Michael’s 20-year career at Shell spanned across roles in instrumentation and electrical, laboratory, environmental, and process analyzers, measurement, and controls and automation, as well as the roles of site ICS security lead and global ICS cybersecurity lead across refining and chemical assets. Michael spent the last 5 years helping owners/operators as a Principal Consultant at Dragos before moving to his global Field CTO role. The broad experience, from plant support to global roles, is reflected in how he approaches teaching ICS410, where he explains core concepts through the realities of distributed control systems (DCS), supervisory control and data acquisition (SCADA), safety instrumented systems (SIS), programmable logic controllers (PLCs), workstations, and human-machine interfaces (HMIs), so students see how security fits alongside safety and uptime. Michael’s experience also informs ICS612, where he connects network design, monitoring, and secure change to what actually happens during maintenance windows, turnarounds, and recovery, giving students practical patterns they can adopt whether they work in oil and gas, manufacturing, power, water, or the public sector.
Michael holds the GIAC Security Expert (GSE) #320 and has earned more than a dozen GIAC certifications. He also holds a Master of Science in Information Security Engineering (MSISE) from the SANS Technology Institute. He contributes to the community through research, such as “Vulnerabilities on the Wire: Mitigations for Insecure ICS Device Communication” and “Gaining Endpoint Log Visibility in ICS Environments”, and by building approachable learning projects—like a PLC-powered coffee roaster—to make industrial concepts more tangible. Michael is also a faculty member of the SANS Technology Institute.
Beyond the classroom, Michael partners with asset owners worldwide on OT resilience, and his teaching style reflects his frontline perspective: meeting people where they are, translating complexity into clear steps, and never forgetting the operators who keep essential services running. Michael describes his mission simply as “helping to safeguard civilization.”
Qualifications Summary
- Field CTO, Oil & Gas, Dragos, Inc.
- SANS Certified Instructor, ICS310: ICS Cybersecurity Foundations, ICS410: ICS/SCADA Security Essentials, ICS515: ICS Visibility, Detection, and Response, and ICS612: ICS Cybersecurity In-Depth
- 25+ years of experience across instrumentation, analyzers, controls/automation, and ICS/OT security (Shell + Dragos consulting)
- Education: Master of Science, Information and Security Engineering (MSISE), SANS Technology Institute; Bachelor of Science, City University of Seattle; Associate of Applied Science, Bellingham Technical College
- GIAC Certifications: GIAC Security Expert (GSE #320), GIAC Security Professional (GSP), GIAC Experienced Cybersecurity Specialist (GX-CS), GIAC Experienced Incident Handler (GX-IH), GIAC Experienced Intrusion Analyst (GX-IA), GIAC Security Essentials (GSEC), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Penetration Tester (GPEN), GIAC Web Application Penetration Tester (GWAPT), GIAC Python Coder (GPYC), Global Industrial Cybersecurity Professional (GICSP, Gold), GIAC Critical Infrastructure Protection (GCIP), GIAC Response and Industrial Defense (GRID), GIAC Critical Controls Certification (GCCC), GIAC Certified Project Manager (GCPM), GIAC Strategic Planning, Policy, and Leadership (GSTRT), GIAC Cloud Security Essentials (GCLD), GIAC Cloud Security Architecture and Design (GCAD)
- Additional Certifications: Certified Information Systems Security Professional (CISSP), Project Management Professional (PMP)
