SecProve
ProfessionalVendor-neutralGIAC· issued from US

GEIR

GIAC Enterprise Incident Response

GIAC Enterprise Incident Response

Official page at GIAC↔ Compare with another cert
Exam fee
$979
Ongoing
$0/yr AMF · 9 CPE/yr
Study time
—
Delivery
Hybrid
Validity
4 yrs (renewal cycle)

› Quality score

28.5 / 40

Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.

Blueprint rigor
How well-defined and rigorous the exam blueprint is.
Newer GIAC blueprint focused on enterprise-scale incident response operations. Rigorous scoping for the niche.
7.5/10
Practical evidence
Hands-on labs / written reports vs pure MCQ.
CyberLive items are central to the format; tracks the SANS course's hands-on exercises.
7.5/10
Currency & upkeep
How aggressively content is kept current with the field.
Brand-new (2024). Tracks SANS course — expect aggressive refresh.
8.5/10
Market recognition
How often this signal actually moves a hiring decision.
Too new for hiring-manager recognition yet. Watch the next 18-24 months.
5.0/10

› Exam format

75 questions + CyberLive, 3 hours, open-book, proctored via Pearson VUE. Passing score: ~70%.

Passing score
70% (scaled per attempt)
Retake policy
Fee: $999 per attempt
Wait: 30d between attempts

30-day wait between attempts. SANS course bundles typically include 2 attempts.

› Recertification

Valid for 4 years. Renewal via 36 CPE credits or renewal exam (479 USD). Each GIAC cert separate.

› NICE Framework work roles

The NIST NICE work-role IDs this cert maps to. NICCS lookup.

PD-WRL-003PD-WRL-001IO-WRL-006
Recognition
Global
Exam languages
en

› Core domains covered

The 1 domain this cert is centrally about. Passing the exam demonstrates working knowledge of each.

A10Security Operations

SOC operations, SIEM tuning, SOAR playbooks, alert triage, log analysis, runbook development.

› Prerequisites

Experience

No formal prerequisites. Associated SANS course strongly recommended.

› Study materials

Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.

Official guides
Practice tests
  • GIAC Practice Tests (2 included with exam)
Free / community

› Version & lifecycle

Current version
Launched 2024
Released
2024-06

› Salary signal

Enterprise IR specialist / ransomware response lead, US, 4-7 years.

$120K–$180K
median $145K

Robert Half Salary Guide extrapolation · 2024 · US base only · p25–p75 range

› How it compares

vs
GCIH

GEIR is enterprise-scale incident response; GCIH is foundational IR.

↔ Compare side-by-side

See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.

Highlight on the domain mapBrowse all certifications