GIAC AI Security Automation Engineer

Scripts are the glue of every security team. You write Python, PowerShell and shell scripts that call APIs, parse structured data, handle errors and keep secrets out of code.

• Python for security tasks: requests, JSON and files
• PowerShell for Windows and cloud administration
• Shell scripting for Linux tasks
• Working with security tool APIs
• Error handling, logging and retries
• Credential handling and testing scripts

You build A tested script library that enriches an alert from three sources and writes the result to a case.

Security tooling should be built the way software is built. You define infrastructure as code, use version control and review for security automation, and share work through collaborative notebooks and repositories.

• Infrastructure as code concepts and tools
• Version control workflows for security teams
• Code review and testing for automation
• Pipelines that deploy security tooling
• Notebooks and shared environments for analysis
• Secrets and state management

You build A repository that deploys a small detection environment from code, with a review pipeline.

AI is now a component of automation, with strengths and failure modes of its own. You learn how language models process text, how retrieval-augmented generation works, which model types fit which tasks, and what makes a system agentic.

• How language models process text
• Retrieval-augmented generation in outline
• Model types and choosing one for a task
• Characteristics of agentic AI
• Limits: errors, bias and cost
• Data handling and privacy for AI in security

You build A short design note that selects a model approach for one security task and lists its failure modes.

SOAR turns repeated analyst steps into playbooks. You design playbooks, integrate tools that do not speak to each other, work with common SOAR platforms, and decide when a human must approve an action.

• SOAR concepts and where they fit in a SOC
• Playbook design: triggers, branches and approvals
• Integrating independent tools through APIs
• Common SOAR tools compared
• Testing and versioning playbooks
• Measuring playbook performance

You build A phishing triage playbook with enrichment, decision points and an analyst approval step.

Defense automation starts at the endpoint. You deploy agents at scale, collect incident artifacts automatically, enrich alerts with context and connect the results to SOC and fusion center workflows.

• Agent deployment and health management
• Automated collection of incident artifacts
• Enrichment sources: intelligence, asset and identity data
• Feeding SOC case management and fusion workflows
• Safe automated containment actions
• Handling automation failures

You build An automated collection and enrichment workflow for a suspected compromised host.

Detection and response can be written, tested and improved like code. You apply response models, forensic tooling and SOAR playbooks, and use generative and agentic AI in the SOC while keeping people accountable for what it does.

• Detection engineering as a development cycle
• Response models and when automation fits each step
• Forensic tooling driven by scripts
• Generative AI for triage, summaries and rule drafting
• Agentic AI in the SOC: scope and guardrails
• Evaluating AI-assisted detections for quality

You build A detection written, tested and tuned through a pipeline, with an AI-assisted triage step and a quality check.

AWS provides the logs and hooks needed for automated response. You use its services for compliance checks, central logging and automated incident response, and improve the setup after each event, including with AI-assisted workflows.

• Audit logging and event sources in AWS
• Threat detection and findings aggregation
• Configuration and compliance monitoring
• Event-driven response with functions and event buses
• Automated containment of compromised resources
• Continuous improvement and AI-assisted analysis

You build An event-driven AWS response that detects a suspicious access key and contains it automatically.

Azure offers its own detection and automation stack. You use Microsoft Defender and Sentinel, define the environment as code, and build automated responses and AI-driven analysis on the platform’s services.

• Azure and Entra logging and signals
• Defender products and their alerts
• Sentinel analytics and incident handling
• Automation rules and playbooks
• Deploying security configuration as code
• AI-driven features and their limits

You build A Sentinel analytic rule with an automated response playbook, deployed from code.

Detections that were never tested are guesses. You learn the terminology, frameworks and methodology of adversary emulation, and use breach and attack simulation platforms to check whether controls see the behavior they claim to see.

• Emulation versus simulation versus red teaming
• Threat-informed emulation plans
• Frameworks for describing and sequencing behaviors
• Breach and attack simulation platforms
• Safe execution, scope and approvals
• Recording results as detection coverage

You build An emulation plan and results sheet that tests five detections and records what each one saw.

Purple teaming works when offense and defense share a loop. You automate that loop with orchestration, chain behaviors the way a real adversary would, use agentic AI where it saves effort, and feed the findings back to detection engineers.

• The purple team loop and where automation helps
• Orchestrating tests across hosts and cloud
• Chaining behaviors into a realistic scenario
• Agentic AI in test planning and execution, with limits
• Guardrails, logging and rollback for test automation
• Turning gaps into new detections

You build An automated purple team exercise that runs a short scenario and produces a gap list for detection engineers.

Join the pieces into a working pipeline. You build detection, enrichment and response, deploy it as code, test it with emulated behavior, and report how well it performs and where people still decide.

• Selecting the scenario and the workflow
• Building detection and enrichment
• Adding response and human approval
• Testing with emulated behavior
• Reporting performance and gaps

You build A deployed detect-and-respond pipeline with test results and a performance report.