Mark Orlando

Mark began his career in 2001 as a SOC analyst and has spent over two decades building and leading security operations across government and enterprise environments. He previously served in roles supporting the Pentagon, the White House, the Department of Energy, and healthcare.gov, where he helped design and manage large-scale detection and response programs. His leadership experience includes serving as Chief Technology Officer at Raytheon Cyber, and Director of Cyber Operations at Foreground Security, a Managed Detection and Response startup. He also co-founded and led Bionic Cyber, where he advised CISOs on building detection and response capabilities, maturing their security programs, and enterprise risk management. These experiences are reflected in the course, where students work through real-world SOC challenges such as detection engineering, incident response, and scaling operations.

Mark holds a Bachelor of Science in Information Technology from George Mason University and is a Project Management Professional (PMP), SOC-CMM Certified Assessor, and GIAC Continuous Monitoring Certification (GMON) and GIAC Certified Detection Analyst (GCDA) certifications. Mark Orlando is also a faculty member of the SANS Technology Institute. Beyond the classroom, he has authored multiple publications on threat intelligence, automation, and security operations, and is named on a patent for automated threat detection and mitigation. His experience building and scaling detection and response capabilities informs LDR551, where students work through practical challenges in designing, operating, and improving security operations centers.

Mark’s teaching focuses on helping defenders and leaders navigate complexity in both tactical and strategic initiatives. He emphasizes foundational knowledge, practical application, and continuous development beyond the classroom. Drawing on his experience across technical, leadership, and operational roles, he helps students understand not just how to detect and respond to threats, but how to build programs that endure. Outside of work, Mark enjoys reading, going to live rock music shows, and the occasional Netflix binge.

Qualifications Summary

• Roles and Affiliations: Field CTO, Push Security; SANS Certified Instructor; previously Co-Founder & CEO, Bionic Cyber; former CTO, Raytheon Cyber; Director of Cyber Operations, Foreground Security
• Credentials: Bachelor of Science in Information Technology; Project Management Professional (PMP); SOC-CMM Certified Assessor; GIAC Continuous Monitoring Certification (GMON); GIAC Certified Detection Analyst (GCDA)
• Key Achievements: Built and led SOCs across Pentagon, White House, Department of Education (DOE), and Fortune 500; developed MDR services and automated detection capabilities
• Publications and Tools: Author of multiple articles on threat intelligence, automation, and SOC operations; named on patent for automated threat detection and mitigation
• Courses: Co-author and instructor for LDR551: Building and Leading Security Operations Centers; former instructor for SEC450: SOC Analyst Training: Applied Skills for Cyber Defense
• Community Roles: Speaker at RSA Conference, Black Hat, BSidesDC, IANS Forum, DefCon Blue Team Village