Rebekah Brown
Certified Instructor CandidateSenior Researcher at Citizen Lab
Specialities
Digital Forensics and Incident Response

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsDigital Forensics and Incident Response

Rebekah Brown has helped develop threat intelligence programs at the highest levels of government and has had some exciting experiences along the way. She is a former National Security Agency network warfare analyst, U.S. Cyber Command training and exercise lead, and crypto-linguist and Cyber Unit Operations Chief for the U.S. Marine Corps. She's even provided a briefing at the White House. But if you ask Rebekah what she's most proud of, she'll tell you it's the success of the students and co-workers she's mentored throughout her career.
Rebekah started out in traditional military intelligence work, focused on Chinese cryptologic linguistics. She was then selected to cross-train as a network warfare analyst, which provided the opportunity to fuse her understanding of language and culture with network defense. "I loved the ability to combine different aspects of intelligence and apply it in ways that many people in the intelligence community were just beginning to understand," she says.
Rebekah has since provided threat intelligence for all types of security programs ranging from national security operations to state and local governments and Fortune 500 companies. She currently works for Apple focusing on Security Engineering and Architecture. She is also a course instructor and student mentor at SANS, where she teaches FOR578: Cyber Threat Intelligence, a course she co-authored. She is also co-author along with SANS Instructor Scott Roberts of the book Intelligence Driven Incident Response.
In her day-to-day work, Rebekah spends a lot of time focused on understanding intelligence sources, conducting multiple levels of analysis, and explaining what intelligence means and how it can be used to a variety of audiences.
"Regardless of their specific role, all three of these actions are things my students will have to do, most likely on a daily basis," says Rebekah. "Understanding intelligence and its implications and being able to convey that knowledge at different levels are skills that will help make any cyber threat intelligence analyst successful."
A highlight of Rebekah's career was providing a briefing at the White House on the future of cyber warfare and coordinated defensive and offensive cyber operations. "This coordination was something I strongly advocated during my time in DoD cyber operations with the Marine Corps," says Rebekah. "I'm happy to report that the idea has been widely adopted."
A dedicated mentor, Rebekah is most proud of the success achieved by the colleagues she supported throughout her career.
"Intelligence work requires a team with diverse backgrounds to be successful, but I found that those without a strong background in computer science often felt that they did not have the experience needed to contribute to the team," she explains. "I love helping colleagues and students understand how their previous experience ties into what they are learning, and providing them with tools and resources that they can go back and use at their jobs on day one."
Rebekah has an associate's degree in Chinese Mandarin, a bachelor's degree in international relations, and a master's degree in homeland security with a cybersecurity focus as well as a graduate certificate in intelligence analysis. She is a faculty member of the SANS Technology Institute, an NSA Center of Academic Excellence in Cyber Defense and multiple winner of the National Cyber League competition.
In her free time, Rebekah enjoys hiking, camping and snowboarding. She also plays the baritone ukulele and loves to read historical and creative nonfiction. However, Rebekah is never too far from the work she loves. Hailing from a family of engineers, she notes that a common family discussion over Thanksgiving dinner might include implementation of PLCs in wastewater treatment labs and the security needed for it!
Rebekah is excellent; injects real-life scenarios, lessons learned, and humor to support lessons.
Rebekah's real-world examples provides perspective & keeps class interesting.
Rebekah has high energy & provides valuable real life stories.
Here are upcoming opportunities to train with this expert instructor.
Explore content featuring this instructor’s insights and expertise.
This hands-on technical session focuses on how to build and deploy modern AI-backed agents inside real CTI workflows - systems that continuously ingest, reason, and take action, including automatically opening and enriching tickets tied to real exposure.

Over the past few years, the cyber threat landscape has been defined by supply chain compromises, the targeting of cloud and SaaS environments, and the growing use of AI by both defenders and adversaries.

Turn threat data into actionable intelligence. Join CTI experts to learn how to overcome common challenges, build consistent workflows, and evolve from foundational skills to real-world threat investigations and operational impact.

As the cyber threat landscape continues to evolve, the past year has presented unique challenges and opportunities for cyber threat intelligence professionals.

On this webcast, Rebekah Brown and Andreas Sfakianakis will explore 2024 CTI Survey results.

Review relevant educational resources made with contribution from this instructor.