Don Murdoch

With more than two decades in cybersecurity, Don has led teams and built programs spanning education, healthcare, and global enterprise. He began in software development and network operations before serving as Information Systems Security Officer at Old Dominion University, where he implemented the institution’s first SIEM and internal honeynet for detection and active mitigation. He later directed strategy and planning for a Fortune 500 healthcare organization, led a managed SOC practice, and served as Director of Security and Risk for RSA Security’s NetWitness Division. Each chapter of his career reinforces his belief that defense is strongest when people, process, and technology work in harmony. Today, as Cyber Defense Principal and lead countermeasures expert at atop 10 hospital system, he drives architecture and detection programs that directly inform the course labs students experience.

Don holds the GIAC Security Expert (GSE #99) designation and multiple advanced certifications, including GIAC Python Coder (GPYC), GIAC Reverse Engineering Malware (GREM), GIAC Defending Advanced Threats (GDAT), GIAC Defensible Security Architecture (GDSA), GIAC Web Application Penetration Tester (GWAPT), GIAC Network Forensic Analyst (GNFA), and GIAC Continuous Monitoring (GMON). He earned both a Master’s Degree in Information Security Engineering and a Graduate Certificate in Cloud Security and Computer Systems Networking and Telecommunications from the SANS Technology Institute, and serves on the SANS Advisory Board. He is the author of the acclaimed Blue Team Handbook series—Incident Response Edition and SOC, SIEM, and Threat Hunting Use Cases—written to give defenders concise, field-tested guidance when clarity matters most. The practices he’s developed have influenced SOC and detection teams worldwide.

In class, Don is known for his direct style, humor, and ability to make complex architecture approachable by sharing real-world examples that amplify the course material. He encourages curiosity and hands-on experimentation, teaching defenders to analyze clearly, act decisively, and adapt faster than their adversaries. For Don, success in cybersecurity isn’t just technical—it’s the confidence to face complexity, simplify it, and teach others to do the same.

Qualifications Summary

• SANS Instructor, SEC530: Defensible Security Architecture and Engineering – Implementing Zero Trust for the Hybrid Enterprise
• Cyber Defense Principal, Fortune 10 hospital system
• Former Director, Security and Risk, NetWitness Division, RSA Security
• Author, Blue Team Handbook: Incident Response Edition and Blue Team Handbook: SOC, SIEM, and Threat Hunting Use Cases
• GIAC Security Expert (GSE) #99
• GIAC Certifications: GPYC, GREM, GDAT, GDSA, GWAPT, GNFA, GMON
• Master’s Degree, Information Security Engineering, SANS Technology Institute
• Graduate Certificate, Cloud Security and Computer Systems Networking and Telecommunications, SANS Technology Institute
• Masters in Business Administration, Old Dominion University
• Member, SANS Advisory Board
• Recipient, SANS Lethal Forensicator Coin and others