Shane Read

Head of APJ Sales & Field CISO @ Goldilock Secure

About

I help critical infrastructure operators across Asia-Pacific enforce physical-layer network isolation, the controls your software stack can’t provide.25 years across Australian Defence, the Federal Government, and multinational organisations. Nine of those as a CISO across Asia. Now leading Goldilock’s expansion across APJ.I write about the gap between where software-defined security ends and where physical-layer controls begin. Most security architectures assume the network is always connected. I challenge that assumption.What I focus on: • Physical Connection Control (PCC), hardware-enforced network isolation for critical infrastructure • OT/ICS security for energy, water, transport, ports, defence, and mining • SOCI Act compliance, ASD Essential Eight, CIRMP, and ISM alignment for Australian CI operators • ASEAN critical information infrastructure frameworks, Singapore Cybersecurity Act, MAS TRM, regional CII obligations • Semiconductor and FAB security, SEMI E187/E188 physical isolation standards • Translating complex OT security into board-ready language and procurement-ready architectureThe Kinetic CISO - my Substack publication - explores physical-layer security for critical infrastructure. If you’re responsible for securing OT environments, it’s written for you.Previously: CISO at Noble Group (Hong Kong), CISO/CIO at a digital asset custodian, Information System Security Manager at the Australian Department of Defence, and advisory roles across financial services, defence primes, and regulated industries.Based in Canberra. Working across Australia, Singapore, Taiwan, Malaysia, Thailand, and New Zealand.

Country

City

Australia

Industry

Computer & Network Security

Skill

Security Architecture Design, Third Party Risk Management (TPRM), Cyber-Physical Systems Security, Critical Infrastructure Protection, OT Security / Operational Technology Security, Physical Network Isolation / Network Segmentation, Zero Trust Architecture, SOCI Act Compliance / Critical Infrastructure Risk Management, Governance Risk and Compliance, Governance, Risk Management, and Compliance (GRC), Leadership, General Management, Go-to-Market Strategy, Hardware Security, New Business Development, Defense Sector, Auditing, Vendor Management, Strategic IT Management, Information Security

Experience

Head of APJ Sales & Field CISO

Goldilock Secure

2024-1 - Present · 2 yrs 8 mos

Canberra

Leading Goldilock’s market expansion across Australia, Singapore, Taiwan, Malaysia, Thailand, and New Zealand. Goldilock’s FireBreak is a Physical Connection Controller (PCC) that enforces hardware-level network isolation at OSI Layer 1 — physically disconnecting and reconnecting critical network segments via non-IP, out-of-band remote command. I work with critical infrastructure operators, systems integrators, and government agencies across energy, water, transport, ports, defence, mining, and financial services to deploy physical-layer controls that sit beneath the existing software security stack. Recognised by NATO’s DIANA Accelerator. Building channel partnerships across APJ, with authorised distribution through M.Tech Products (Singapore) and established Australian distribution.

Principal

TJL Cyber

2021-3 - Present · 5 yrs 6 mos

Australia

At TJL Cyber, I provide strategic cybersecurity leadership to MNCs and regulated industries, ensuring compliance, resilience, and risk-aligned security operations. • Cyber Strategy & Risk—Develop enterprise-wide cybersecurity strategies, aligning with MAS TRM, GDPR, NIST CSF, ISO 27001, and industry best practices. Advise C-suites and boards on risk, cyber investment, and compliance. • Regulatory Compliance & GRC – Build and implement governance, risk, and compliance (GRC) frameworks, ensuring audit readiness and regulatory adherence for financial services, critical infrastructure, and insurance. • Target Operating Model (TOM) Development – Design scalable TOMs that align people, processes, and technology with business objectives, IT architecture, and security mandates. • Security Leadership & Operations – Lead cyber teams, security transformations, DevSecOps integration, and risk-driven security programs while engaging with regulators, auditors, and industry bodies. • Incident Response & Threat Management – Oversee SOC, threat intelligence, BCP/DR planning, and security automation, ensuring resilient operations against evolving cyber threats. ✅ Advised Fortune 500 firms, financial institutions, and critical infrastructure providers on cyber risk and compliance. ✅ Designed & implemented TOMs for regulated MNCs, optimising security and operational resilience. ✅ Led major security transformations, enhancing cyber posture while optimising investments.