GIAC Security Operations Certified (GSOC)

Cyber Defense Certification Overview

Validates the ability to defend an enterprise using essential blue team incident response tools and techniques, and to run a modern SOC.

Explore SEC450 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GSOC Certification?

The GIAC Security Operations Certified (GSOC) certification validates a practitioner’s ability to defend an enterprise using essential blue team incident response tools and techniques. Certification holders are prepared to run a security operations center (SOC), with the practical technical knowledge and key concepts needed to operate a modern, effective cyber defense team.

By the numbers

2 hrs

Exam duration

Questions

67%

Min. passing score

What GSOC Covers

GSOC’s 9 published exam objectives group into five practical areas, which map to the five sections of SEC450.

SOC Foundations and AI Workflow

Covers the mission and role of a SOC, plus SOC monitoring and incident response using the incident management systems, threat intel platforms, and SIEMs that run it.

Network Evidence and Enrichment

Covers analysis and defense against network-based threats, including network traffic review, DNS defense, HTTP(S) analysis, and common protocol attacks against SMTP, SMB, DHCP, ICMP, FTP, and SSH.

Triage and Automation

Covers analyzing log and file based threats by reading Windows and Linux event logs and extracting evidence from files, plus prioritizing incidents with organizational context in mind.

Email, Malware, and Detection

Covers defending against the most common enterprise targeted attacks at the endpoint, including endpoint logging, plus how to design, test, and refine detection analytics.

SOC Performance

Covers designing, automating, and enriching security operations, including automating repetitive SOC tasks, orchestrating response, AI assisted analysis, and agentic workflows, plus training the team to run more efficiently.

Prepare With This Course

SEC450: AI-Enabled Security Operations: Hands-on Investigation, Detection, and Automation

Course Details

How SEC450 Prepares You for GSOC

SEC450 is built around the exam objectives that make up the GSOC certification:

Section 1, Building the AI-Enabled SOC: Mission, Intelligence, Tools, and Workflow builds skills tested under Blue Team Defense Concepts and SOC Management Systems.
Section 2, Network Evidence and Agentic Enrichment: Protocols, OPSEC, and Tool Use builds skills tested under Network Traffic Analysis, HTTP(S) Analysis and Attacks, and Protocol Attacks and Analysis.
Section 3, From Telemetry to Investigation: Triage, Structured Analysis, and Agentic Automation builds skills tested under Interpreting Events and Intrusion Triage and Analysis.
Section 4, From Phishing to Detection: Email, Malware Analysis, YARA-X, and Sigma builds skills tested under Endpoint Defense and Analytic Design and Tuning.
Section 5, Operating the AI-Enabled SOC: Risk, Judgment, and Sustainable Performance builds skills tested under Operational Improvement.

Across all 5 sections, 19 hands-on labs and a capstone MoneyMatrix Incident exercise give you the chance to apply each skill in a live simulated SOC environment before you sit the exam.

Read the full GSOC certification overview

SEC450 Course Author

John Hubbard

Consultant at Security Operations Center (SOC)

John is a Senior SANS Instructor and SOC consultant, author of SEC450 and LDR551. With deep SOC leadership experience, GIAC certifications, and hands-on labs, he equips cyber defenders with the skills to hunt, detect, and lead resilient operations.

Who Should Pursue GSOC

Security Analysts

Incident Investigators

Security Engineers and Architects

Technical Security Managers

SOC Managers

Anyone Starting a Blue Team Career

Frequently Asked Questions

GSOC proves you can run the practical side of a SOC, using incident management systems, threat intelligence platforms, and SIEMs to monitor and respond, analyzing and defending against the attacks enterprises see most often, and designing automation that makes the SOC more efficient.

The exam is a single proctored attempt: 2 hours, 75 questions, with a minimum passing score of 67%. GIAC periodically reviews and updates certification specifications, so confirm the exact format for your attempt in the Certification Information section of your GIAC account before test day.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GSOC fits SOC analysts, incident investigators, security engineers and architects, technical security managers, and SOC managers who want a stronger technical grounding. It is also a starting point for anyone moving into a blue team role.

SEC450: AI-Enabled Security Operations is built around the GSOC objectives, with 19 hands-on labs and a capstone incident investigation covering SOC tools, network and endpoint evidence, detection engineering with YARA-X and Sigma, and the AI-enabled workflows now part of SOC work.

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GSOC certification?

Add the GSOC exam attempt when you register for SEC450.

Already trained? Register for the exam directly through GIAC here.

SEC536: Adversarial AI - Penetration Testing AI Systems