SANS Training Roadmap

Baseline Skills Focused Job Roles Specific Skills, Specialized Roles

NEW TO CYBER SECURITY | COMPUTERS, TECHNOLOGY, & SECURITY DESIGN, DETECTION, AND DEFENSIVE CONTROLS ADVANCED CYBER DEFENSE | HARDEN SPECIFIC DEFENSES
COMPUTER & IT Focused Cyber Defense Skills Platform Focused
SEC275 SANS Foundations | GFACT
FUNDAMENTALS
ADVANCED WINDOWS/
SEC501 Advanced Security Essentials – Enterprise Defender | GCED SEC505 Securing Windows and PowerShell Automation | GCWN
CYBER SECURITY GENERALIST POWERSHELL
SEC301 Introduction to Cyber Security | GISF
FUNDAMENTALS
MONITORING Topic Focused
SEC511 Continuous Monitoring and Security Operations | GMON
You are an aspiring cybersecurity professional beginning your security journey or & OPERATIONS
TRAFFIC ANALYSIS SEC503 Intrusion Detection In-Depth | GCIA
an experienced professional who needs to learn key concepts and terminology. SECURITY
Foundational concepts and skills will be reinforced with hands-on labs. Your career SEC530 Defensible Security Architecture and Engineering | GDSA SIEM SEC555 SIEM with Tactical Analytics | GCDA
ARCHITECTURE
journey will be enhanced with the essential security skills and techniques acquired.
The detection of what is happening in your environment requires an increasingly POWERSHELL SEC586 Blue Team Operations: Defensive PowerShell
sophisticated set of skills and capabilities. Identifying security anomalies requires PYTHON CODING SEC573 Automating Information Security with Python | GPYC
increased depth of understanding to deploy detection and monitoring tools and to
interpret their output. SEC595 Applied Data Science and Machine
DATA SCIENCE
Learning for Cybersecurity Professionals

Open-Source Intelligence Open-Source Intelligence

OSINT SEC487 Open-Source Intelligence (OSINT) Gathering and Analysis | GOSI SEC537 Practical Open-Source Intelligence
OSINT
(OSINT) Analysis and Automation

CORE TECHNIQUES | PREVENT, DEFEND, MAINTAIN OFFENSIVE OPERATIONS | VULNERABILITY ANALYSIS, ETHICAL HACKING SPECIALIZED OFFENSIVE OPERATIONS | FOCUSED TECHNIQUES & AREAS
Every Security Professional Should Know Every Offensive Professional Should Know Network, Web & Cloud
SECURITY NETWORK SEC660 Advanced Penetration Testing,
SEC401 Security Essentials: Network, Endpoint, and Cloud | GSEC SEC560 Network Penetration Testing and Ethical Hacking | GPEN EXPLOIT
ESSENTIALS PEN TESTING Exploit Writing, and Ethical Hacking | GXPN
DEVELOPMENT
SEC760 Advanced Exploit Development for Penetration Testers
Core Defensive, Offensive, and Incident Response Knowledge WEB APPS SEC542 Web App Penetration Testing and Ethical Hacking | GWAPT
SEC642 Advanced Web App Testing, Ethical
BLUE TEAM SEC450 Blue Team Fundamentals: Security Operations and Analysis | GSOC VULNERABILITY WEB APPS Hacking, and Exploitation Techniques
SEC460 Enterprise and Cloud | Threat and Vulnerability Assessment | GEVA
ASSESSMENT SEC552 Bug Bounties and Responsible Disclosure
ATTACKER
SEC504 Hacker Tools, Techniques, Exploits, and Incident Handling | GCIH
TECHNIQUES The professional who can find weakness is often a different breed than one focused CLOUD PEN TEST SEC588 Cloud Penetration Testing | GCPN
exclusively on building defenses. A basic tenet of red team/blue team deployments
All professionals entrusted with hands-on cybersecurity work should be Specialized Penetration Testing
is that finding vulnerabilities requires different ways of thinking and different tools.
trained to possess a common set of capabilities enabling them to secure systems,
Offensive skills are essential for cybersecurity professionals to improve their defenses. BLOCKCHAIN SEC554 Blockchain and Smart Contract Security
practice defense in depth, understand how attacks work, and manage incidents
when they occur. To be secure, you should set a high bar for the baseline set of RED TEAM SEC564 Red Team Exercises and Adversary Emulation
skills in your security organization.
MOBILE SEC575 Mobile Device Security and Ethical Hacking | GMOB
PEN TEST SEC580 Metasploit Kung Fu for Enterprise Pen Testing
WIRELESS SEC617 Wireless Penetration Testing and Ethical Hacking | GAWN
Purple Team
SEC599 Defeating Advanced Adversaries –
ADVERSARY Purple Team Tactics and Kill Chain Defenses | GDAT
EMULATION SEC699 Purple Team Tactics - Adversary
Emulation for Breach Prevention & Detection

FORENSICS ESSENTIALS INCIDENT RESPONSE & THREAT HUNTING | HOST & NETWORK FORENSICS DIGITAL FORENSICS, MALWARE ANALYSIS,
& THREAT INTELLIGENCE | SPECIALIZED INVESTIGATIVE SKILLS
Every Forensics and IR Professional Should Know Every Forensics and IR Professional Should Know
Specialization
FOR500 Windows Forensic Analysis | GCFE
FORENSICS ESSENTIALS FOR308 Digital Forensics Essentials ENDPOINT
FOR508 Advanced Incident Response, Threat Hunting, CLOUD FORENSICS FOR509 Enterprise Cloud Forensics and Incident Response
FORENSICS
and Digital Forensics | GCFA
BATTLEFIELD FORENSICS FOR610 Reverse-Engineering Malware:
FOR498 Battlefield Forensics & Data Acquisition | GBFA MALWARE ANALYSIS
& DATA ACQUISITION NETWORK FOR572 Advanced Network Forensics: Threat Hunting, Malware Analysis Tools and Techniques | GREM
FORENSICS Analysis, and Incident Response | GNFA
Threat Intelligence
Whether you’re seeking to maintain a trail of evidence on host or network systems,
or hunting for threats using similar techniques, larger organizations need specialized CYBER THREAT INTELLIGENCE FOR578 Cyber Threat Intelligence | GCTI
professionals who can move beyond first-response incident handling in order to Digital Forensics & Media Exploitation
analyze an attack and develop an appropriate remediation and recovery plan.
SMARTPHONES FOR585 Smartphone Forensic Analysis In-Depth | GASF
MAC FORENSICS FOR518 Mac and iOS Forensic Analysis and Incident Response
INDUSTRIAL CONTROL SYSTEMS SECURITY INDUSTRIAL CONTROL SYSTEMS SECURITY
Every ICS Security Professional Should Know Every ICS Security Professional Should Know
ESSENTIALS ICS410 ICS/SCADA Security Essentials | GICSP ICS DEFENSE
ICS515 ICS Active Defense and Incident Response | GRID
& RESPONSE
ICS ADVANCED
ICS612 ICS Cybersecurity In-Depth
SECURITY
NERC Protection
NERC SECURITY
ICS456 Essentials for NERC Critical Infrastructure Protection | GCIP
ESSENTIALS

CLOUD SECURITY ESSENTIALS CORE CLOUD SECURITY ADVANCED CLOUD SECURITY

Every Cloud Security Professional Should Know Preparation for More Focused Job Functions Specialization for Advanced Skills & Roles
ESSENTIALS SEC488 Cloud Security Essentials | GCLD PUBLIC CLOUD SEC510 Public Cloud Security: AWS, Azure, and GCP | GPCS CLOUD FORENSICS FOR509 Enterprise Cloud Forensics and Incident Response
DEVSECOPS SEC534 Secure DevOps: A Practical Introduction SECURE WEB APPS SEC522 Defending Web Applications Security Essentials | GWEB MONITORING
SEC541 Cloud Security Monitoring and Threat Detection
& DETECTION
If you are new to cybersecurity or looking to up-skill, cloud security AUTOMATION
SEC540 Cloud Security and DevOps Automation | GCSA
essentials is a requirement for today’s organizations. These courses & DEVSECOPS CONTAINERS SEC584 Cloud Native Security: Defending Containers and Kubernetes
provide the basic knowledge required to introduce students to the cloud With the massive global shift to the cloud, it becomes more critical for every organization CLOUD PEN TEST SEC588 Cloud Penetration Testing | GCPN
security industry, as well as in-depth, hands-on practice in labs. to have experts who understand the security risks and benefits that come with public
Learning how to convert traditional cybersecurity skills into the nuances of cloud
cloud use, how to navigate and take full advantage of multicloud environments,
security is a necessity for proper monitoring, detection, testing, and defense.
and how to incorporate security from the start of all development projects.

CLOUD SECURITY LEADERSHIP AND GOVERNANCE

Every Cloud Security Leader Should Know
AUTOMATION &
SEC557 Continuous Automation for Enterprise and Cloud Compliance
COMPLIANCE
VULNERABILITY
MGT516 Managing Security Vulnerabilities: Enterprise and Cloud
MANAGEMENT
DESIGN &
MGT520 Leading Cloud Security Design and Implementation
IMPLEMENTATION

FOUNDATIONAL LEADERSHIP CORE LEADERSHIP LEADERSHIP SPECIALIZATIONS

Every Cybersecurity Manager Should Know Transformational Cybersecurity Leader Cloud Cybersecurity Leadership
CISSP® TRAINING MGT414 SANS Training Program for CISSP® Certification | GISP TECHNOLOGY MANAGING
MGT512 Security Leadership Essentials for Managers | GSLC MGT516 Managing Security Vulnerabilities: Enterprise and Cloud
LEADERSHIP VULNERABILITIES
RISK
MGT415 A Practical Introduction to Cyber Security Risk Management
MANAGEMENT SECURITY DESIGN &
MGT514 Security Strategic Planning, Policy, and Leadership | GSTRT MGT520 Leading Cloud Security Design and Implementation
STRATEGY IMPLEMENTATION
SECURITY
MGT433 Managing Human Risk: Mature Security Awareness Programs
AWARENESS SECURITY CULTURE MGT521 Leading Cybersecurity Change: Building a Security-Based Culture AUTOMATION &
SEC557 Continuous Automation for Enterprise and Cloud Compliance
COMPLIANCE
CIS Controls SEC440 CIS Critical Controls: A Practical Introduction Operational Cybersecurity Executive
Management Specialization
With an increasing number of talented technologists, organizations require MANAGING
MGT516 Managing Security Vulnerabilities: Enterprise and Cloud
effective leaders to manage their teams and processes. Those leaders will not VULNERABILITIES AUDIT & MONITOR AUD507 Auditing and Monitoring Networks, Perimeters & Systems | GSNA
necessarily perform hands-on work, but they must know enough about the SOC MGT551 Building and Leading Security Operations Centers LAW &
LEG523 Law of Data Security and Investigations | GLEG
underlying technologies and frameworks to help set strategy, develop appropriate INVESTIGATIONS
policies, interact with skilled practitioners, and measure outcomes. CRITICAL
SEC566 Implementing and Auditing CIS Critical Controls | GCCC
CONTROLS PROJECT
MGT525 IT Project Management & Effective Communication | GCPM
MANAGEMENT

Essentials ICS410 ICS/SCADA Security Essentials | GICSP