About
Author, teacher, speaker, defender.
A cybersecurity executive focused on threat intelligence and cybercrime investigations, with 18+ years across the U.S. Army, the Department of Defense, Dell Technologies, KPMG, Equinix, and Southern Company.
Who is Sean O'Connor?
Sean started his career, like many in the Intelligence Community, in U.S. Army Military Intelligence, working across disciplines from Human Intelligence (HUMINT) to tactical Signals Intelligence (SIGINT), and later served as a Counterintelligence (CI) contractor for the Department of Defense.
After his third tour in Afghanistan, he moved to the private sector and spent six years in the Dell SecureWorks Counter Threat Unit (CTU). By applying traditional HUMINT tradecraft through sock puppet personas, he built the CTU's first virtual HUMINT (vHUMINT) team to infiltrate cybercriminal communities.
"The intelligence training and experience I obtained throughout my military career and in the DoD gave me the tools necessary to build the CTU's first ever virtual HUMINT team."
He went on to lead threat intelligence and incident response at KPMG, building the CTI program for the US, LATAM, and Israel member firms, then founded and led the Equinix Threat Analysis Center (ETAC), growing it into a global, multidisciplinary team.
Today he is the Director of the Digital Defense Center (DDC) at Southern Company, leading enterprise cyber defense across both IT and operational technology: security operations, incident response, threat intelligence, threat hunting, detection engineering, and insider threat.
Areas of focus
Author & Teacher
Sean is a SANS Certified Instructor Candidate and the lead author of FOR589: Cybercrime Investigations, which covers evidence handling, adversary profiling, infrastructure mapping, and attribution. He is also a faculty member at Georgia State University's Evidence-Based Cybersecurity (EBCS) Research Group, where he coauthored GSU's first Darknet Intelligence course for law enforcement.
"As analysts we should always be trying to keep up with the ever-evolving threat landscape, and as an instructor, I enjoy teaching these topics to anyone who has the willingness to learn."
Mentorship
Sean mentors students and, most of all, veterans transitioning out of the military and into the civilian workforce.
"I was so fortunate to have had a successful transition out of the defense sector because I was able to translate the skills that I had obtained while in the military into the needs of the private sector, and I want to help as many veterans as I can do the same thing."
Community
Sean hosts the SANS Threat Analysis Rundown (STAR), co-chairs the SANS DFIR Summit, and chairs the IT-ISAC Data Center SIG. He founded the CTI-League Darknet Intelligence team (CTIL Dark), which works alongside law enforcement to protect healthcare organizations and publishes an annual dark web threat landscape report, and received a SANS 2020 Difference Maker award.
Outside of work he enjoys travel, soccer (futbol), reading, working out, and time with family and friends.
Profile summary
18+ years in intelligence and security
Sean O'Connor is a cybersecurity executive whose experience spans Counterintelligence (CI), Human Intelligence (HUMINT), and Digital Forensics & Incident Response (DFIR) for the defense sector, to building and leading threat intelligence programs and security teams aligned with business objectives in the private sector. He is an author and teacher, holds the CISSP and multiple GIAC certifications, speaks at international conferences, and is quoted by media outlets on security research topics.
