Joshua Morgan · Security Advocate | Trainer | Leader
About me
I'm Joshua Morgan — a security leader, trainer, and community volunteer with a Master's in Cybersecurity and Information Assurance. I've shared my expertise at DEF CON and BSides, teach a college Masters-level course, and stay sharp through CTFs and security certifications.
As an accomplished security authority, I've built a reputation for top-notch security solutions from high-level Security Operations Centers. I'm passionate about empowering the next generation through teaching and mentorship — as a college Masters-level instructor, I help shape the future of our industry and stay active in the security community at conferences.
What drives me is collaboration, growth, and continuous learning — whether leading a team, mentoring a colleague, or diving into analysis, my goal is always actionable insights that make a tangible difference. Let's connect and explore how we can work together to secure the future!
More about me:
Blog | Videos | CTFs | Talks | Community | Certs | Skills
Connect with me
Email: [email protected]
Book Time: Availability Schedule
Security Conference Presentations
Incident Response 101: Preparing Before the Hack, Responding After It
DEF CON · Las Vegas, NV · August 2026
When an organization gets hacked, recovery is only part of the challenge. Security teams must quickly determine what happened, contain the threat, remove the attacker, and restore operations without allowing the incident to happen again. That work falls to incident responders, the cybersecurity professionals who investigate attacks, coordinate response efforts, and help organizations recover under pressure. This beginner-friendly session introduces the role of the incident responder and explains how incident response works across the major stages of preparation, detection, containment, eradication, recovery, and post-incident improvement. Attendees will leave with a practical understanding of what incident responders do, why their work matters, and how structured response processes help organizations reduce damage and improve resilience after a cyber incident.
Incident Response 101: What Happens After the Hack?
DEF CON · Las Vegas, NV · August 2025
Ever wonder what happens behind the scenes when a company gets hacked? Restoring systems, containing the damage, and keeping attackers out for good doesn't happen by magic — it takes skilled professionals to guide the process. Enter the Incident Responder: part digital detective, part crisis manager. Their job is to figure out what went wrong, kick out the bad actors, and make sure it doesn't happen again. Join us for a beginner-friendly presentation on the essential role of Incident Responders in cybersecurity.
From RTFM to BTFM: Helping Shape New Beginnings
BSides San Diego · San Diego, CA · March 2025
In the Information Security ecosystem, stereotypes for practitioners persist, and they're not always the most flattering. If we approached these stereotypes like we do our technical work, perhaps we could do better for ourselves and others. What can we do to help dispel the stereotypes and can we use them to our advantage? For those of us who have been in the industry for years, we may be used to how things are or how 'they used to be', but we sometimes miss how what we do affects those looking in from the outside wanting to break in. I share how I was affected when I first moved into the information security world, lessons I've learned in my time within the industry, and ways to make small improvements to pave a better path for those to come after us.
Security Community Highlights
2026
August
DEF CON 34
Las Vegas, NVPacket Hacking Village
- Assisted with Packet Inspector/Packet Detective Workshops providing students with guidance and support as necessary.
Blue Team Village
- Presented talk "Incident Response 101: Preparing for the Hack, Responding After it Happens" for Project Obsidian's Blue Team 101 series of talks.
- Project Obsidian Lead
- Crafted questions for annual Capture the Flag for Project Obsidian.
2025
February
Wild West Hackin Fest — Mile High
Denver, CO- A/V Monitor Support, Classroom Setup
August
DEF CON 33
Las Vegas, NVPacket Hacking Village
- Assisted with Packet Inspector/Packet Detective Workshops providing students with guidance and support as necessary.
- Assisted Hardwired team - training guests on how to terminate RJ45/Ethernet Cables.
Blue Team Village
- Presented talk "Incident Response 101: What Happens After the Hack?" for Project Obsidian's Blue Team 101 series of talks.
- Project Obsidian Lead
- Crafted questions for annual Capture the Flag for Project Obsidian.
September
GrrCON (2025)
Grand Rapids, MI- Track Operator Supporting Talk Tracks
2024
August
DEF CON 32
Las Vegas, NVPacket Hacking Village
- Assisted with Packet Inspector/Packet Detective Workshops providing students with guidance and support as necessary.
Blue Team Village
- Project Obsidian Lead
- Crafted questions for annual Capture the Flag for Project Obsidian.
- Assisted with documentation creation for backend processes within Project Obsidian operations.
September
GrrCON (2024)
Grand Rapids, MI- Track Operator Supporting Talk Tracks
October
Wild West Hackin Fest — Deadwood
Deadwood, SD- A/V Monitor Support, Classroom Setup
2023
August
DEF CON 31
Las Vegas, NVPacket Hacking Village
- Assisted with Walk-Through Workshops providing insight and support for visitors, focusing on Honeypot Workshop using Cowrie.
Blue Team Village
- Project Obsidian
- Presented talk (n)map Explorations based on a Threat Hunt walkthrough.
- Assisted with Capture the Flag question generation.
September
GrrCON (2023)
Grand Rapids, MI- Track Operator Supporting Talk Tracks
2022
April
Wild West Hackin Fest — Way West
San Diego, CA- Moderator/Support for Resume Workshop Class
August
DEF CON 30
Las Vegas, NVPacket Hacking Village
- Assisted with Walk-Through Workshops, focusing on Network Operating System walkthrough.
Blue Team Village
- Project Obsidian
- Presented talk Go Phish! Visualizing Basic Malice based on a Threat Hunt walkthrough.
2021
August
DEF CON 29
Las Vegas, NVPacket Hacking Village
- Assisted with Walk-Through Workshops, focusing on Honeypot Walkthroughs using Cowrie.
October
ShellCon
Huntington Beach, CA- Discord chat Moderator during conference
Professional Security Certifications
CompTIA Security Analytics Professional (CSAP)
Earners of this certification are security analytics professionals that have the ability to plan and carry out security measures to protect an organization's computer networks and systems.
GIAC GSEC
A cybersecurity certification that certifies a professionals knowledge of information security beyond simple terminology and concepts and ability to perform hands-on IT system security roles
CompTIA Cybersecurity Analyst+ (CySA+)
For cyber professionals tasked with incident detection prevention and response through continuous security monitoring
CompTIA Security+
A global certification that validates the baseline skills necessary to perform core security functions and pursue an IT security career
CompTIA Linux Network Professional (CLNP)
Earners of this certification are Linux network professionals that are able to provide hands-on support and to monitor critical internal and client systems.
CompTIA Project+
For IT Pros this shows the skills they need to successfully manage small to medium-sized projects
Technical Languages & Analysis
Ariel & Kusto Query Languages
Developing advanced queries to extract actionable insights from security telemetry.
YARA Rules
Designing detection signatures to identify and categorize malicious software.
Regular Expressions (RegEx)
Utilizing pattern matching to parse and analyze complex datasets.
OSINT (Open Source Intelligence)
Applying publicly available information to support investigations and threat intelligence.
Dashboard & Query Optimization
Creating customized investigation dashboards and queries that revolutionize analyst workflows and reduce manual investigation time.
Security Tooling & Platforms
EDR & SIEM Management
Operating enterprise-grade security tools such as Crowdstrike Falcon, SentinelOne, Splunk, and IBM QRadar.
Vulnerability Management
Identifying and assessing security weaknesses using tools like Rapid7 InsightVM.
SOAR (Security Orchestration, Automation, and Response)
Implementing automated response workflows to streamline security operations and incident response.
Cloud & Email Security
Managing security posture across cloud applications and email platforms via Trend Micro and Forescout.
Phishing Analysis Automation
Developing automation rules and use cases for email analysis platforms to significantly reduce manual review time.
Leadership & Professional Development
Technical Instruction & Mentorship
Delivering specialized cybersecurity training and guiding the professional growth of team members and students.
Public Speaking & Workshop Facilitation
Presenting technical security concepts and leading hands-on workshops at industry conferences like DEF CON and BSides.
Project Charter Development
Establishing strategic frameworks and formal documentation to guide organizational security initiatives.
Tabletop Exercise Facilitation
Leading interactive tabletop exercise engagements to foster cross-functional collaboration and drive process improvements.
Cybersecurity Curriculum Design
Designing comprehensive educational courses covering information assurance, security risk management, and security operations.
Security Operations & Consulting
Incident Response Workflow Design
Crafting tailored response processes and workflows for business-specific security events to boost productivity and efficiency.
SOP Development
Creating comprehensive Standard Operating Procedure documentation to ensure seamless onboarding and operational consistency.
Capture The Flags
OSINTion CTF
2nd Place
Achieved 2nd Place, demonstrating elite skills in Open Source Intelligence.
Cyberbit ICL Cup
Top 7
Placed in the Top 7.
Hack-a-Sat
Top 20
Placed in the Top 20 — a specialized space-themed cybersecurity challenge.
Boss of the SOC
Top 20
Placed in the Top 20 of this premier Splunk-led detection and response challenge.
Boss of the SOC
Participated
Participated in this premier Splunk-led detection and response challenge.
Cyber Range
BHIS / Antisyphon Cyber Range
Top 10%
Achieved a ranking in the Top 10% across the rolling set of challenges on the BHIS (Antisyphon) Cyber Range.
Tools & Resources
SOC-Tools
A curated collection of free & open-source web tools for SOC analysts: decoding, IP/DNS/URL analysis, malware sandboxing, threat intel, phishing, OSINT, hashing, and service status.
conference-timer
A zero-dependency conference timer: build a run of talks and breaks, and one countdown advances through every segment automatically — with phase warnings, drag-and-drop scheduling, and full-screen alerts.
Check out the blog!
View all posts »Some thoughts and observations
Sep 2, 2025
Vegas and the Lucky Number 7
The Annual DEF CON trek
May 26, 2025
Six Tickets: The Ramblings of a Beaten Down SOC Analyst
My Journey in Security - and how life... finds a way
Aug 11, 2023
nMap Explorations - A Great Time - DEF CON 31 (Blue Team Village)
My Talk from DEF CON 31 in 2023
Aug 13, 2022
Go Phish! Visualizing Basic Malice - DEF CON 30 (Blue Team Village)
My Talk from DEF CON 30 in 2022
May 13, 2022
Introspection from an Introverted Information Security Instructor
Lessons from a first-time instructor.
Jul 1, 2018
What is your passion?
What is your TRUE passion?