SANS Technology Institute

What you'll study

The curriculum begins with a required core course, proceeds through one blue and one red elective (order is flexible after the core), and concludes with a capstone:

• Required core (3 credits): ISE 5201: Hacker Tools, Techniques, Exploits, & Incident Handling (SEC504 + GCIH).
• Blue elective (3 credits) — choose one: ISE 5401 Intrusion Detection In‑Depth (SEC503 + GCIA); ISE 6215 Advanced Security Essentials (SEC501 + GCED); ISE 6240 Cybersecurity Engineering: Advanced Threat Detection and Monitoring (SEC511 + GMON); ISE 6255 Defensible Security Architecture & Engineering (SEC530 + GDSA); ISE 6578 Cyber Threat Intelligence (FOR578 + GCTI); ISE 6595 Applied Data Science and AI/Machine Learning for Cybersecurity Professionals (SEC595 + GMLE).
• Red elective (3 credits) — choose one: ISE 6315 Web App Penetration Testing and Ethical Hacking (SEC542 + GWAPT); ISE 6320 Enterprise Penetration Testing (SEC560 + GPEN); ISE 6325 Mobile Device Security & Ethical Hacking (SEC575 + GMOB); ISE 6360 Advanced Penetration Testing, Exploit Writing, & Ethical Hacking (SEC660 + GXPN); ISE 6370 Red Team Operations and Adversary Emulation (SEC565 + GRTP); ISE 6630 Cloud Penetration Testing (SEC588 + GCPN).
• Capstone (3 credits): ISE 6250 Purple Team Tactics & Kill Chain Defenses (SEC599 + GDAT) culminating in a Defend‑the‑Flag challenge.

Skills emphasized include coordinated red/blue workflows, detection engineering and validation, adversary emulation, defense tuning, and measuring defensive effectiveness. Students earn GIAC certifications as they complete program courses.

Entry requirements

Applications are accepted monthly; apply by the 15th of any month to receive a decision within 30 days and potentially start courses as soon as one month after admission. The program requires professional experience and a current information security or related role.

Career prospects

The program is targeted at working cybersecurity practitioners seeking to improve detection and response capabilities and to perform purple team activities. The page reports a median salary of $120,500 USD based on earnings reported by program graduates. Graduates also earn GIAC certifications employers value.

Scholarships & funding angle

SANS.edu offers academic pricing on SANS courses and GIAC certifications and provides dedicated student advising and success coaching to support completion. The program’s NSA designation and DoD 8140 alignment may be relevant for applicants seeking government or defense‑related funding or roles.