LSU Builds Student-Powered Cybersecurity SOC | Cisco Live 2026

Hey everyone. Welcome back here to Techstrong TV at Cisco Live. I almost said CISO Live.

I've got security on my brain. But no, we're at Cisco Live. We're in Vegas.

My next guest is Craig Wooley. Craig is the CIO of the LSU, well, it's Louisiana State University, is LSU. I almost said LSU University.

Of course, the Tigers. Craig, welcome to Techstrong TV. Thank you for having me.

So, how does one wind up as the CIO of LSU? How did you get here? So, I've been in higher ed IT for 37 years.

That's all I have done- Good for you ... my adult life. I've been at only three institutions, University of South Florida in Tampa- Oh, really?

For most- My nephew just graduated there. I graduated from there. And- Great school.

Great medical school ... never left, stayed there in IT. Moved up to Assistant Vice President.

Decided I wanted to try my hand at being a CIO, so I got a job at Wright State University in Dayton, Ohio. Sure. Was there- Good for you ...

for about five years when LSU approached me about the opening there. And it was too good of an environment and so exciting, that I couldn't refuse it. And, so there I was at LSU, and I've been there about six years.

Really? That's fantastic. Look, LSU, and I'm saying this as a dad of Gators, it's a great university, right?

They've got- Yes, it is ... amazing research that goes on there, and athletics to the side for a second. Amazing research, does great work in the state, and actually it's a national, international footprint, right?

But running a university's IT, a university of that size and stature, their IT is a challenge. Yep. Right?

We were talking about this. I remember 20 years ago going to Penn State University and talking to them about intrusion detection, and they said, "Oh, no. You don't understand our mission.

We're an educational institution. " The world's changed since then. That does not work now.

You don't want that open anymore. No, that's right. But you still have that EDU mission, and you got to balance that with compliance and what's good for your students, what's good for your faculty, what's good for the university.

Give people a little insight, Craig, how do you balance those? I think what's helped me is I've been in higher ed my whole adult career, so I know how to work with faculty, and I've worked with faculty for a long time. Understand their mission, understand my role as trying to help them be productive, increase our research, increase our educational opportunities for our students, and also supporting the administration.

So higher ed is a lot about collaboration, and it is about building trust, and it's about getting people to buy into your... " No. You can, you just won't last very long at higher ed.

So it's about getting people to buy in to your vision of what you're trying to do, which is a big topic that we've had at LSU for the last five years. When I got there, I asked my CISO what he felt like we needed to do to improve our cybersecurity posture. Right?

And I felt like we had a pretty good cybersecurity setup, but he told me we really need a SIEM to monitor all of our logs. We didn't have one at the time. And so he said he really thought Splunk was the best fit for us, but he said, "If you want to do a SIEM, you really need to be monitoring that 24 by 7," and that's very, very expensive.

So I didn't have the budget at the time, even though LSU, you would think we had a big budget. We didn't have a huge budget. That all goes to sports and other things.

Spoken like a real CIO. Yeah. I bet you the athletic director would say differently.

Oh, definitely. But yes, they're separate budgets. Uh-huh.

But still, we didn't have a lot of money. So, I put that on pause for a while. We got a new president not much longer after that, and he announced to the world he wanted LSU to be the best cybersecurity education school in the country.

So that's where, again, as a CIO, I say, "Okay, this is my president, where he's trying to get to. " And that's where I started putting together, okay, we want a SOC, but they're expensive, and president wants to have that great cybersecurity education. So we want to do workforce development for our students.

And so I decided, okay, we're going to do a student-run SOC, which many schools cross country run, have a student-run SOC. I was going to do it a little bit differently. I was going to call in a partner, to help us build the SOC, train the students, get the program up and running.

I would keep them for a year to get us going, and then we would let them go, and we would just do a normal student SOC. Splunk brought us one MDR partner, and we flew them down. We talked to them for a while, and they just at the end of the day said, "We don't want to deal with students.

" But we are a school, though. That's hard. Well, and that's where I said that you're missing the point.

Yeah. The students have to be involved because I want the workforce development aspect of this. So then we brought in a second partner called Techstream.

Mm-hmm. " They loved the idea. And so as we were talking with them, that's where I changed my mind, and this is where we went a different path than most schools.

We actually created a public-private partnership with Techstream. That's great. And the beauty of this model is we have a full 24 by 7 MDR contract with Techstream, but our students- Love it ...

work in a local SOCMy students just work 8:00 to 5:00, Monday through Friday. That was my choice. While they're working, they're working side by side with Techstream, who's in Atlanta, Georgia, and Techstream is helping if students have to escalate an incident or something, Techstream is there to help.

And the beauty of that model, one, my students don't have to work 24 hours a day, seven days a week, and holidays, and all of that. And, also it gives the students that great real-world experience. And my contract with Techstream, they reduce my fees- By how much?

because of the work that the students are doing. " We built this model to scale from day one as more of a franchise model. So there are now three higher ed institutions in the state of Louisiana that have their own students in their SOC, all trained the same way.

We built it as a process, all reporting up through the Techstream umbrella. Then the state loved the workforce development aspect of this, which was the key, so they funded us. Oh my God.

Seven and a half million dollars a year in recurring dollars. So now 38 institutions across Louisiana are having their incidents monitored by either my SOC at LSU or the two individual SOCs at LA Tech and Shreveport. So their students are getting that great real-world experience.

That has worked so wonderfully. And again- What a great story ... everything we're talking about just started three years ago, and this is where public-private partnerships can help.

We moved very fast, very quickly. So our SOC at LSU is the largest joint SOC for higher ed in the country. We figured, why stop there?

Let's make this a national opportunity. So now NJIT in New Jersey has a SOC. Same program.

Oh, interesting. Same training, all of that. University of Alabama, boo, but yes, they're in the program.

Roll Tide. Auburn University, the McCreery Institute. Go War Eagles.

Kennesaw State University. Another good school. And Georgetown University in Washington, DC.

So all of them have their own local... Some are in the process of bringing them up. They're going to have their own students, all trained the same way, all working under the Techstream umbrella.

What a great story. What a brilliant model. I can't tell you the amount of calls.

My kids graduated college in the last three to four years, both of them. " They've got no real-world experience. Exactly.

Everything they took was in a class. Yep. They never got a job in cyber.

And now they're calling saying, "Mr. " How am I going to help? I try, but they've got no experience.

These kids are coming out having run a SOC level one. Level two and level three now. And three.

So- I love it ... 100% of our graduates found jobs right away. I'm sure.

Seven of them got snatched up by Techstream. Really? They were very smart, right?

They create- Because they already knew them. They know them. They knew the best workers.

So what Techstream does for any student in the program is they'll get, since everything's tracked in Splunk and we use Splunk SOAR, everything the student does we know. So we create for them a transcript when they're getting ready to graduate that shows every incident they solved- That's fantastic ... the type.

We do random audits on the students, so they have a random audit score of how well they dealt with that incident. That's something they can take to a potential employer- Absolutely ... " And who wouldn't hire them?

So we figured at that point, why stop there? So I opened up a second SOC at LSU called Tiger SOC. Tiger SOC.

Well, duh. You know? It wasn't going to be Gator SOC.

And the idea of this SOC is to flip the model some. So what you see a lot of companies do to save money is they'll outsource overseas. So what Tiger SOC is- Now they get outsourced ...

is Techstream, since they do this for lots of companies- Private companies ... across the country, Techstream now has an outsource contract with me, and our students are doing actual incident... One of the largest casinos in the country is having their incidents monitored by Tiger SOC.

It's brilliant. And Techstream is paying us, and it saves them money because paying students is cheaper than paying their own people, so they could lower their costs, right? And we're creating now more student graduates and a pipeline that these private industries and businesses will have access to be able to say, "Hey, I already know what the type of work you're doing for me, you know my environment.

" So the- Yeah, absolutely. And so now we're offering that to any of the schools in this program can use it as a- So you've set up an MSSP almost here. And it's a revenue generation and all the risk is on Techstream.

That's true. Because they do all the legal risk- They're behind you anyway ... all the SLAs.

Yeah. Yep. So.

It's brilliant. Brilliant. All we hear about there's a million unfilled security jobs out there, right?

That's exactly right, and that's what this is supposed to help. Here are kids getting real experience, able to fill these jobs. Do me a favor.

Yep. Look into this camera. For kids out here who want to maybe get involved in a program like this, or maybe there's other colleges out here who may want to do something similar, tell them where to go, what to do.

So- How to contact you. Something. Yeah.

Well, and actually you can always reach out to me. edu. That's the easiest one instead of trying to spell my name.

Absolutely. But the other thing about this program is this is open to students of all backgrounds. So you do not have to have a cyber background, a technology background at all.

We developed, with Techstream, a critical thinking test, and we believe critical thinking is the most important thing. I love this, man. So now students from all walks of life can apply, and as long as you pass 75% or better on the critical thinking test, you're eligible.

And that same critical thinking test goes at all the schools. So we've literally called this a franchise that the schools- It is ... buy into, and everything's done.

They already have the testing. We have the training process. Everybody gets that transcript.

Wow. They got to take this. This should be like a federal program.

I've had some talks in DC about this. And the beauty of it, when I call it a franchise model, like I'll use NJIT as an example. If you buy a McDonald's franchise, right, you can buy it, and they'll give you all the recipes and all that, but the name on the door is McDonald's.

McDonald's. Here, the SOC in New Jersey- NJIT ... is the NJIT SOC.

They named it after their mascot, and they did a ribbon cutting. And they're celebrating their SOC, but underneath, it's all the work we've put into it. It's still your IP.

And they can just cut and paste. Hey, man, God bless you. Honestly.

Okay. This is such an inspiring story. I haven't heard a story this good in I don't know how long.

So good work really, Craig. Thank you. This is great.

I enjoy listening to it. Keep up the great work. I know you're busy running around here and presenting, but this is the kind of stuff we need.

Keep it up. We're going to take a break. You're watching Techstrong TV.

This is Cisco Live.