Randy has been involved in computing since the 1970s and joined SANS in 1992, making him the longest-running SANS instructor. His path includes work as an IBM systems programmer, data acquisition software developer, VAX and Unix administrator, IT auditor, consultant, and university security leader. At Virginia Tech, he has helped shape security architecture, policy, standards, and guidance for protecting university systems and sensitive data. He draws on that experience while teaching the course, helping students connect CIS Controls implementation, audit methods, security benchmarks, risk measurement, and real-world failure analysis to the work of building security programs that can be tested, improved, and explained.
Randy holds a BSCS/MSEE in computer security from Virginia Tech. Randy Marchany is also a faculty member of the SANS Technology Institute, which has been designated an NSA Center of Academic Excellence in Cyber Defense and is a multi-year winner of the National Cyber League competition. He co-authored the original SANS Top 10 Internet Threats, the SANS Top 20 Internet Threats, the SANS Consensus Roadmap for Defeating DDoS Attacks, and SANS Incident Response: Step-by-Step guides. He was also part of the original Center for Internet Security benchmark development work and later contributed to CIS Controls version 8. As a frequent speaker at national and international conferences including EDUCAUSE, SANS, SANS Summits, IEEE, NIST, ISACA, BSides and RSA, Marchany shared Virginia Tech’s pioneering approaches to cybersecurity. The university was among the first to offer practical cybersecurity courses starting in 1998, and under Marchany’s leadership, has remained at the forefront of cybersecurity education and research.
Randy teaches by challenging students to think, fail safely, and connect “book” knowledge to actual defensive work. He does not just explain controls; he pushes students to understand why the control matters, what evidence proves it is working, and where assumptions break. His broader community work includes the US Cyber Challenge, Virginia Cyber Range, VASCAN, EDUCAUSE, and REN-ISAC. Away from security, Randy is a hammer dulcimer master, wrote the original theme song for NPR’s World Cafe, played for decades with the band No Strings Attached, NAIRD INDIE (Independent music version of the Grammy) winner, coached college volleyball, rides bicycles and motorcycles, and reads history whenever a museum is not available.
Qualifications Summary
- Education: BSCS/MSEE in computer security, Virginia Tech
- GIAC Certifications: GIAC Critical Controls Certification (GCCC) and GIAC Defensible Security Architect Certification (GDSA)
- Key Achievements: Chief Information Security Officer at Virginia Tech; Director of the Virginia Tech IT Security Lab; SANS Senior Instructor since 1992; co-holder of three cybersecurity patents; member of the team that wrote CIS Controls version 8; co-author of the original CIS benchmarks, part of the team that created the Secure Coding exams that justified creation of the SANS Secure Coding courses, built and influenced cybersecurity education and security operations across higher education.
- Awards: 2026 Virginia Tech Computer Science Academy of Distinguished Alumni, 2021 SANS Difference Maker Award, the 2016 VASCAN Founders Award, 2017 Virginia Governor’s Technology Award, 2024 Capital ORBIE CISO Public Sector finalist, 2024 and 2025 OnCon Top 10 CISO award, 2025 CISO Connect Top 10 CISO Award and the 2000 SANS Institute’s Security Technology Leadership Award
- Courses: Instructor for SEC566: Implementing and Auditing CIS Controls; also, has taught SEC401, SEC434 and SEC440
- Publications and Research: Co-author of the original SANS Top 10 Internet Threats, SANS Top 20 Internet Threats, SANS Consensus Roadmap for Defeating DDoS Attacks, and SANS Incident Response: Step-by-Step guides; more than 45 cybersecurity papers and lists patents on moving target secure communications, IPv6 address obfuscation, and attack detection through power-consumption monitoring.
- Community Contributions: Founding member of the US Cyber Challenge; founder of VASCAN; founding member of the Virginia Cyber Range; former REN-ISAC board member; former EDUCAUSE Higher Education Information Security Council member; VigiTrust Global Advisory Board member; CyberEdBoard Executive Board member, original member of the SANS Dshield project which morphed into the Internet Storm Center
