Graduate Certificate Program in Incident Response


Program Description

As digital crime and intrusions have increased, so has the need for professionals inside organizations who can identify and respond to incidents before they are discovered by clients or customers. Designed for working professionals in information security, information technology, and audit, the graduate certificate in Incident Response is a highly technical 13-credit-hour program focused on developing your ability to manage both a computer and network-based forensic investigation as well as the appropriate incident responses.

“I chose the SANS Technology Institute graduate program because the technical content and faculty are unparalleled," said Joshua Lewis, VP of Threat Intelligence & Incident Response at Umpqua Bank. "And the mix of live and online instruction fit into my work life.”

In this hands-on program, you’ll begin with a foundational course, progress through three advanced graduate courses, including 1 elective of your choice, and have the opportunity to test real-world techniques in DFIR NetWars Continuous, a graded, online range exercise.

Applications are accepted monthly on the 15th of the month.

Please note that the SANS Technology Institute’s programs are non-residential. Although the college is based in Maryland, USA, its in-person trainings take place across the United States and around the world. The college’s online study options can be completed from anywhere you have access to the Internet. At this time, the SANS Technology Institute does not issue I-20s or support F-1 student visas.

Learn How To

  • Explain the role of digital forensics and incident response in the field of information security, and recognize the benefits of applying these practices to both hosts and networks when investigating a cyber incident.
  • Analyze the structure of common attack techniques in order to evaluate an attacker's footprint, target the ensuing investigation and incident response, and anticipate and mitigate future activity.
  • Evaluate the effectiveness of available digital forensic tools and use them in a way that optimizes the efficiency and quality of digital forensic investigations.
  • Utilize multiple malware analysis approaches and tools to understand how malware programs interact with digital environments and how they were coded, in order to reverse the effects of the program on networks and systems.


Total required credits: 13 credit hours

Required Courses | 10 credit hours

  • Computer Forensic Investigations – Windows | GCFE
  • Advanced Computer Forensic Analysis & Incident Response | GCFA certification
  • Advanced Network Forensics and Analysis | GNFA certification
  • Certificate Program Capstone | DFIR NetWars Continuous

Elective Course | 3 credit hours
(Students choose 1)

  • Hacker Tools, Techniques, Exploits, & Incident Handling | GCIH certification
  • Malware Analysis & Reverse Engineering | GREM certification
  • Cyber Threat Intelligence | GCTI certification
  • Advanced Smartphone Forensics | GASF certification

The SANS Technology Institute Advantage

Live and Online Study Options

The graduate certificate program can be completed entirely online, through immersive weeklong live courses, or in combination.

Flexibility for Working Professionals

Monthly admissions windows mean you can start on your schedule and earn the graduate certificate in roughly two years.

Credentials that Showcase Your Skills

Earn industry-recognized GIAC certifications that validate your skillset in critical, specialized areas of InfoSec.

World-class Faculty

Learn skills you can use immediately on the job from some of the world's best cybersecurity instructor-practitioners.

Pathway to a Master's Degree

Credits earned in the certificate program may be applied directly toward the master's degree program should you later apply and be accepted.

Last updated Jan 2020

About the School

The SANS Technology Institute prepares the next generation of cybersecurity professionals for what they will face in the field. Our programs are distinguished by our world-class faculty; our emphasis ... Read More

The SANS Technology Institute prepares the next generation of cybersecurity professionals for what they will face in the field. Our programs are distinguished by our world-class faculty; our emphasis on hands-on learning in SANS courses that are continually updated for real-world relevance, most of which lead to industry-recognized GIAC certifications; our innovative in-person and online course delivery options; and the proven success of our alumni. Cybersecurity is all we teach and nobody does it better. Read less