Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsDigital Forensics and Incident Response, Open-Source Intelligence
Sean O'Connor is a cybersecurity executive specializing in threat intelligence and cybercrime investigations, a SANS instructor, and the lead author of FOR589: Cybercrime Investigations. He serves as Director of the Digital Defense Center at Southern Company, where he leads enterprise cyber defense for one of the largest energy providers in the United States. With more than 18 years of experience spanning the U.S. Army, the Department of Defense, Dell Technologies, KPMG, and Equinix, he focuses on applying intelligence tradecraft to investigate and counter modern cyber threats. He also hosts the SANS Threat Analysis Rundown (STAR), where he translates adversary activity into practical insights.
At Southern Company, Sean directs the Digital Defense Center (DDC), leading the teams responsible for security operations, incident response, threat intelligence, threat hunting, detection engineering, and insider threat. The mission spans both enterprise IT and the operational technology environments supporting safe and reliable electric and gas service for millions of customers.
Before joining Southern Company, Sean led the Equinix Threat Analysis Center (ETAC), developing it into a global, multidisciplinary team integrating threat intelligence, incident response, threat hunting, and data analytics. This strengthened investigative depth and operational resilience across a digital infrastructure enterprise operating data centers worldwide. His work centers on improving how organizations detect, investigate, and respond to adversary activity. Prior to that, he served as the head of Threat Intelligence and Incident Response at KPMG, and spent six years as a security consultant in the Dell Technologies Counter Threat Unit (CTU).
A defining element of Sean’s expertise is cybercrime investigations and adversary engagement. He has built and led virtual HUMINT (vHUMINT) operations, engaged with ransomware ecosystems, and conducted cryptocurrency tracing to support attribution and financial investigations. With a background in the U.S. military and the Intelligence Community, he brings a real-world investigative mindset that helps practitioners understand not just how adversaries operate, but how to track, attribute, and disrupt them.
In FOR589, Sean translates this experience into hands-on training focused on evidence handling, adversary profiling, infrastructure mapping, and attribution, equipping students with practical skills they can immediately apply in real-world investigations.
He holds multiple GIAC certifications and the Certified Information Systems Security Professional (CISSP). Sean earned an MBA from Georgia Southern University, a degree in Business Information Systems from the University of Arizona, and an Executive CISO Certificate from Carnegie Mellon University. Known for a practical and engaging teaching style, he is passionate about helping practitioners build real-world investigative skills and advance their careers in cybersecurity.
Here are upcoming opportunities to train with this expert instructor.
Explore content featuring this instructor’s insights and expertise.
Review relevant educational resources made with contribution from this instructor.
