SANS Technology Institute

17 Programs 5 Degree levels
Short Training

Graduate Certificate in Incident Response

DegreeShort Training
FieldCybersecurity

A 12-credit graduate certificate that teaches hands-on incident investigation and response methods for working cybersecurity professionals. It suits practitioners in current infosec or related roles who want practical skills in detection, evidence handling, containment and recovery, delivered with flexible online or in-person options.

Programme overview

This 12-credit Graduate Certificate is designed to build practical incident response capabilities for professionals who already work in information security or related roles. The program combines a required foundational course, three advanced graduate courses and one elective. Delivery options include 100% online (OnDemand or Live Online) and in-person formats. The program is NSA-designated as a Center of Academic Excellence in Cyber Defense, supports DoD 8140 workforce readiness, includes GIAC certifications as you complete courses, and lists a reported median salary of $139,000 USD from program graduates. Total program cost is stated as $22,800 USD, and typical completion is 18–24 months.

What you'll study

The curriculum proceeds in a set order starting with a core then advancing through graduate-level incident response topics. Core and elective course listings (course codes and associated SANS course/GIAC cert) are provided below.

  • Required Core Courses (9 credits): ISE 6500: Windows Forensic Analysis | FOR500 + GCFE; ISE 6508: Advanced Incident Response, Threat Hunting, and Digital Forensics | FOR508 + GCFA; ISE 6608: Enterprise-Class Incident Response & Threat Hunting | FOR608 + GEIR.
  • Elective (3 credits) — choose one: ISE 5503 SEC503 + GCIA; ISE 5504 SEC504 + GCIH; ISE 6509 FOR509 + GCFR; ISE 6518 FOR518 + GIME; ISE 6572 FOR572 + GNFA; ISE 6577 FOR577 + GLIR; ISE 6578 FOR578 + GCTI; ISE 6585 FOR585 + GASF; ISE 6595 SEC595 + GMLE; ISE 7610 FOR610 + GREM.

Entry requirements

Applications are accepted monthly; apply by the 15th of any month to receive a decision about 30 days later and potentially start within one month of admission. The published entry expectation notes that applicants must have professional experience and hold a current infosec or related role.

Career prospects

The program emphasizes immediately applicable skills: incident detection and triage, evidence collection and analysis, containment/eradication/recovery techniques, and incident documentation with post-incident reporting. Courses include GIAC certification paths employers recognize; the page reports a median graduate salary of $139,000 USD based on alumni-reported earnings.

Scholarships & funding angle

The site references SANS.edu academic pricing on SANS courses and GIAC certifications and offers dedicated student advising and success coaching. Specific scholarship, loan or employer-funding details are not provided on the course page; prospective students are encouraged to contact admissions for funding options and guidance.

Latest Short Training Scholarships

⚖ Compare this programme with similar ones

Similar Short Training programmes at other universities

Get help applying to SANS Technology Institute

Shortlist scholarships and plan your application — free guidance from our advisors.

Programme details are indicative and may change — always verify current information with the official university website before applying.