GIAC Security Operations Manager Certification (GSOM)

Exam Certification Objectives & Outcome Statements

• Continuous ImprovementThe candidate will demonstrate an understanding of using post-incident data along with automation, analytic testing, and adversarial emulation to optimize SOC operations and ensure future growth.
• Cyber Defense Theory, Threat Intel, and Defensible ArchitectureThe candidate will demonstrate an understanding of fundamental cyber defense theory, cyber threat intelligence, and defensible security architecture concepts.
• Data Source Assessment and CollectionThe candidate will demonstrate an understanding of utilizing business operations knowledge, organizational specific use cases, and industry frameworks to plan, prioritize, and orchestrate secure and efficient data collection and enrichment to support SOC monitoring operations.
• Managing Alert Creation and ProcessingThe candidate will demonstrate knowledge of alert creation, prioritization, and classification to support efficient SOC triage efforts. The candidate will demonstrate an understanding of implementing best practices to ensure timely and manageable SOC alert response.
• Managing Incident Response ExecutionThe candidate will demonstrate knowledge of techniques for performing effective investigations and methods to support the success of each phase of the incident response cycle.
• Preparing for Incident ResponseThe candidate will demonstrate an understanding of the preparation requirements for successful incident response, fundamental knowledge of the incident response cycle, and the role that incident response plays in the overall SOC operations.
• Proactive Detection and AnalysisThe candidate will demonstrate familiarity with the threat hunting process, active defense techniques, and how community sourced resources can be utilized to supplement gaps in the SOC detection capabilities.
• SOC Analytics and MetricsThe candidate will demonstrate knowledge of using metrics, goals, and analytics to measure the progress and effectiveness of SOC operations to generate and implement a strategic plan that guides continuous maturity of the SOC.
• SOC Design and PlanningThe candidate will demonstrate an understanding of how to assess the business goals, operational requirements, relevant threats, potential attack paths, and risk profile of an organization to design and staff an effective SOC program.
• SOC Tools and TechnologyThe candidate will demonstrate knowledge of common SOC tools and technology, how they are utilized to support SOC operations, and the proper implementation practices to secure these resources.