Sydney Marrone

Her career began in application development and IT at Salt River Project before progressing through security engineering roles at Nordstrom, Arrow Electronics, and Lumen Technologies. At Splunk, she became Principal Threat Hunter, leading threat hunts, overseeing purple team activities, and collaborating with the SURGe research group. Alongside her operational work, Sydney has co-developed and taught hands-on threat hunting workshops, sharing practical techniques with other defenders.

Sydney co-authored the PEAK Threat Hunting Framework and The Threat Hunter's Cookbook, helping practitioners structure their hunts and choose effective ways to analyze data. Alongside David Bianco and Ryan Fetterman, she received the 2024 SANS Difference Makers community award for Innovation of the Year for PEAK. She also created the Agentic Threat Hunting Framework, which preserves investigative knowledge so analysts and AI assistants can build on previous work. Her qualifications include a Bachelor of Science in Computer Information Systems from Arizona State University and GIAC Cloud Threat Detection (GCTD), GIAC Defending Advanced Threats (GDAT), and GIAC Network Forensic Analyst (GNFA) certifications.

As co-founder of THOR Collective, Sydney shares research and practical lessons through community projects such as HEARTH and THOR Collective Dispatch. She encourages hunters to begin with focused questions, work with the tools they have, and document what they discover so others can build on it. Her approach to AI follows the same principle: use it to support investigation while continuing to develop independent judgment. Outside of work, she enjoys lifting weights.

Qualifications Summary

• Professional experience: Head of Threat Hunting at Nebulock; former Principal Threat Hunter at Splunk, with earlier security engineering roles at Lumen Technologies, Arrow Electronics, and Nordstrom.
• SANS course authorship and teaching: Co-author of FOR668: Threat Hunting and Data Analysis with David J. Bianco; co-developed and taught hands-on threat hunting workshops.
• Frameworks and publications: Co-author of the PEAK Threat Hunting Framework and The Threat Hunter's Cookbook; creator of the Agentic Threat Hunting Framework.
• Industry recognition: Co-recipient of the 2024 SANS Difference Makers community award for Innovation of the Year for the PEAK Threat Hunting Framework.
• Education and certifications: Bachelor of Science in Computer Information Systems, Arizona State University; GIAC Cloud Threat Detection (GCTD), GIAC Defending Advanced Threats (GDAT), and GIAC Network Forensic Analyst (GNFA).
• Community contributions: Co-founder of THOR Collective and contributor to THOR Collective Dispatch and community initiatives such as HEARTH.