It is interesting that he values "SANS" certifications, but not the courses for them.
Besides my own rambling[1] you might find these resources valuable instead:
* https://tisiphone.net/category/security-education/
* https://krebsonsecurity.com/category/how-to-break-into-secur...
* https://s3ctur.wordpress.com/2017/06/19/breaking-into-infose...
[1] http://dfirnotes.net/ etc.
hth,
adric