Show Notes
Most people arrive at the CISO chair from the outside. Graham Fairley did the opposite — he earned it from within.
In this episode, host David Savva-Willett sits down with Graham Fairley, Chief Information Security Officer at PEXA (Property Exchange Australia), for a candid and personal conversation. Davey held the CISO role at PEXA before Graham, and the two have been friends and colleagues for the better part of a decade — which makes this a rare, honest look at what it actually takes to grow into one of the most demanding seats in Australian cyber.
Graham progressed through identity and access management, security consulting and a security services lead role before stepping into the CISO chair in late 2024. Eighteen months in, he reflects on the learning curves nobody warns you about: winning executive and board buy-in, sitting with the weight of accountability, learning to let go of the technical work he loves, and becoming the kind of storyteller a modern security leader has to be.
They also get into what PEXA actually protects — a platform underpinning Australia's ~$10 trillion property market and designated critical infrastructure — including the 6.5 million intrusion attempts PEXA blocked in a single financial year, four times the previous year's volume. Graham unpacks PEXA's layered defence approach, and the harder problem beyond the platform: the consumer. As he puts it, criminals don't need to compromise systems — they just need to compromise trust. In this episode: Why the "internal" route to CISO is undervalued — and the edge it gives you The first 18 months in the chair, and the skills that sharpened fastest Why every CISO has to be a storyteller (and where AI genuinely helps) Learning to step back so the team — not the CISO — becomes the hero Defending critical infrastructure at scale: layered controls, threat intel and speed-to-detect Social licence, shared accountability and PEXA's Safeguarding Your Property Settlement white paper AI-supercharged business email compromise, and the "stop and think" habits that stop it Real advice for anyone who wants the CISO job one day Cyber Voices is the official podcast of the Australian Information Security Association (AISA). If you're enjoying the show, a five-star rating (about five seconds of your time) genuinely helps more people find it.
Interested in sponsoring Cyber Voices or reaching the AISA community at CyberCon? Contact the AISA national events and sponsorship team via [email protected]. #CyberSecurity #CISO #AISA #CyberVoices #PEXA #CriticalInfrastructure #InfoSec #Leadership
More from Cyber Voices
Recorded on the CyberCon 2026 expo floor in Melbourne, this episode sees host David Savva-Willett sit down with Keren Elazari, the friendly hacker, the day after her keynote closed out day one of the conference. Keren is the founder of BSidesTLV and Leading Cyber Ladies, a senior researcher at Tel Aviv University, and the speaker behind one of TED's most watched talks on why the world needs hackers.
Recorded on day three of CyberCon 2026 in Melbourne, the first episode of the Cyber Voices CyberCon series brings AISA Chair Michael Burchell back into the booth with host David Savva-Willett. Close to 5,800 delegates came through the doors this year, a record for the conference, and the pair reflect on what made it work: a program with a record number of speakers presenting for the first time, a deliberate focus on cyber while a global trend pulls conferences towards AI, and a community that turns up to share what it has learned.
There was a pen on the table at a workshop. Placed next to an unlocked phone, it opened the browser and loaded the facilitator’s website, with nobody tapping anything and nobody agreeing to anything.
Information stealing malware is not new and not sophisticated. That is precisely what worries Jesse Hoppo, who leads the open source intelligence and cyber crime team within Telstra's Threat Research and Intelligence Group, and who spends a good deal of his time reading what these things send home.
Governance, risk and compliance generates a great deal of manual work, and not all of it is work anyone would miss. Ian Yip's argument is that this is exactly where AI earns its place in a security team, provided nobody mistakes it for judgment.