GREM
GIAC Reverse Engineering Malware
Static + dynamic malware analysis, unpacking, custom RE tooling.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Market signals
public, citable inputs to the recognition score› Built for these roles
› Exam format
Open-book MCQ exam, 75 questions over 3 hours, online proctored. Heavy focus on disassembly snippets.
30-day wait. SANS course bundles typically include 2 attempts.
› Recertification
36 CPE credits over four years (avg 9/yr) plus the $499 renewal fee per cycle.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 3 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
Static/dynamic analysis, sandbox analysis, assembly/disassembly, packer analysis, YARA rules, malware family classification.
IR playbooks, memory/disk/network forensics, chain of custody, malware analysis.
SIGMA/YARA/Suricata rule writing, hypothesis-driven hunting, log deep-dives, detection gap analysis.
› Also touched
Present in the blueprint but not the primary focus — you’ll be introduced but shouldn’t expect depth.
› Prerequisites
Three-plus years of security experience. Assembly fluency is a real prerequisite — not optional. Usually paired with SANS FOR610.
- x86/x64 assembly
- Debuggers (x64dbg, WinDbg) and disassemblers (IDA, Ghidra)
- Static and dynamic analysis workflows
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No certs require this one.
› Study materials
Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.
- SANS FOR610 Course Materials — SANS
- GIAC Practice Tests (2 included with exam)
- Practical Malware Analysis (Sikorski/Honig)
- REMnux
› Version & lifecycle
› Salary signal
Malware analyst / threat-research engineer, US, 4-7 years.
Robert Half Salary Guide + Glassdoor 'Malware Analyst' aggregations · 2024 · US base only · p25–p75 range
› How it compares
GREM is malware reverse engineering; GCFA is forensic analysis. Often paired in DFIR teams.
↔ Compare side-by-side› Careers that commonly pursue this cert
Dissect malicious software to understand capabilities, extract indicators, and produce attribution. A specialist role that powers threat intelligence, detection engineering, and advanced IR.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.