and Australia. Atherton joined Suncorp New Zealand in 2021 as executive manager of infrastructure and operations, served as acting CIO, and became head of infrastructure and cybersecurity and CISO in August 2025.
Eli Hirschauge – NZ Head of Information Security, ANZ
Eli Hirschauge started as a programmer, team lead, and architect before moving into programme management in Europe, including integration management for the Symbian mobile operating system, PMO leadership at UBS Investment Bank, and a global IT service management rollout at RBS. After moving to New Zealand, he led project management at Optimation and spent more than five years as a director in PwC’s technology consulting practice. At Tower Insurance he served as technology delivery director, acting CIO, and head of strategy and governance and deputy chief digital and data officer, leading strategy, architecture, and cyber security, while also sitting on the board of the Insurance Claims Register. Hirschauge became NZ head of information security at ANZ in February 2023.
Steady Hands for New Zealand’s Money
These five leaders bring an unusual depth of operational experience to financial services security. Macpherson has protected banking systems since the mainframe era, while Boxall and Atherton built long careers in large-scale IT operations before taking on security. Manson grew from running his own IT business to leading security for a major wealth manager, and Hirschauge brought strategy and programme leadership to one of the country’s biggest banks. Together they help keep New Zealand’s financial system trusted and resilient.
Discover more CISOs securing their organizations:
-
- Protecting the Patient: The Netherlands’ Hospital CISOs to Watch
- Public Service, Protected: New Zealand’s Government CISOs to Watch
- Power and Water: Denmark’s Energy and Utilities CISOs to Watch
- Chemistry and Code: Germany’s Chemicals Manufacturing CISOs to Watch
- From Piazza Affari to Payments: Italy’s Financial Services CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.