Jeff Lomas
Certified InstructorPrincipal Network and Host Forensics and Incident Response Analyst at Mission Support and Test Services, LLC
Specialities
Open-Source Intelligence

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsOpen-Source Intelligence

Jeff Lomas turns real-world investigative experience into hands-on learning that empowers students to think, analyze, and act like cyber investigators. As a Certified Instructor for the SANS Institute, he teaches SEC497: Practical Open-Source Intelligence (OSINT), guiding students to transform open data into actionable intelligence. In his current role as Principal Network and Host Forensics and Incident Response Analyst at Mission Support and Test Services, LLC, Jeff leads digital forensics and incident-response operations supporting critical national infrastructure. Whether analyzing nation-state threats or tracing digital footprints across devices, he translates active investigative techniques into practical, repeatable skills that students can apply immediately.
Drawing on 17 years as a Detective and Digital Forensic Examiner with the Las Vegas Metropolitan Police Department, his law enforcement experience forms the backbone of his teaching. Jeff investigated cybercrime, mobile forensics, and digital evidence across multiple platforms. By integrating OSINT into traditional forensic workflows, he pioneered methods for uncovering leads, mapping networks, and validating evidence, approaches that now form the foundation of his labs and case studies. His teaching style is rooted in those real-world experiences, helping students connect technical skills with investigative intuition. Students consistently praise the course’s real-world focus and Jeff’s ability to demystify advanced techniques through relatable, law enforcement-based examples.
A lifelong learner, Jeff holds certifications that reflect his commitment to growth, including the GIAC Open Source Intelligence (GOSI), GIAC Security Essentials (GSEC), GIAC Certified Incident Handler (GCIH), and Magnet Certified Forensic Examiner (MCFE). He earned a Master of Science in Cybersecurity from Wilmington University and a Bachelor of Science in Intelligence Management from the Henley-Putnam School of Strategic Security. He is also a faculty member of the SANS Technology Institute, an NSA Center of Academic Excellence in Cyber Defense and multi-year winner of the National Cyber League competition. Beyond SANS, he serves as an Adjunct Assistant Professor at Wilmington University, where he authored SEC360: Advanced Mobile and IoT Forensics, mentoring students who aspire to careers in digital investigations.
Students often describe Jeff’s classes as the moment OSINT “clicked,” praising his empathy, humor, and ability to connect complex theory with ethical, real-world application. Known for creating a collaborative, hands-on environment, he ensures learners leave class ready to apply what they learn the very next day. Outside of work, Jeff enjoys playing guitar and ukulele, playing board games, and coaching his son’s youth baseball team. He believes curiosity and empathy, the same traits that drive great investigations, are what turn technical skill into true mastery in cybersecurity.
One of the best instructors I have ever seen. Wish he was the instructor for all my training/courses.
[Jeff] Lomas, is awesome. I love his excitement and approach to bringing us all into his world.
[Jeff] presented clear instruction with a strong knowledge base. Answered questions that were fielded in a timely, professional manner.
Here are upcoming opportunities to train with this expert instructor.
Explore content featuring this instructor’s insights and expertise.
Join us for SANS Secure Your Fortress: Building Robust and Resilient Defenses for 2025, where cutting-edge techniques meet hands-on practicality. Designed for cybersecurity professionals at all levels, this event equips you with the tools, strategies, and insights needed to overcome today’s toughest challenges and prepare for tomorrow’s emerging threats.

This presentation will equip attendees with the knowledge and tools necessary to identify AI-generated images in their investigative practices.

Join us at the forefront of cybersecurity at "SANS Secure Your Fortress: 2024's Top Defense Strategies and Trends!"

This talk delves into the pervasive integration of Artificial Intelligence (AI), specifically Language Models (LMs), within the current OSINT landscape. Jeff will discuss the art of uncovering the deployment of Large Language Models (LLMs) across social media posts, product reviews, and academic settings by examining linguistic patterns and using multiple tools to uncover TTP's used by threat actors.

Review relevant educational resources made with contribution from this instructor.