GCIH — GIAC Certified Incident Handler
One of the most widely recognized incident response certifications globally, and a benchmark credential for SOC and IR roles. Covers the full incident response lifecycle from detection through containment, eradication, and recovery, with strong emphasis on understanding attacker techniques. DoD 8140 approved and commonly required in job postings for IR analysts and SOC leads. The MCQ-heavy format is the recurring GIAC criticism, but GCIH has maintained strong employer recognition for over a decade. A solid foundational IR cert that pairs well with GCFA for a complete DFIR credential stack.
| Issuer | GIAC / SANS Institute |
|---|
| Level | intermediate |
|---|
| Domains | Digital Forensics & Incident Response |
|---|
| Practical weight | 25% |
|---|
| Cost (USD) | 999 |
|---|
| Renewal | 4 years |
|---|
| DoD 8140 | Yes |
|---|
| Skills | incident_detection, incident_containment, network_investigation, malware_identification, attacker_technique_recognition, incident_response_process, log_analysis |
|---|
Official certification page
Browse all 426 cybersecurity certifications on EBCertMap