Michael Lamb

His experience includes leading security operations, supporting incident response, and building practical automation for SOC and DFIR teams. He has also served at HM Revenue & Customs, NATO Communications and Information Agency, Aspire Technology Solutions, Precursor Security, and Vanguard Cyber Security.

Michael holds GIAC Enterprise Incident Response (GEIR) and GIAC Security Operations Manager (GSOM) certifications, along with additional credentials in incident response, threat hunting, MITRE ATT&CK, CrowdStrike Falcon response, Cribl administration, and security operations. He is a faculty member at the SANS Technology Institute. SANS.edu is an NSA Center of Academic Excellence in Cyber Defense and multi-year winner of the National Cyber League competition.

In the classroom, Michael connects the course to the practical work of building and leading SOC teams, including staffing, process, tooling, alert triage, incident response, automation, and continuous improvement. His experience includes leading an incident toward the indictment of a large LockBit affiliate, building two SOCs to CREST standards, and building automations for SOC and DFIR teams.

Qualifications Summary

• Professional Certifications: GIAC Enterprise Incident Response (GEIR); GIAC Security Operations Manager (GSOM); CrowdStrike Certified Falcon Responder (CCFR); Level 2: Cribl Certified Admin - Stream; CMA Cyber Incident Planning & Response (CIPR); Blue Team Level 1 (BTL1); Junior Penetration Tester (eJPT); MITRE ATT&CK Fundamentals Badge
• Key Achievements: Senior SecOps Engineer at Cribl; Director of Security Operations at Precursor Security; built two SOCs to CREST standards; built automations for SOC and DFIR teams; led an incident toward the indictment of a large LockBit affiliate.
• Courses: Instructor for LDR551: Building and Leading Security Operations Centers
• Community Contributions: Speaker on AI-supported SOC triage at OWASP Newcastle and a speaker for Leeds Cyber Security Conference 2024