John Hubbard
Senior InstructorConsultant at Security Operations Center (SOC)
Specialities
Cyber Defense, Cybersecurity Leadership

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsCyber Defense, Cybersecurity Leadership

Few instructors combine real-world security operations center (SOC) leadership, curriculum design, and frontline defense experience like John Hubbard. As a Senior Instructor at the SANS Institute, author of SANS SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations, and co-author of SANS LDR551: Building and Leading Security Operations Centers, John translates years of frontline SOC leadership into practical lessons students can immediately apply. His courses give participants more than technical knowledge—they build the skills and judgment that ensure professionals thrive in modern security operations.
John’s path into cyber defense was fueled by a fascination with how complex systems can fail, and with how defenders can out-think attackers. After earning a Bachelor of Science in Electrical Engineering from Purdue University and a Master of Engineering in Computer Engineering with a specialization in Information Assurance and Network Security from SUNY Binghamton, he joined the SOC of a global pharmaceutical company. Rising from analyst to U.S. SOC Manager, John helped scale global operations, lead threat hunts, tune detections, and coordinate incident responses across a vast enterprise. These real-world challenges shape the labs in his courses, where students practice the same workflows, detection engineering, and threat hunting techniques he used on the job.
John holds multiple advanced GIAC certifications spanning SOC operations, continuous monitoring, cloud threat detection, penetration testing, and malware analysis. He is also a faculty member of the SANS Technology Institute, which has been designated an NSA Center of Academic Excellence in Cyber Defense and is a multi-year winner of the National Cyber League competition. Beyond credentials, he is author of SEC450 and LDR551 and extends his impact through the Blueprint podcast, his blog, public speaking, and defensive research, fostering a global community around SOC leadership and detection engineering.
In the classroom, John is known for his clarity, energy, and hands-on teaching style. He builds environments that mimic real SOC conditions, enriching them with lessons from actual investigations. Students often praise his ability to make difficult concepts simple and engaging, while keeping labs practical and relevant — learners leave class empowered to apply SOC workflows, detection engineering, and hunting skills immediately. Away from cyber defense, he recharges by playing piano and guitar as well as exploring electronic music production and DJing, and he enjoys photography and the craft of roasting coffee. To balance these creative outlets, he stays active with CrossFit, running, and hiking. These pursuits reflect the same spirit of exploration he brings to teaching, inspiring students to approach cyber defense with creativity, persistence, and passion.
Your enthusiasm for the content is energetic.
John Hubbard is extremely knowledgeable and has good insight into problems that people run into. I especially appreciate the practical examples he offers from his career.
I enjoy John Hubbard's teaching style. He keeps things moving briskly, but gives enough information and even has time for questions. He does a great job of staying on time, as well.
Here are upcoming opportunities to train with this expert instructor.
Explore content featuring this instructor’s insights and expertise.
Join us for SANS Secure Your Fortress: Building Robust and Resilient Defenses for 2025, where cutting-edge techniques meet hands-on practicality. Designed for cybersecurity professionals at all levels, this event equips you with the tools, strategies, and insights needed to overcome today’s toughest challenges and prepare for tomorrow’s emerging threats.

Join us at the forefront of cybersecurity at "SANS Secure Your Fortress: 2024's Top Defense Strategies and Trends!"

As the digital landscape continues to evolve, so do the threats that put organizations at risk. With 2025 on the horizon, the urgency to anticipate and prepare for emerging cybersecurity challenges has never been greater. This webcast is designed specifically for cybersecurity practitioners who are looking to future-proof their skills and defenses to combat these challenges.

Step into a world where cutting-edge defense meets practicality in cybersecurity! "SANS Secure Your Fortress" will teach you how to master the latest and most effective defense techniques. Whether you're a seasoned expert or just beginning your cyber journey, this event is for you.

Ahoy matey! Are ye setting off to sail the cyber seas but unsure of yer treasure map or the seaworthiness of yer vessel? Are ye strugglin' to muster a hearty crew? In need of counsel from a seasoned sea dog, are ye? Aye, if that be yer quest, this dead man’s tale's for you! We'll be shorin' up yer venture by recruiting a fearless SOC crew, readying yer ship and tools, and charting a course through the treacherous online seas towards the island of SOC riches. So join John Hubbard, multiple GIAC certified holder, to hoist the mainsail, sharpen your cutlass, and prepare for battle!Yo, Ho, Yo, Ho! A Pirate’s Life For Me (and You)!

Running a SOC is a complex combination of data sources, processes, and teamwork, and it's easy to get lost in the details. In this keynote we'll step back to think big picture about what a SOC truly needs to deliver and present some simple mental models that cyber security analysts and managers can use to abstract away complexity and gain clarity on their true priorities. We'll discuss SOC goals, workflow, how to gather those important but "hard to measure" metrics and use a top-down approach to help focus you on your path to cyber defense success.
