The GCFA journey
GIAC Certified Forensic Analyst · SANS FOR508: Advanced Incident Response, Threat Hunting & Digital Forensics. Target exam date: December 2026
508.1Advanced IR & threat huntingstudying
IR process, threat intel, credential theft, persistence
508.2Intrusion analysisstudying
Evidence of execution, event logs, lateral movement artifacts
508.3Memory forensicsstudying
Volatility, rogue processes, code injection, rootkits
508.4Timeline analysisstudying
MACB timestamps, filesystem vs. super timelines, Plaso
508.5Anti-forensics & NTFSstudying
$MFT, $UsnJrnl, $LogFile, deleted file recovery, wipers
508.6Capstone & indexstudying
Build the index, practice exams
milestones
- GCFA exam (goal)
Target: sit the GIAC Certified Forensic Analyst exam in December.
- SANS FOR508 live class
Six days of Advanced Incident Response, Threat Hunting & Digital Forensics, October 17–22.
- Launched this site
Started publishing write-ups on brendorobo.com.
- B.S. Cybersecurity & Information Assurance
Graduated from Western Governors University, earned while working full-time in the SOC.
- First CTF: HTB Holmes 2026
Team FirstEnergy TSOC placed 476th of 5,637 teams, solving 42/111 challenges for 3,925 points.
- Passed the ISC2 SSCP
Systems Security Certified Practitioner, earned as part of my WGU degree.
- A.A.S. from Stark State College
Computer Network Administration & Security Technology, completed through my IT apprenticeship.
- Cybersecurity Analyst
Moved into a full-time SOC role: incident response, digital forensics, threat hunting and detection content.
- Junior Systems & Network Administrator
Started an IT apprenticeship while working on my associate degree.