GIAC Security Operations Manager Certification (GSOM)

Cybersecurity Leadership Certification Overview

Prove you can design, staff, and run a Security Operations Center that catches real threats and holds up under pressure.

Explore LDR551 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GSOM Certification?

The GIAC Security Operations Manager (GSOM) certification validates a practitioner's ability to field an effective Security Operations Center (SOC). GSOM certification holders are qualified to manage a technical team and strategically operate an SOC in alignment with an organization's business goals and security requirements.

By the numbers

2 hrs

Exam duration

Questions

66%

Min. passing score

What GSOM Covers

The certification's 10 published objectives group into 5 practical domains, matching LDR551's five course sections.

SOC Design and Planning

Covers SOC Design and Planning, and Cyber Defense Theory, Threat Intel, and Defensible Architecture: assessing business goals, threats, and risk profile to design and staff an effective SOC program.

SOC Tools and Data Collection

Covers SOC Tools and Technology, and Data Source Assessment and Collection: prioritizing and orchestrating secure, efficient data collection using industry frameworks.

Detection and Alert Management

Covers Managing Alert Creation and Processing, and Proactive Detection and Analysis: alert prioritization, classification, and threat hunting to supplement detection gaps.

Incident Response Leadership

Covers Preparing for Incident Response, and Managing Incident Response Execution: preparation requirements and investigation techniques across the incident response cycle.

Metrics and Continuous Improvement

Covers SOC Analytics and Metrics, and Continuous Improvement: selecting metrics and using post-incident data, automation, and adversarial emulation to optimize SOC operations.

Prepare With This Course

LDR551: Building and Leading Security Operations Centers

Course Details

How LDR551 Prepares You for GSOM

LDR551 is built around the exam objectives that make up the GIAC Security Operations Manager (GSOM) certification:

Section 1, SOC Design and Operational Planning builds skills tested under SOC Design and Planning, and Cyber Defense Theory, Threat Intel, and Defensible Architecture.
Section 2, SOC Telemetry and Analysis aligns with SOC Tools and Technology, and Data Source Assessment and Collection.
Section 3, Attack Detection, Hunting, and Triage builds skills tested under Managing Alert Creation and Processing, and Proactive Detection and Analysis.
Section 4, Incident Response aligns with Preparing for Incident Response, and Managing Incident Response Execution.
Section 5, Metrics, Automation, and Continuous Improvement builds skills tested under SOC Analytics and Metrics, and Continuous Improvement.

Across all five sections, 19 hands-on labs and the Cyber42 leadership simulation, which culminates in a purple team assessment exercise, give you the chance to apply each skill before you sit the exam.

Read the full GSOM certification overview.

LDR551 Course Authors

John Hubbard

Consultant at Security Operations Center (SOC)

John is a Senior SANS Instructor and SOC consultant, author of SEC450 and LDR551. With deep SOC leadership experience, GIAC certifications, and hands-on labs, he equips cyber defenders with the skills to hunt, detect, and lead resilient operations.

Learn more

Mark Orlando

Field CTA at Push Security

Mark Orlando, SANS Instructor and LDR551 co-author, brings decades of SOC leadership experience to help practitioners build, scale, and operate effective security operations programs.

Learn more

Who Should Pursue GSOM

SOC Managers and Leads

Security Directors

Security Program Managers

Lead and Senior SOC Analysts

Technical CISOs

Frequently Asked Questions

The GSOM certification proves you can field an effective Security Operations Center. It validates the ability to manage a technical team and strategically operate a SOC in ways that hold up against an organization's business goals and security requirements, covering everything from designing and staffing a SOC program to prioritizing log collection, building alert use cases, writing response playbooks, and choosing the metrics that show whether a SOC is actually improving.

The GSOM exam is a single proctored test, 2 hours long, with 75 questions. GIAC has set the minimum passing score at 66% for the exam version released on or after February 26, 2022. Because GIAC periodically reviews and updates its exam specifications, confirm the format that applies to your specific attempt in the Certification Information section of your GIAC account.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GSOM is built for SOC managers and leads, security directors, security program managers, lead and senior SOC analysts, and technical CISOs. It fits practitioners moving into SOC leadership for the first time as well as current managers who want to formalize skills they've already picked up on the job.

LDR551, Building and Leading Security Operations Centers, is the SANS course built around the GSOM exam objectives. It runs 5 days of instruction (30 hours self-paced), includes 19 hands-on labs and the Cyber42 leadership simulation, and is taught by John Hubbard and Mark Orlando. Register for LDR551 to build these skills and add the GSOM exam attempt at checkout, or if you're already trained, register for the exam directly through GIAC.

Ready to earn your GSOM certification?

Add the GSOM exam attempt when you register for LDR551.

Already trained? Register for the exam directly through GIAC here.

SEC536: Adversarial AI - Penetration Testing AI Systems