Jean-Baptiste Bres

Chief Information Security Officer

Is Australia struggling from a bout of breach fatigue

Another good read this week…

Screen Shot 2019-12-03 at 09.55.39

Unto the breach: let’s face up to data security

We just published an article that talks about data security and how we, at Xinja, are protecting our customers. Let us know what you think!

Screen Shot 2019-10-15 at 13.12.25

Cyber Attack Conference Sydney 2019

I am very honoured to be one of the speakers at the upcoming Cyber Attack 2019 Conference in Sydney on October 17th. I will be facilitating a round table discussion on how to implement a security Bring Your Own Device (BYOD) policy.

Australian banks face secret penetration tests

An interesting initiative from NPP (which coordinate the open access infrastructure for fast payments in Australia, PayID). Following the PayID lookup attacks that occurred in the last months, they might now perform secret penetration tests to ensure that participating banks are up to the right level of protection. 💡


Security Designer @ Xinja

Last but not least, we are also hiring a Security Designer, a strategically critical role in defining and assessing Xinja’s security strategy, architecture and practices.

If you think this is something for you, contact me or visit Xinja career website for more information.

Security Designer

Info Sec GRC Manager @ Xinja

Another great opening in the Xinja Security Team. We are looking for an Information Security GRC Manager!

This is a key role for the organisation: You will manage the information risk and security governance, focussing on raising standards and awareness, as well as providing assurance and monitoring compliance with policies and standards.

If you think this is something for you, contact me or visit Xinja career website for more information.

More openings coming soon…

Screen Shot 2019-08-05 at 10.15.51

DevSecOps role @ Xinja

Another great new security-related role we are recruiting for at Xinja: we are looking for a DevSecOps engineer with a focus on security automation. You’ll be embedded in the DevOps team to facilitate continuous delivery of secure, quality software to the Xinja Banking Platform using DevSecOps practices and principles. You’ll need to have a broad cross section of skills along with a strong consultative approach.
You’ll work with software engineers and security experts to ensure that the right practices are in place and to take the security lead on automating the path to production to enable deployment of changes with no manual intervention and in a highly secure manner.
We run a small, crack team of DevOps engineers to help us to build out a world class continuous integration and delivery pipeline for the Xinja Banking Platform as we continue to scale at pace. You will ensure security standards are upheld and secure coding practices maintained.
You should know that we do things a little differently at Xinja. You won’t be micromanaged and will have the flexibility to choose the tools you need to get your work done. Along with the team you work with, you’ll be given autonomy on how you design and build DevSecOps processes as long as it stays within the guidance of the Xinja Software Development Lifecycle and Information Security Management System. You should be comfortable with pushing new tools and processes and challenging the norms of secure software development and deployment.

If you think this is something for you,
contact me or visit Xinja career website for more information.

More openings coming soon…


Security Analyst role @ Xinja

I am recruiting a Security Analyst to join the fantastic security team at Xinja. The role will be responsible for assisting in building upon and improving Xinja’s Information Security Program. You will be the primary technical security resource in a small team responsible for the day-to-day operations of the security of all things Xinja.

If you think this is something for you, contact me or visit Xinja career website for more information.

More openings coming soon… 😉

Security Analyst

Your inbox is spying on you

It seems that Technology and Privacy still have a long road to go to work hand-in-hand. Security is still - for a lot of organisations - an afterthought and not an inherent part of the design.

"When we built [our company], we focused only on the needs of our customers. We did not consider potential bad actors." 😧

Read more:

Is your cybersecurity training reaching the right people?

People attitude toward security is probably the most important factor when it comes to ensure a good Security strategy is in place. Even with the right technical protections, if people do not act carefully, it is not going to work out! So awareness is key. And targeting the right audience is critical to ensure the right outcome. On that topic, ZDNet published an interesting article titled: Is your cybersecurity training reaching the right people?

💡 Conference Transcript: Building an Information Security Policy Framework


Following my presentation on Building an Information Security Policy Framework at the "Implementing CPS 234" conference held in Sydney in May 2019, I received many requests to publish a transcript. Thank you all for your interest and for the large amount of feedback you shared with me. As promised, here is an augmented transcript of my presentation.

It covers an overview of what a Policy Framework is, and why it is an essential part of any Information Security program; the various existing frameworks used across the industry, their strengths and limitations; a methodology to create a flexible framework, supported by a risk assessment and a strong understanding of the assets owned by the institution and the threats they are exposed to; and an approach to define an adequate control set and how to prioritise its implementation.

Read More…

Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

Microsoft today is taking the unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003, citing the discovery of a “wormable” flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of 2017. Read more at

💡 Creating a Secure Bring-Your-Own-Device Strategy


Corporate reality is that there is a growing interest from employees to use their personal devices for work. This can have a very positive impact on business – choosing which device is best for them and when, empowers workers and makes them more productive – but it also raises many security concerns for the enterprise – especially around access, confidentiality of information, compliance, security and privacy.


In order to define how employees will be able to interact with the corporate resources, the Bring-Your-Own-Device (BYOD) strategy is a critical part of your journey toward BYOD. It is there to define the capabilities your organisation offers to employees to use their personal laptops, smartphones or tablets for work.

To assist you in your journey, this article covers how to answer these questions and what are the options available for you in order to create a secure BYOD strategy.

Read More…

What the Marriott Breach Says About Security

Marriott disclosed earlier this week a four-year-long breach. It involved the personal and financial information of 500 million guests of some of its hotel properties.
What could have gone so wrong that such a breach remained unnoticed for so long? This great article shares some considerations around the security postures that companies take on, and why they work... or not.

💡 APRA CPS 234: Are you ready?


The Australian Prudential Regulation Authority (APRA) just published the final version of the Prudential Standard CPS 234 (Information Security), that will be enforceable by 1 July 2019. Have you assessed your readiness? This article reviews the main expectations from the regulator and provides some guidance on how to ensure timely compliance.

Read More…

Facebook Security Breach Exposes Accounts of 50 Million Users

Facebook is breached, putting 50 Million users’ data at risk. Great time to ask yourself what data you are making available on the net, and what would you do if it ends ends available to all because of a breach? Maybe it’s time to close your social network accounts that are not providing you any real value?...

💡 Security 101 – Why is it not safe to share sensitive information by email?


You are regularly being reminded by your security team that sharing sensitive information by email is not safe. But why? Well, good question. Here are some answers

Read More…

💡 Understanding Meltdown and Spectre


As an executive or senior manager, what should I know and what should my company be doing about Meltdown and Spectre?
If you are not an IT Security specialist and you have been trying to understand what all the fuss is about - you are probably struggling to find articles that are not overly technical or too generic. Hopefully, this one will be answer your questions.

Read More…