Jack Reason, principal security architect
Principal security architect at 4IR Pty Ltd, the independent architecture and security advisory practice he founded in 2022. Based in Sydney, working with organisations across Australia.
Background
Jack Reason is a security architect with 15+ years in banking, government, telecommunications and health. He leads every 4IR engagement, working where security, AI, cloud, data and regulation meet to turn technology risk into decisions leaders can act on.
Since 2022, 4IR engagements have covered security architecture, design governance and sign-off, and security operations, incident response and vulnerability management alongside them, including assessing AI coding agents in the developer toolchain, control assessments of CI/CD and Kubernetes platforms, and a secure-by-design engagement model for a state government agency.
Before founding 4IR, Jack worked as a security and cloud architect in banking, retail, telecommunications, health, energy and higher education, including assuring a bank-wide AI program that handled a highly sensitive, organisation-wide dataset.
The work draws on established architecture frameworks such as SABSA and TOGAF, and on the rules clients answer to: APRA CPS 234 and CPS 230, the ACSC ISM, IRAP and ISO 27001. Jack holds a BSc (Hons) in Computer Engineering.
4IR holds professional indemnity and public liability insurance. Certificates of currency are available on request.
4IR engagements, 2022 onward
Representative engagements, by sector. Organisations are not named. For more detail, see the case notes.
-
Banking and financial services
Security architecture, assurance and security operations
- Led security operations, incident response and vulnerability management alongside security architecture and assurance, including control assessment of the CI/CD and software supply chain.
- Delta security assessment of extending an AI coding agent from the editor to command-line and unattended CI use.
- Design governance, threat modelling and compliance sign-off from ideation to delivery under a bank’s secure-by-design framework, validating designs against its security standards and presenting to its security governance forums.
- Signed off multi-cloud secrets management (AWS, Azure, GCP) and privileged access management; assessed hosted Git, pipelines and cloud-hosted runners; approved every infrastructure-as-code change to the landing-zone architecture.
- Security posture review of a business-to-business collaboration platform.
-
State government agency
Security architecture and secure-by-design advisory
- Wrote a single secure-by-design advisory process, replacing ad hoc engagement with delivery teams.
- Ran an IRAP readiness pre-assessment of the primary Azure hosting environment and set ISM-aligned requirements for a key modernisation initiative.
- Security governance on the identity and access management program (Microsoft Entra ID Governance and ITSM integration).
-
National telecommunications provider
Security advisory
- Control assessment of a Kubernetes microservices architecture; security advisory for digital product teams, including third-party SDK integration in an authenticated mobile app.
-
Global medical device company
Information security architecture
- Led security for a cloud contact centre on AWS, a customer identity (CIAM) uplift and DevOps platform assurance.
- Controls defined against HIPAA, ISO 27001 and NIST, and governed through the architecture review board.
Prior experience, before 4IR
Jack’s work as a security and cloud architect before founding 4IR in 2022.
-
Australian banking
Security architecture
- Assured a bank-wide AI program analysing organisation-wide collaboration data: privacy and data-flow review, access controls and security sign-off.
- Secure-by-design assurance and sign-off for institutional banking and legal functions, including real-time regulatory reporting and data pipelines with external parties.
- Led a post-incident review of a third-party security event, reporting root causes and remediation.
-
National retailer
Cloud security
- Delivered a cloud security capability uplift roadmap during a period of accelerated cloud transformation.
- Azure PaaS security patterns (AKS, Azure Policy, Microsoft Sentinel, Key Vault) and governance for the enterprise data platform.
-
National telecommunications provider
Cloud architecture
- Architecture for six programs, including a data marketplace and privacy-safe IoT telemetry, across 20+ system integrations.
-
Health, energy and higher education
Cloud and solution architecture
- Multi-cloud enablement architecture and IaaS roadmaps for a state health department, a cloud migration for an energy retailer’s digital services, and an AWS adoption roadmap for a major university.