Forensic Certificat...
Clear all

Forensic Certification and Career transition question  

New Member

Hi All,

I have 15 years of experience as a programmer/consultant in C,C++,Java,python etc. My recent experience was working on end point security product development. Also i do have many years of consulting work directly with customers onsite and offsite.

I am very much interested in security and consulting work. After working for many years i want to narrow down my core focus and feels like Digital Forensics is best suited for my interests.

My goal is to get CISSP first and then some forensic certifications this year. BTW i have not done any forensic work before.

To get started on forenscics certifications i would like to start with a Vendor neutral certification. I came across SANS GIAC forensic certification and planning to attend FOR408 SANS course at DFIRCON in Monterey,CA March,2014.

1. I did some research on this website forums on whether to attend FOR408 or FOR508. Looks like FOR408 is best suited for beginners like me. Thanks for the feedback given by others.

2. I am planning to self fund for FOR408 SANS course since my employer doesn't pay and i am not doing any forensic work for them. Anybody self funded for the SANS course before? Is it really worth? I would like to hear pros and cons. Also I am planning to take off from my current work for few days to attend DFIR conference.

3. At first i thought GREM SANS 610 course is suited best for me. I want to hold off on this one since i did some memory dump analysis and system level programming/troubleshooting before. I think i can self study on my own for this and prepare for GREM in the near future.

4. Also i want to hear from folks who started off by Forensics certifications and targeted their job search in the digital forensics field. Especially folks who were working in non forensics field and got their jobs in Forensics.

Thanks in advance.

Posted : 21/01/2014 1:37 am
Community Legend

The CISSP is really more of a 10,000 foot management certificate. Very well respected in security circles, not really applicable to day-to-day forensics.

Taking a SANS class at a conference provides more than just the training it also provides great networking opportunities.

408 is a great starting point in training.

Are you going to take a class at the DFIR Conference as well?

If your employer will not pay for your training does that mean they do not do or use forensics? I ask because I am curious what your employment plans are to transition into forensics.

Posted : 21/01/2014 3:45 am
New Member

@BitHead Thank you for the feedback. Yes i am planning to take FOR408 class at the DFIR conference. Nope, My employer doesn't work in the forensic domain. This is outside of my day to day job domain. I intend to transition to become a forensic specialist one day and i want to prepare the ground work for that)

Posted : 21/01/2014 4:17 am