technology leader & educator · in tech since the “late 1990s” · coastline college
I identify and solve problems before they become liabilities, and since the “late 1990s” (dial-up era, ask your parents) that has been the job. Now I get to teach it, firsthand, at Coastline College. This site follows the five elements, one per section.
today's fortune
In tech since the “late 1990s,” which is what you say when you'd rather not do the math. Coding since high school. Now yours for a semester. Wood is the element of growth, and growth is the whole point.
Welcome, I'm glad you're here. I'm Toan Tran, and I teach cybersecurity and computer science at Coastline College. I've been coding since high school and in tech since the “late 1990s,” a phrase in which the quotation marks are doing some gentle rounding. I've spent that time building and defending real systems; the path is just below. The part of that work I loved most was the moment something finally clicked for someone. Teaching lets me have that moment every week.
My classes feel a lot like the work, on purpose. You'll use real tools and real workflows, break things deliberately, fix them for real, and learn to explain why the fix holds. I bring the two-in-the-morning bug hunts and the nine-o'clock risk briefings into the classroom, and you get to experience all of it.
Most of my students are fitting school around a job, a family, or a time zone, so my courses are built for that: online, paced by module, everything you need on the page, materials that cost $0.00, and pages that work on a Chromebook at the kitchen table. Come as you are. Bring your questions, your half-questions, and the error message you can't name yet. Those are my favorite kind.
In six words: learn by building. I've got you.
Identity, detection, and governance that hold up in production and in an audit.
Alert rules, log pipelines, and automated triage that catch what matters.
NIST, GLBA, PCI-DSS, HIPAA. Audits directed, findings closed, compliance automated.
Coast Learning Systems moved onto AWS, clustered servers, IDS/IPS, network segmentation, and the monitoring to know it's working.
Shipping code since the “late 1990s,” back when it shipped on a CD: PHP, Python, Java, SQL, and JavaScript.
OWASP Top 10, threat modeling, code review, and the defense that makes the exploit fail.
Learn by building. Every idea gets a demo, every demo gets a bug, every bug gets a lesson.
Courses built like software: markdown source, a validating pipeline, one-click Canvas import, WCAG-clean pages.
Cybersecurity apprentices, junior developers, and students, from first commit to first incident.
Contain fast, restore cleanly, write the report, fix the cause. The same two halves every real incident has.
Fuel. Also a hobby. Also a personality trait.
WCAG 2.2, UDOIT-clean pages, captioned demos. Design everyone can use, on any device.
What I teach at Coastline College, drawn from the work. Each class's syllabus is posted in Canvas and is the governing document; office hours and the virtual meeting link are in the syllabus.
Structured programming for students with no prior experience. Python 3 in Thonny, one starter file per module, and a term-long job as a junior analyst at a fictional security shop.
Relational database fundamentals and SQL, from SELECT-FROM-WHERE to stored procedures, views, and indexes, in MySQL Community Server and Workbench.
Lists, hashing, trees, graphs, sorting, and external memory in Java. Cost before code: every structure is introduced by what it makes cheap and what it makes expensive.
OWASP Top 10:2025, taught defense-first. Each module opens with an incident against your own hosted PHP portal; you write the incident report and ship the fix that makes the exploit fail.
Bridging classroom theory and on-the-job practice through individualized objectives at your cybersecurity workplace. One unit per 54 hours of paid or unpaid work.
One module per week, two in an eight-week session. Graded work is due at the end of the module week at 11:59 PM Pacific; the exact date sits on every item.
Late submissions lose points per day and receive zero after seven days unless we arranged something beforehand. Closed discussions stay closed. Nothing is accepted after the last day of the term.
Complete the Student Learning Contract and the first module's work in week one, or you may be dropped. After that, stay within a module of the class.
It may explain a concept or an error message while you study. It does not write what you submit, and you must be able to explain every line on request. Each syllabus draws the exact line.
The Canvas Inbox is the channel of record. Put the course number and your name in the subject line. I reply within 24 to 48 hours on business days.
Every graded item ships with its rubric. Quizzes grade instantly; assignments and discussions get individual written feedback within a week of the due date.
Arrange accommodations through Coastline's DSPS office; they apply from the day they're set. Every course page passes an accessibility gate before a student sees it.
Required materials cost $0.00 in every course but one, which uses a single textbook. All software is free.
class agreements · the same in every course
Every line you submit is a line you can explain, on request.
Break it to understand it. The grade goes to the fix.
Choose the structure for the workload, and name the cost you accept.
Real tools, real workflows, real incident reports.
AI may explain. It may not write what you submit.
Required materials cost: $0.00 wherever I can make it so.
Recorded walkthroughs and demos for my courses. Solid ground you can come back to at any time, at any speed. Links are posted in each class; a public playlist is on the way.
Things I've built, in production and in the classroom, forged one small commit at a time.
Identity, threat detection, governance, and compliance for a community college district: Azure AD Conditional Access, Defender and Security Onion detections, NIST and GLBA audits, phishing simulations, MS-ISAC threat sharing.
2021 to 2026Deployed and integrated a district-wide Security Onion grid for network monitoring and threat detection, tuned the sensors, and wired it into the SOC.
network monitoringMigrated the production learning platform to Amazon Web Services with WAFs, network segmentation, encryption, and automated security monitoring.
cloud migrationDirected the platform's infrastructure, application development, and security strategy from concept to full deployment, with the support processes to match.
Author a whole course as markdown and ship it to Canvas as one .imscc import: pages, assignments, quizzes, rubrics, due dates. Standard-library Python, nothing to install.
in production · every courseA small, deliberately insecure PHP portal that ICS C230 students harden across the term, one incident at a time. Plain PHP, SQLite, no framework.
lab appOpen-source Student Learning Outcomes assessment platform: LTI launch from the LMS, hierarchical outcomes, encrypted student data with FERPA in mind.
Browser-only app: upload a Canvas cartridge, pick and order pages, get one print-ready, accessible syllabus. Nothing leaves your machine.
client-sideA subject-agnostic method for building an online course: architecture, voice, page system, toolchain. Consistency enforced by a script, not by memory.
methodHands each waitlisted student an unused add code and emails it, sent as the instructor, with every code recorded so none is issued twice.
small toolThis site. One HTML file, five elements, zero frameworks. You are currently inside it.
liveMy other site, where the professor jokes live. Enter at your own risk. Not a study resource. (opens in a new tab)
liveOutcomes, then objectives, then what will prove each one.
A standard for what to teach, courseware for how, and a lab the student owns.
Lecture, quiz, lab, assignment. The same shape every module, so effort goes to the content.
Rubrics before lessons. Build the assessment before the content, or you teach what is easy to write.
Markdown in, Canvas package out, every page checked by a script before a student sees it.
Questions in, answers out. Email is the fastest channel; office hours are the friendliest. Students, the Canvas Inbox is the channel of record for anything about your course. Industry, LinkedIn works too.
For anything: a question, an idea, a bug you can't name yet, or a hello. Put your course name in the subject line and you'll get a faster answer. I reply within 24 to 48 hours on school days.
The full version, back to the “late 1990s,” with the parts that don't fit on a tile, or in a decade. (opens in a new tab)
Lab apps, course tooling, and the occasional side project. (opens in a new tab)
not sure which channel? email is always a safe bet
Ask it. In class, in office hours, or by email. Curiosity is always in season.
Say hello 👋