DFIR · Cyber Threat Intelligence · HUMINT
Sean O'Connor
Cybersecurity executive, SANS instructor, and cybercrime investigator. Eighteen years of turning intelligence tradecraft into better defense.
What I do
Intelligence work, from the field to the classroom
Cybercrime Investigator
Virtual HUMINT operations, engagement with ransomware ecosystems, and cryptocurrency tracing for attribution and financial investigations, built on a career that started in Army HUMINT.
Speaker & Host
Host of the SANS Threat Analysis Rundown (STAR), co-chair of the SANS DFIR Summit, invited conference speaker, and a regular source for media on cybercrime and threat research.
Author & Teacher
SANS Certified Instructor Candidate and lead author of FOR589: Cybercrime Investigations, and a faculty member at Georgia State University.
About
Who is Sean O'Connor?
Sean is the Director of the Digital Defense Center (DDC) at Southern Company, one of the largest energy providers in the U.S., where he leads enterprise cyber defense across IT and operational technology: security operations, incident response, threat intelligence, threat hunting, detection engineering, and insider threat.
He started in U.S. Army Military Intelligence and DoD counterintelligence, spent six years in the Dell SecureWorks Counter Threat Unit building its first virtual HUMINT team, led threat intelligence and incident response at KPMG, and founded and led the Equinix Threat Analysis Center (ETAC).
SANS Training
FOR589: Cybercrime Investigations
Learn the tradecraft behind modern cybercrime investigations: evidence handling, adversary profiling, infrastructure mapping, and attribution, including dark web intelligence and cryptocurrency tracing.
May 17, 2027 · In person or live online · 5 days
Start anytime · 4 months of access
Latest from SANS
Webcasts & writing
Speaking · Training · Advisory
Interested in having a chat?
Send a note or book time directly.