Differentiate your skill as a blue team leader, ready to design, automate, and improve SOC operations under real-world pressure.
The GIAC Security Operations Certified (GSOC) certification validates a practitioner's ability to defend an enterprise using essential blue team incident response tools and techniques. GSOC certification holders are prepared to run a security operations center (SOC) equipped with the practical technical knowledge and key advanced concepts essential for operating a modern, effective cyber defense team.
Areas Covered
- SOC monitoring and incident response using incident management systems, threat intelligence platforms, and SIEMs
- Analysis and defense against the most common enterprise-targeted attacks
- Designing, automating, and enriching security operations to increase efficiency
Who is GSOC for?
- Security analysts
- Incident investigators
- Security engineers and architects
- Technical security managers
- SOC managers seeking additional technical perspective on how to improve analysis quality, reduce turnover, and run an efficient SOC
- Anyone looking to start their career on the blue team
Instructor Testimonial
“Instructor Testimonial
Security team leaders play a vital role in aligning security operations with business functions and keeping our defenders engaged. The GIAC Security Operations Manager (GSOM) certification is an important step in formalizing and recognizing the unique combination of management skills, leadership traits, process frameworks, and tools required to field an effective security operations team. Obtaining the GSOM demonstrates a practical understanding of how a truly advanced security team operates and how to prioritize security operations tasks to stop today’s advanced cyber threats.”
Exam Format
- 1 proctored exam
- 2 hours
- Minimum passing score of 67%
- 75 questions
Note: GIAC periodically reviews and may update certification specifications to ensure fairness, validity, and reliability. Using a psychometric standard-setting study, GIAC has set the passing score for the GSOC exam at 67% for all candidates who receive the exam version released on or after August 28, 2021.
To confirm the exam format and passing score that apply to your specific attempt, please refer to the Certification Information section of your GIAC account: https://exams.giac.org/pages/attempts.
Certification Delivery
GIAC certification attempts will be activated in your GIAC account after your application has been approved and according to the terms of your purchase. Details on delivery will be provided along with your registration confirmation upon payment. You will receive an email notification when your certification attempt has been activated in your account. You will have 120 days from the date of activation to complete your certification attempt.
NOTE: All GIAC Certification exams are web-based and required to be proctored. There are two proctoring options: remote proctoring through ProctorU, and onsite proctoring through PearsonVUE. Click here for more information.
Exam Certification Objectives & Outcome Statements
- AI Foundations and Analyst Workflow IntegrationThe candidate will understand core generative AI concepts and how to responsibly integrate AI assistance into the analyst workflow while verifying AI-generated output.
- Alert Enrichment and Operational SecurityThe candidate will understand how to enrich alerts manually and with AI agents, apply operational security practices during investigation, and evaluate agent tool use and associated risk.
- Detection EngineeringThe candidate will understand how to design, write, test, tune, and share detection rules and logic.
- Log Analysis and Incident TriageThe candidate will understand how to interpret various logs, prioritize incidents, and how to include organizational factors in analysis and response.
- Malicious File and Email Threat AnalysisThe candidate will be familiar with common phishing and email-based attack techniques, defensive email authentication standards, and methods for identifying and analyzing malicious files.
- Network Protocols and Traffic AnalysisThe candidate will be able to analyze network traffic--including DNS, HTTP(S), encrypted traffic, and other common protocols--to identify malicious activity and attacker techniques.
- SOC Automation and Agent ManagementThe candidate will understand when and how to apply automation, SOAR, and AI agents to SOC workflows, and how to configure and manage agent behavior responsibly.
- SOC FoundationsThe candidate will be able to explain the purpose of a SOC, its role in organizational risk, and how SOC strategy, team structure, tooling, case management, and cyber threat intelligence work together to support monitoring and incident response.
- SOC Performance and Continuous ImprovementThe candidate will understand methods for improving SOC operations, including AI risk governance, metric use, and professional development.
Practice Tests
- Practice exams are a simulation of the real exam, allowing you to become familiar with the test engine and style of questions
- Practice exams can serve as a gauge to determine if your preparation methods are sufficient
- The bank of practice questions is limited, so you may encounter the same question on multiple practice tests
- Practice exams never include actual exam questions
- Purchase a GSOC practice test here
Other Resources
- Training is available in a variety of modalities including live training and OnDemand
- Practical work experience can help ensure that you have mastered the skills necessary for certification
- College level courses or self-paced study through other programs or materials may meet the needs for mastery
- Understand the procedure to contest exam results
- Use this justification letter to share key details of this certification opportunity with your boss