← HomeGIAC / SANS · Full exam outline
GSOM
Security Operations Manager
Security operations managementCore certification
1SOC Design and Planning
1.1SOC models and staffing
1.2Mission, scope and service catalogue
1.3Tooling and technology strategy
2Detection and Analysis
2.1Detection engineering and use cases
2.2Alert triage and analyst workflow
2.3Threat intelligence integration
3Incident Response Management
3.1Response process and playbooks
3.2Containment, eradication and recovery
3.3Post-incident review and metrics
4Active Defence and Threat Hunting
4.1Hunting methodology
4.2Adversary emulation and deception
4.3ATT&CK alignment and coverage
5SOC Team Management
5.1Hiring, training and retention
5.2Shift design and burnout prevention
5.3Performance metrics and reporting
Weights are the certification body’s published values and are checked against each outline revision.