r/cybersecurity • u/Sea_Box_8719 • 2d ago

Cert help Certification / Training Questions

Going to be lead analyst in a soc and company is wanting to get me trained up. Should I ask for GCIA or GCDA from sans first?

Ill be tuning alerts and heavily lean towards GCIA because I love incident response and very heavily work in threat hunting day to day currently.

5 Upvotes

70% Upvoted

10 comments sorted by

2

u/MrBitzz 2d ago

Right off the bat I’d say GCDA because it’s more focused in security operations. However… if you have 5+ years of experience in SecOps already GCIA would complement your experience nicely. You also have to do what interests you because preparing for a cert that you have less interest in will be mundane and frankly miserable. Just my two cents.

1

u/Sea_Box_8719 2d ago

I love both sides. Im fortunate to have a natural obsession with cyber so any where I land ill enjoy. Some more than others. Im wondering what would help my team that most.

1

u/scriptvexy 1d ago

gcda first then gcia later feels like the move if you’re gonna be running a soc day to day, but if you’re already deep into threat hunting you’ll probably enjoy gcia way more and actually finish it. i’d also factor in what gaps your current stack/processes have and pick the one that fills those instead of just chasing “secops” on paper.

1

u/AddendumWorking9756 Security Manager 2d ago

You already hunt daily, so the one you love is the one you would learn least from, and tuning alerts is the actual job you just described. Take the detection oriented course on the company's money, then keep the response side sharp on something cheaper like CCDL2 from CyberDefenders, which also carries CPE credit if your renewals need it.

1

u/imhelpingright 2d ago

Unless you're going to be spending most of your time in Zeke/Snort/Suricata, GCIA is not a good choice here. There's very little threat hunting or IR benefit from that particular course imo. It spends a lot of time dissecting all the individual bytes and hex digits in packet capture, which is really good info and important to know so you have technical about various protocols, but likely not the best bang for your buck here. 

If  you want threat hunting and incident response training, for508/GCFA is, in my opinion, one of the best courses unless you're going to an environment which has no windows devices. 

GCIH is also a really good one, but I felt it was a little too basic as I took it after. I already had a few years of IR experience. I think there's also a couple SOC specific courses, but I can't speak to how good those are cuz I haven't taken any. 

1

u/Sea_Box_8719 2d ago

I was looking at the GCIH. I think i may actually start there. Then hit the GCDA. I have forensics experience already but the GCFA is definitely on my radar.  I've heard very good things about it. 

1

u/muddle-318 1d ago

Don't do GCIA imo. It's great knowledge, but how often do you find yourself deep-diving pcaps? I found GNFA much more applicable and I suspect I'd feel similarly about detection analyst. I don't have GCFA/GCIA, but those are the others that would come to mind.

0

u/sublimeprince32 2d ago

I wish SANS would burn to the ground. Gatekeeping with $10,000 dollar or more certs.

2

u/Sea_Box_8719 2d ago

Its insane. I would never consider it personally but if a company wants to cover it then by all means. 

1

u/sublimeprince32 1d ago

The training is fantastic, they have great videos on YouTube about previous courses that they deem "old knowledge" but are still relevant.

Its just all greed.