NAB's CSO to move to ANZ Banking Group

NAB’s group chief security officer of over five years Sandro Bucchianeri will head for fellow ‘big four’ bank ANZ in November to lead security there.

ANZ revealed the coup in a statement on Wednesday, announcing that Bucchianeri would start as chief information security officer (CISO) on November 11.

A NAB spokesperson was contacted for comment.

Bucchianeri will report to ANZ Group CIO Donald Patra, who is less than a year into his role leading the bank’s technology division.

“As CISO for ANZ, Bucchianeri will be responsible for leading ANZ’s information and cyber security strategy and driving a threat-led, risk-informed approach across the enterprise,” ANZ said in a statement.

“He will work closely with teams across the bank to manage risk and uplift cyber maturity and capability.”

Patra added: “Sandro is an outstanding and globally respected security leader, with a proven track record of uplifting cyber maturity across large, complex organisations.

“As cyber security threats continue to evolve at pace, Sandro’s experience will be invaluable to maintaining the delivery of safe, resilient services for our customers.”

Until Bucchianeri joins, Shane Ripley will remain as ANZ’s acting CISO.

ANZ’s last permanent CISO, Dr Maria Milosavljevic, retired from full-time work earlier this year. 

Bucchianeri was appointed group CSO at NAB back in mid-2021.

In a LinkedIn post, Bucchianeri wrote that it was a "difficult decision" to leave.

"To my team, thank you for the role you played in building a security function I am exceptionally proud of," he wrote.

"It was an honour to lead a team spanning three continents, unified under one mission of protecting people, assets, and information.

"I'm proud of what we accomplished together, and prouder still of who we became along the way."

Bucchianeri also thanked former and current leaders of NAB Ross McEwan and Andrew Irvine respectively, as well as retiring technology leader Patrick Wright.

NAB, like a handful of other blue-chip organisations, has a CSO as its key security role, with responsibility spanning both information and physical security domains.