Want a sequenced plan instead of a list? Join the structured learning tracks

Cert Atlas

GCIH

GIAC Certified Incident Handler

Defensive Intermediate GIAC
Target job title
Incident Responder
Level
Intermediate. Assumes fundamentals and some hands-on time; typical first-job or first-promotion certs.
Prerequisites
None formal. SANS SEC504 is the aligned course.
Official page
GIAC

Recent updates

Includes CyberLive hands-on questions. Renewal every 4 years.

Reviewed 2026-10-02. Confirm exam details on the official page before booking.

Where it sits in Defensive Security

  1. Entry BTL1 TryHackMe SAL1 CompTIA Security+ Google Cybersecurity Microsoft SC-900 ISC2 CC CCDL1
  2. Intermediate HackTheBox CDSA TryHackMe SAL2 CompTIA CySA+ CompTIA SecAI+ SPLK-5001 OSDA GCIH Microsoft SC-200
  3. Advanced BTL2 CCDL2 CompTIA SecurityX

Natural next steps: BTL2, CCDL2, CompTIA SecurityX.

Preparing for GCIH?

Structured learning tracks

Membership with role- and cert-based learning tracks: roadmaps, cheat sheets, assessments, exclusive writeups and member pricing on notes.

Join the learning tracks

Coaching & cert roadmaps

One-to-one guidance and a roadmap built around your background, target role and timeline, so you stop guessing which cert comes next.

See coaching programs

Prep resources & cheat sheets

Cheat sheets, command references and exam-day extras for when you already know the material and need it fast and in one place.

Browse prep resources