Location · Sydney, Australia
Remote application security reviews that fit an Australian day
I assess your apps, APIs and edge controls remotely from Colombo, with my mornings overlapping your afternoons, and travel for the workshops that need it.
- Sydney
- UTC+10
- APAC
In short
For Australian organisations, I run application security assessments remotely from Colombo, which is four and a half hours behind Sydney outside daylight saving. I assess web and mobile apps, APIs (application programming interfaces), edge protection and monitoring, and map findings to the expectations you work under, such as APRA (Australian Prudential Regulation Authority) Prudential Standard CPS 234 and the Essential Eight. You get a ranked, vendor-neutral plan.
How we work together
Remote-first, on-site where it counts.
every working day
The market
What I see in Australia.
- Breaches go publicUnder the Notifiable Data Breaches scheme, eligible breaches are reported to the regulator and to the people affected.
- Prudential expectationsAPRA-regulated entities must show security capability matches the threats, including at third parties.
- APIs on the board agendaHigh-profile breaches have made exposed APIs and stolen credentials a board-level question.
Rules you work under
The frameworks I map findings to in Australia.
Findings are written so your risk, audit and compliance teams can use them directly. This is orientation, not legal advice.
- Australian Prudential Regulation AuthorityPrudential Standard CPS 234 Information SecurityRequires APRA-regulated entities to test their controls and manage information security risk at third parties.
- Australian Government, regulated by the OAICPrivacy Act 1988 and the Notifiable Data Breaches schemeA leak of personal data through an app or API that is likely to cause serious harm must be notified.
- Australian Signals Directorate (ASD)Essential Eight Maturity ModelWidely used as a baseline beyond government. How fast applications are patched is one of its maturity tests.
Sectors
Who I work with in Australia.
- BankingMobile apps, APIs and internet banking that regulators watch closely.Explore
- Fintech & paymentsWallets, payment APIs and apps that ship weekly and must stay trusted.Explore
- InsuranceCustomer and broker portals and partner APIs full of sensitive data.Explore
- TelecomsSelf-care apps, top-ups and busy edges that attract bots and floods.Explore
Services
Assessments available in Australia.
Fixed scope and a fixed fee. Every engagement ends in a prioritised plan you can take to any delivery partner.
- AppSec maturity assessmentScored baseline, gap analysis, 12–24 month roadmap, board summary
- Application architecture reviewThreat model, control coverage map, prioritised fixes
- WAAP & API protection assessmentCoverage gaps, bypass paths, migration or tuning plan
- Mobile app security assessmentMobile threat model, protection policy, MASVS test plan
- Exposure management (CTEM) assessmentPrioritisation model, validation approach, owner playbook, metrics
- Executive briefing or team workshopPlain-language risk briefing or hands-on workshop
- Fractional AppSec advisorRoadmap governance, vendor and design reviews, escalation support
Can a consultant in Sri Lanka work effectively with an Australian team?
Yes. Colombo is four and a half hours behind Sydney, or five and a half during daylight saving, so my mornings overlap your afternoons. Interviews, reviews and read-outs sit in that window, and evidence review between calls covers the rest. Perth is only two and a half hours ahead of Colombo, which makes overlap easier still. On-site visits are possible for key workshops.
How does application security relate to APRA CPS 234?
APRA (Australian Prudential Regulation Authority) Prudential Standard CPS 234 Information Security expects regulated entities to keep security capability in line with their threats, test how well their controls work, and manage risk at third parties. Customer-facing applications and APIs (application programming interfaces) are where much of that risk sits. An assessment gives tested evidence and a remediation plan that supports those obligations; it is not a legal opinion.
Does the Essential Eight cover application security?
Partly. The Essential Eight, from the Australian Signals Directorate (ASD), includes patching applications and user application hardening, but it was designed mainly for Windows-based networks. It does not address API (application programming interface) authorisation, bot abuse, business logic flaws or mobile app resilience. I treat it as a baseline and assess the application layer on top of it.
Do you also implement the fixes for Australian organisations?
Not by default. I assess and recommend; execution is scoped case by case, and only where you want help. Your own team or a local partner of your choice is often the natural fit in Australia, and I can provide independent oversight of their work. Innov8’s Application Security Business Unit, which I head, is another option and is always disclosed.
Other locations