Heritage Bank

Mikhail Lopushanski, Chief Information Security Officer, Heritage Bank

Mikhail Lopushanski is the Chief Information Security Officer for Heritage and People’s Choice, Australia’s leading customer-owned banking organization. 

He has directed and established information/cyber security, business continuity, risk management, privacy, audit, corporate strategy and governance in both public and private sectors, as well as ran his own consulting business.  He has also established several threats intelligence-sharing groups to improve the visibility of threat activity across the industry.

He holds several industry qualifications including FGIA/FCIS, FCSA, GAICD, CISM, CRISC, CISA, and CDPSE and is an active member of the Australian Information Security Association.

When he isn’t advocating security governance, he spends his time cycling or enjoying photography while bushwalking. 

Could you provide an overview of your role and responsibilities within the company?

As a key and strategic role, the CISO is responsible for driving and maintaining Heritage People’s Choice’s comprehensive organization-wide information security management program. My role is responsible for supporting and enabling the business objectives and protecting and safeguarding our critical information and data, while also meeting legal and regulatory compliance requirements.  My team provides senior management and the Board with advice, strategy and assurance across information security.  

What are some of the key challenges you face?

Given our recent merger between Heritage Bank and People’s Choice Credit Union, our focus is on integrating information security functions, the future technology roadmap, and risk management. Third and fourth-party risk has also been a key focus area.

Thinking outside of the usual recruitment box has been important to get a diversity of thought and experience in the team.  As my function develops, it is important to have a team with diverse work and knowledge experiences.

What would you say are some of the futuristic trends that will have an impact in the next 18-24 months?

In the next 18-24 months, I think we will see more code injection into open-source libraries and AI data poisoning. These attacks will start to creep into the supply chain, which will impact managed services and managed platforms.

“ Experience in other areas such as legal, audit, media or operations can contribute to understanding a broader context in terms of compliance, risk, and social engineering – what makes people ‘click’.”

I believe we will also start to see a move to updated regulations in areas of privacy and data management, especially after significant data breaches in the domestic market. More regulation is not necessarily the only answer, but it is used as a visible response to public issues to drive an industry outcome.

What advice would you give to young professionals who are interested in pursuing a similar career, and what qualities do you think are essential for success in this field?

Don’t be defined by your previous experience or the idea that you must go down a particular route to get into information security.  Having a technical background or understanding is important, but this does not necessarily mean you need to come up through your IT department.  Experience in other areas such as legal, audit, media or operations can contribute to understanding a broader context in terms of compliance, risk, and social engineering – what makes people ‘click’.

If you are interested in information or cyber security, there are a lot of good resources online and several industry-level certifications that can help uplift your understanding. Ask within your current organization whether there are any opportunities to second into a cyber role or intern in a technology risk team.  Certifications are important to show a technical understanding, but practical experience provides real-world knowledge.