Profile: Alissa Torres,
Certified SANS Instructor
Rebecca Waters
New readers are always asking us how to get into the digital forensics field. DFI News caught up with Alissa Torres, who worked her way from the Marine Corps to a position as a Certified SANS Instructor and
an Incident Handler at Mandiant, to see how she made her start and what she can recommend to those
wanting to follow in her footsteps.
DFI News: Tell me a little about your time in the Marine Corps, what was your position, what kind of
work did you do?
Alissa Torres: My first billet as an electronic communications junior officer was that of wire and radio
platoon commander. I was in charge of the training, readiness, and well being of twenty Marines whose
specialties involved switchboard, radio, and wired communications. Though I did learn a tremendous
amount about how to ensure reliable data communications in large-scale operations, the most valuable life
lessons involved my interactions with my platoon members. The guidance provided by my senior enlisted
Marines kept me out of trouble and allowed me the opportunity to work with technical experts who were
passionate about their work, something I have continued to enjoy today in my role as a SANS instructor.
As a platoon commander, I also focused on inspiring and motivating my younger Marines and helping
them formulate a plan for achieving what they wanted out of life beyond their time in the Marine Corps.
DFI: What made you decide to go into digital forensics?
AT: I was first introduced to digital forensics while working as a technical instructor at Defense Cyber
Investigations Training Academy (DCITA) at DC3 in Linthicum, Maryland. Most of my fellow instructors
were prior law enforcement and had experience in digital forensics cases working criminal cases. Their
war stories were enticing, the intrigue of hunting down evil in the form of digital evidence. Even in those
early days, I was drawn to network intrusion cases. There is a similar mission in protecting U.S. corporate
data from theft as there was in defending the nation as a Marine. Like most of the professionals working
in the digital forensics/incident response (DFIR) field, I believe that this work is important and it makes
a difference. Forensics is a technical field that is constantly changing—I love to learn—every day, feel a
challenge. Information security is in its infant stages even now due to rapid evolutions of threat vectors
and new technologies that expand the surface area of our enterprise networks.
DFI: What training did you undergo to become a forensic investigator?
AT: My training in forensics began at the Defense Cyber Investigations Academy at DC3. I attended some
incident response classes there that introduced me to the field and peaked my interest in digital forensics.
In my off-hours, I attended university classes to obtain my Masters degree in Information Assurance. Over
the past five years I have completed digital forensics vendor-specific training as well as numerous SANS
forensics courses. One of the SANS classes in particular that was a “game changer” for my career was the
“FOR508: Advanced Computer Forensic Analysis and Incident Response.” This class is based on a scenario modeled after real-world network intrusion with sophisticated threat activity on a company network.
This hands-on technical training provided me the operational skills I use today in my Incident Handler
role at Mandiant.
DFI: Did any of your training or experience in the Marine Corps carry over to your work in forensics?
AT: In the Marine Corps, I experienced first-hand that an individual’s success is determined by her
passion, commitment, and drive. These three things are required in bucketfuls in order to be an effective
