Tim Medin

After watching the movie Sneakers, Tim knew the career path he wanted to pursue. "I saw the movie and wanted to break into places and hack things," he says. Infosec was the perfect fit. "I love hacking, and I can get paid to do it!"

Today, he's the founder and principal consultant at Red Siege where he manages the company and hacks things, his favorite career role so far because he gets to lead a team of smart hackers and run a business. He's also program director for the SANS Master of Science in Information Security Engineering (MSISE) curriculum and creator of Kerberoasting, the widely-used technique to extract kerberos tickets. An experienced international speaker and huge presence in the classroom, Tim's charismatic presentation style is exhilarating.

More About Tim


Tim began his security career in 2008 with a role at AgStar Financial Services (now Compeer Financial), and since then has worked for FishNet Security (now Optiv) and Counter Hack, before founding Red Siege. A SANS instructor since 2012, Tim is currently the program director for the SANS Master of Science in Information Security Engineering (MSISE) curriculum, as well as a principal instructor and course author. In the classroom, you'll find him teaching SEC560: Network Penetration Testing and Ethical Hacking, of which he is also lead author, and SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking.

Through the course of his career, Tim's had the opportunity to hack some of the best and biggest companies on earth and get a sneak peek inside cutting-edge technology before it's publicly released. He has performed penetration tests on a wide range of organizations and technologies in industries including control systems, higher education, financial services, and manufacturing, and brings years of practical experience and stories from himself and his team to his SANS students.

Tim says an eagerness to learn, and an openness to see things differently are keys for success in his classroom. "I really enjoy seeing students break through their current way of thinking and see technology and data differently," he says.

And those lessons can have a lasting impact. "Years ago I had a high school student in a one-day class who came up to me years later and showed me he was doing penetration testing at a major company," says Tim. "It was amazing to see him develop himself and see his transformation."

Tim is an experienced international speaker and the creator of Kerberoasting, a widely-used technique to extract kerberos tickets in order to offline attack the password of enterprise service accounts. He has an MBA from the University of Texas, holds the GWAPT, GPEN, GMOB, GCED, and GCIH certifications, and previously held the CCNA certification.

In his free time, you'll find Tim watching sports, appreciating a good beer, and running.



Dirty Defense, Done Dirt Cheap: Make your life easier by making mine harder

Hacking Common AD Misconfigurations

Kerberos & Attacks 101

Hacking without Domain Admin

Offensive WMI

Assumption of a breach: How a new notion can help protect your enterprise

Enterprise Discovery: I Still Haven’t Found What I’m Looking For

Head Hacking


Assumed Breach: The Better Pen Test

Kerberos and Attacks 101

KringleCon - Hacking Dumberly Not Harderer

Hacking Dumberly Redux - More Dumberer

Successful Hacking with Domain Admin


Recon Methods Part 1 - OSINT Host Discovery

Recon Methods Part 2 – OSINT Host Discovery Continued

User Enumeration Part 2 – Microsoft Office 365

You can read Tim's blog posts here.


Daily Cyber #212 - Understanding Penetration Testing

Assumed Breach: The Better Pen Test

Paul's Security Weekly #535 - Breaking Kerberos with Active Directory

Tim's Contributions