Kevin Tyers

Kevin has more than 20 years of experience across government, telecom, healthcare, finance, and technology. Before SoFi, he previously served in security and engineering roles at GitHub, PayPal, Dignity Health, Level 3 Communications, and ST Connect. Kevin has deep experience building threat intelligence systems, developing security automation, hiring and training SOC teams, improving SIEM visibility, and supporting incident response in large, regulated environments. He draws on that experience while teaching the labs, helping students connect topics such as identity controls, cloud logging, Infrastructure as Code analysis, Cloud Custodian, incident response playbooks, Nmap, Masscan, Sigma rules, Hashcat, Metasploit, and AI-assisted analysis to the decisions they face at work.

Kevin holds nine GIAC certifications, along with credentials from CompTIA, Cisco, Juniper Networks, Qualys, Rapid7, Fortinet, and MobileIron. He is also a faculty member of the SANS Technology Institute. SANS.edu is an NSA Center of Academic Excellence in Cyber Defense and multi-year winner of the National Cyber League competition. Beyond teaching, Kevin builds and shares tools including QuantumDuck, Syngsong, and obscureV4, and contributes to the security community as a co-founder of DC480 in Phoenix, Arizona.

Kevin teaches with the patience and clarity students need when material gets technical fast. Students often comment on Kevin's ability to provide relatable examples, create a positive learning environment, and show visible enthusiasm for the material. Students leave his class with the core skills to evaluate cloud and on-premises exposure, respond to incidents, analyze attacker behavior, apply defensive controls, and communicate what matters to technical and nontechnical teams. Outside of work, Kevin is a dedicated family man who enjoys collecting luxury watches, reading fantasy fiction, and miniature painting.

Qualifications Summary

• Bachelor of Science in Network Communications Management, DeVry University
• GIAC Certifications: GIAC Experienced Incident Handler (GX-IH); GIAC Security Leadership Certification (GSLC); GIAC Cloud Security Essentials (GCLD); GIAC Certified Windows Security Administrator (GCWN); GIAC Certified Penetration Tester (GPEN); GIAC Certified Incident Handler (GCIH); GIAC Certified UNIX Security Administrator (GCUX); GIAC Certified Intrusion Analyst (GCIA); GIAC Network Forensic Analyst (GNFA); GIAC Web Application Penetration Tester (GWAPT)
• Additional Credentials: Security+, CCNA, JNCIA, Fortinet FCNSP, QualysGuard Vulnerability Management Certification, Nexpose Certified Administrator, MobileIron Certified Administrator, and CompTIA CSA+
• Key Achievements: Director of Cyber Threat Intelligence at SoFi, with prior leadership experience at GitHub across security baselines, telemetry, and infrastructure governance for 100,000+ cloud resources across Azure, AWS, and GCP. Previously built and led cyber intelligence engineering at PayPal, helped author six security patents, and established 24/7 SOC monitoring for 400+ healthcare facilities at Dignity Health.
• Courses: Instructor for SEC502: Cloud Security Tactical Defense and SEC504: Hacker Tools, Techniques, and Incident Handling.
• Community Contributions: Co-founder of DC480 in Phoenix, Arizona; speaker at BSidesLV, CactusCon, SANS Hackfest, and GopherCon Europe; active open-source contributor through GitHub