Tanya Baccam

Tanya’s career has given her a view of security from several sides. She previously served as Director of Assurance Services for a security consulting firm, Manager of Infrastructure Security for a healthcare organization, and a manager in Deloitte’s information security practice. Today, her consulting work includes IT audits, SOC 2 readiness and reporting, penetration testing, and AI and web application security assessments. That breadth helps her show students not only how controls should work, but how to determine whether they are working in practice.

Tanya holds a bachelor’s degree in MIS, Accounting, and Business Administration from Dordt University. Her credentials include Certified Public Accountant (CPA), GIAC Security Essentials (GSEC), GIAC Certified Incident Handler (GCIH), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Systems Auditor (CISA). In more than 23 years teaching with SANS, Tanya has taught over a dozen courses spanning security fundamentals, incident handling, leadership, audit, and defensive security, and has authored multiple SANS courses. She also serves as a SANS Technology Institute Faculty Research Advisor.

That depth of experience shapes Tanya’s approach to teaching. She helps students look beyond the checklist and ask better questions: Is the control working? Does the evidence support it? What needs to change? She continues to bring that practical perspective to the broader security community, speaking on topics ranging from web application and AI security to blockchain and emerging audit risks

Qualifications Summary

• Roles and Affiliations: Founder & CEO, Baccam Consulting; Senior Instructor and Faculty Research Advisor, SANS Institute
• Education: Bachelor’s degree in MIS, Accounting, and Business Administration, Dordt University
• Certifications:
• Certified Public Accountant (CPA)
• GIAC Security Essentials (GSEC)
• GIAC Certified Incident Handler (GCIH)
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified Information Systems Auditor (CISA)
• Current Course: SEC566: Implementing and Auditing CIS Controls
• Courses Taught: SEC401: Security Essentials; LDR414: SANS Training Program for CISSP Certification; SEC504: Hacker Tools, Techniques and Incident Handling; SEC440: Critical Security Controls: Planning, Implementing & Auditing (retired); AUD507: Auditing & Monitoring Networks, Perimeters and Systems (retired), and more
• Course Authorship: Author of multiple SANS courses, including AUD507: Auditing & Monitoring Networks, Perimeters and Systems (retired); SEC502: Perimeter Protection In-Depth: Firewalls, IDS/IPS, and Network Security Architecture (retired); and SEC509: Oracle Database Security(retired)
• Professional Experience: 25+ years across cybersecurity and IT audit, including IT audits, SOC 2 readiness and reporting, penetration testing, AI and web application security assessments, infrastructure security, and assurance services