Isaac Ojeh

How did you get interested in cybersecurity?

I started young. I was 12 years old when I first became fascinated by tv shows and movies like 24, CSI, and The Matrix, and by how computers could either help solve investigations or be used to hurt people, and I decided very early that I wanted to be on the side that fights cybercrime and helps investigators do their work.

That interest became personal when my dad was a victim of cybercrime and the investigation that followed proved ineffective. My question then was why computers couldn’t solve the crime, punish the culprits or recover the loss, just like in the movies. As I began researching, I found out that computers can actually solve crimes, and you can actually study this field for a career. I immediately dropped an interest in studying medicine to chase after my DFIR passion in cybersecurity and it never wore off. It carried me through undergrad in France, through a national CERT experience in Estonia, a master’s from the USA, and eventually into senior blue team and incident response roles with more than a decade of experience.

What is your current position? What does that entail?

I am a transformational cybersecurity leader at a Canadian fintech. My work spans the entire cybersecurity program, from architecting the enterprise security roadmap and authoring the policy framework mapped to CSA CCM, NIST CSF, NIST 800-53, CIS Controls, SOC 2 and PCI DSS, to leading the security operations, DFIR investigations, running tabletop exercises, and executive briefings. I have taught cybersecurity as an adjunct instructor at Conestoga and Fanshawe Colleges and with TCM Security (Educate360). And I make time to volunteer and mentor through various international platforms, to help peers thrive in the cyber field.

What do you like most about cybersecurity?

The investigation. The moment when a set of unrelated signals suddenly resolves into a coherent picture of what happened, who did it, and how to keep it from happening again is the part of the work I have loved since I was a young Sherlock Holmes at 12. Working on the defensive side of cybersecurity side means you are always working on behalf of someone else, whether that is a hospital, a bank, a school, or a person who does not yet know they are being targeted. That responsibility keeps the work honest and keeps me learning. My slogan is “you snooze, you lose,” because in this field the day you stop growing is the day you become the vulnerability.

What was your educational background prior to enrolling in SANS.edu?

I hold a B.Sc. in Telecommunications, Wireless Networks and Security from Université Grenoble Alpes in France (2013, top three of my cohort). I was accepted to Tallinn University of Technology’s M.Sc. Cybersecurity program in Estonia on an Estonian Ministry of Foreign Affairs scholarship, which I transitioned out of when I moved to Canada. Before my SANS program, I had no GIAC certifications but a bunch of EC-Council, Microsoft, CompTIA, Oracle and Cisco certifications. I started my SANS master’s program in August 2023 while completing an M.S. in Cybersecurity and Information Assurance from Western Governors University (2023). More recently I completed an Executive MBA at the Valar Institute at Quantic School of Business and Technology (January 2026). Alongside the degrees I have picked up more than 35 industry certifications to date, including eight GIAC certifications (the SANS master’s degree program includes nine).

Why did you choose to enroll in the SANS Technology Institute?

SANS kept surfacing as the place to go for the most rigorous cybersecurity education available. I aim for the best in whatever I am pursuing, and I make sure I am ready to move the moment the opportunity is within reach. I had been able to fund every other program I set my sights on, but funding the SANS Technology Institute master’s program took more planning. I waited for the right moment and enrolled the day it became possible. It was worth every penny and month of preparation.

What do you think was most valuable about your SANS.edu program?

The way you can take what you learn and put it straight to work. Every topic I have covered has been something I can implement at my desk the following Monday morning, and that has been the difference for me between training that expires and training that compounds. In SEC530 in particular, every module was a gem, and I am still using what I learned there on a daily basis to “think Red and act Blue.” LDR514 is the course that landed me the leadership position I hold today. That kind of return is rare in any program, let alone a graduate degree program in a rapidly evolving field. That practical focus is central to the SANS.edu experience. It reflects the philosophy Alan Paller instilled throughout SANS: “Learn Today, Use Tomorrow.”

Can you tell me about the FOR585 Lethal Forensicator coin coming on the heels of FOR500?

I received the Lethal Forensicator coin for FOR500 Windows Forensic Analysis in February 2026 and then for FOR585 Smartphone and Mobile Forensics in May 2026. Holding the designation across two separate forensic disciplines is rare, and it maps directly to the reality of modern DFIR work where an investigation almost never stays on one type of device. DFIR and blue team security align with the path I chose when I was 12, and I’ve stuck to it to date. The awards showed that I knew what I wanted in cybersecurity, where my passion lies, and my chosen path to success in the field. If I can move confidently across the laptop and the phone, I can help my organization and my students see the whole picture instead of only half of it.

Tell me about the SEC530 Red Coin tied to your MICCMAC research and about your Zero Trust line of research overall?

The Red Coin is a community contribution coin awarded by Ismael Valenzuela for the SEC530 Defensible Security Architecture and Engineering course. To earn it you have to take the course and then take what you learned back to the community. My contribution was a peer-reviewed paper titled Getting Devices Ready for Zero Trust Architecture by Complying with Richard Bejtlich’s MICCMAC Framework, which I presented at the 24th European Conference on Cyber Warfare and Security (ECCWS 2025). Ismael happened to be flying into Toronto for another engagement, and I offered to pick him up from the airport so I could receive the coin from him in person. Not many Sentinels have 5 SANS coins, and even fewer receive a Red Coin in person, so it meant a great deal to me.

My Zero Trust line of research has continued from there. I co-authored Zero Trust Architecture for UAV/Rail Logistics Ecosystem and Cyber-Physical Incident Attribution in UAV/Rail Attacks at ICCWS 2026, and I have a chapter accepted for the forthcoming book Education in the AI Age from Academic Conferences International. I have also released an open-source reference implementation of the MICCMAC framework at my GitHub repository, so the toolkit is actually usable by defenders and not only readable as a paper.

Can you tell me about your experience working with your advisor?

Terrie Fox has been my Student Advisor since day one and she has been outstanding. She has handled everything from routing my course registrations and updating my academic plan, to pushing course extensions through when my professional workload spiked, to personally chasing down the FOR500 coin when the shipment ran into a delivery issue. What I appreciate most is that she looks at the whole picture, including my plans outside the program (research, teaching, community work, and other personal plans), and helps me stay on pace across all of it.

How has your SANS.edu degree impacted your career trajectory?

One of the clearest impacts was the security operations leadership role at PayFacto. The company needed someone to help rebuild the security program and fill gaps left by the departure of the security director. I went into that conversation with a case study from LDR514 that matched the situation almost perfectly, and I was able to explain exactly how I would approach it. That experience helped me earn the role using concepts I had learned in the course.

Beyond that position, the SANS Technology Institute has expanded my range as a practitioner. The Red Coin, two Lethal Forensicator coins, research publications, opportunities to teach at colleges and instruct with TCM Security, my seat on a GIAC advisory board, and my leadership with BSides Burlington all trace back to the confidence and depth the program has helped me build.

What advice would you offer someone considering applying to the SANS Technology Institute?

Forget the cost (this might be your number one concern). Plan the program now and get yourself into position so that when the funds line up, you can move immediately. If I were told to pay double what I paid, I would still enroll, and even at the current price the SANS.edu master’s program saves you close to 50% of what 9 standalone SANS courses with their respective on-demand access and GIAC exams would cost. The value shows up on the job the very next week. Do not let sticker shock be the reason you never apply. Also, SANS programs are broken into specialties, just as cybersecurity has different specializations. So beforehand, knowing the specialty where your passion lies can be a key to success.

What’s next for Isaac Ojeh?

Finishing the M.S. in Information Security Engineering at the SANS Technology Institute by the end of 2026. My research project Beyond Readiness: A Pluggable Maturity-Model MICCMAC Security Scorecard with Automated Risk Register Generation for Zero Trust Devices focuses on building an open-source Zero Trust security scorecard that evaluates device configurations, assigns maturity levels, and identifies control gaps for a risk register.

I’m also continuing research on AI-assisted DFIR, MCP/LLMs for cyber resilience, and secure AI adoption, while launching BSides Burlington, mentoring, volunteering, and publishing a chapter in Education in the AI Age.

Cybersecurity is a moving field. As I said, you snooze, you lose.

See More Success Stories >