Australia’s banks operate under APRA’s demanding security standards and face constant pressure from fraud rings and nation-state actors alike. The five CISOs below protect some of the country’s largest and most closely watched financial institutions, from a major bank and a global investment group to international banks and a wealth manager. Their routes into the role are strikingly varied. One has led security at Westpac since 2009. Another began as an accountant in Newcastle and built market risk models in Hong Kong before turning to cyber. A third led security at a neobank built from scratch, and a fourth started on an SAP service desk before rising to lead security for a global bank’s Australian and New Zealand operations.
Richard Johnson – CISO, Westpac
Richard Johnson began as chief security engineer at Bankers Trust Australia before joining Westpac in 2003 as head of technical security services. He went on to lead architecture research and cybercrime, and has served as Westpac’s CISO since 2009, making him one of the longest-serving bank CISOs in Australia. His expertise spans enterprise risk management, ISO 27001, PCI DSS, and enterprise architecture. Johnson holds a Bachelor of Economics in accounting and finance from the University of Sydney and the CISM certification.
Steven Ebrill – Group CISO, Macquarie Group
Steven Ebrill started as an accountant at Prosperity Advisers in Newcastle and worked in market risk at HSBC in London. Over more than 14 years at Standard Chartered, he headed equity and convertible bond market risk in Hong Kong, developing the equity business’s VaR model, before moving into change and transformation leadership in Singapore. As managing director for the Group COO, he was accountable executive for the bank’s operational continuity in resolution programme, then led its group-wide information and cyber security transformation and remediation portfolio, presenting frequently to the board. He later led cyber threat mitigation and built a cyber risk index into the bank’s official risk framework. After leading data and digital identity transformation at Optus, Ebrill joined Macquarie Group in 2024 to lead cybersecurity transformation and became Group CISO in September 2025.
Jean-Baptiste Bres – CISO & Director of Enterprise AI & Technology, AMP
Jean-Baptiste Bres began in Paris as an IT support and business analyst at BNP Paribas and as a project manager at Société Générale, where he turned around a struggling trade finance platform migration to deliver a 10% productivity gain. After moving to Sydney with BNP Paribas, he led information security, operational risk, and continuity for Australia and New Zealand. As CISO of StatePlus, he helped make it the first Australian financial institution to move a system of record to the cloud in line with APRA CPS 234. He then served as CISO of neobank Xinja, which was built from scratch on a cloud stack and earned the highest security score of any Australian bank in 2020, and as CISO of Avenue Bank and HSBC Australia, also leading HSBC’s regional security cluster across five countries. Bres joined AMP as CISO in 2024 and in July 2026 added responsibility for enterprise AI. He holds CISSP and CGEIT certifications, mentors emerging security professionals, and has lectured in information technology.
Martin Doherty – CISO Australia & New Zealand, HSBC
Martin Doherty started as a security analyst at Vertex Data Science in Liverpool and spent nine years at HP, rising from engineer in Manchester to lead its EMEA 24/7 security incident response team and then head managed security services across Asia Pacific and Japan, building and launching a new security operations centre in Sydney. At Commonwealth Bank he led cyber defence, overseeing the investigation, containment, and remediation of all cyber security events across the group worldwide. After heading cyber risk and compliance at Macquarie Group, he built the risk framework and cyber controls at payments fintech mx51 from the ground up, maintaining PCI DSS compliance and achieving its first SOC 2 Type 2 report. Doherty became CISO of HSBC Australia and New Zealand in April 2024.
Dineish Nallainathan – Head of Information Security (CISO) – ANZ, Rabobank Australia
Dineish Nallainathan started on the SAP service desk at KPMG and spent several years in SAP security at UBS, Tata Consultancy Services, and Barclays in Singapore, where he became global security delivery lead. He moved into broader security leadership at Accenture, working on the national electronic health record programme for the Department of Health, then led cyber risk and governance at Caltex and cyber risk at Westpac, while also teaching IT and cyber security at Western Sydney University. At ING Australia he led security strategy and governance and served as interim head of identity and access management and interim CISO. Nallainathan joined Rabobank Australia in August 2025 as head of information security and CISO for Australia and New Zealand.
Guarding Australian Finance
These five CISOs bring a wide range of experience to banking security. Johnson has led Westpac’s security for nearly two decades, while Ebrill brought market risk and transformation leadership from Asia to Macquarie. Bres and Doherty built careers across neobanks, fintechs, and global banks, and Nallainathan rose from SAP security to lead a bank’s regional programme. Together they help keep Australia’s financial system secure and trusted.
Discover more CISOs securing their organizations:
-
- Trust and Treasure: New Zealand’s Financial Services Cybersecurity Leaders to Watch
- Protecting the Patient: The Netherlands’ Hospital CISOs to Watch
- Public Service, Protected: New Zealand’s Government CISOs to Watch
- Power and Water: Denmark’s Energy and Utilities CISOs to Watch
- Chemistry and Code: Germany’s Chemicals Manufacturing CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.