GCIH
GIAC Certified Incident Handler
Incident handling methodology and lifecycle.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Market signals
public, citable inputs to the recognition score› Built for these roles
› Exam format
Open-book MCQ exam, ~106 questions over 4 hours plus a Cyber Live hands-on component, online proctored.
Retake fee $999. 30-day wait between attempts. SANS course bundle includes 2 attempts.
› Recertification
36 CPE credits over four years (avg 9/yr) plus the $499 renewal fee per cycle.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
› Also touched
Present in the blueprint but not the primary focus — you’ll be introduced but shouldn’t expect depth.
Static/dynamic analysis, sandbox analysis, assembly/disassembly, packer analysis, YARA rules, malware family classification.
SIGMA/YARA/Suricata rule writing, hypothesis-driven hunting, log deep-dives, detection gap analysis.
› Prerequisites
Two to three years of SOC or IR experience recommended. Often paired with SANS SEC504.
- Incident response lifecycle (PICERL / NIST SP 800-61)
- Windows and Linux log analysis
- Common attack tradecraft
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No certs require this one.
› Study materials
Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.
- SANS SEC504 Hacker Tools, Techniques, and Incident Handling
- GIAC self-study path (without SANS course)
- GIAC Practice Tests (2 included with exam)
- GIAC Index Building Tips (multiple community guides)
- r/SANSGIAC
› Version & lifecycle
SANS SEC504 is updated continuously; GIAC certification objectives track the course.
› Salary signal
Incident responder / blue team analyst, US, 3–5 years.
Robert Half Salary Guide + SANS-affiliated salary data · 2024 · US base only · p25–p75 range
› How it compares
GCIH is incident response (live); GCFA is forensic analysis (post-incident, evidence). Often paired.
↔ Compare side-by-side› Careers that commonly pursue this cert
Investigate breaches, contain threats, and perform digital forensics. The first call when an attack is discovered.
Owns the end-to-end find → prioritize → fix → verify loop at scale, now increasingly AI-driven.
External-first role: inventories what an attacker can see, tracks what's new, and drives closure through the org. The outside-in counterpart to vuln management.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.