Weekend batches
October 2026
09:00–15:00 · flexible hours
$799per learner
24 Oct 2026
4 of 25 seats available
31 Oct 2026
10 of 25 seats available
Cybersecurity
Incident Response Professional Certification in United States
Incident Response Professional Certification Training in United States develops practical skills in incident detection, analysis, containment, eradication, recovery, digital forensics, threat investigation, and cybersecurity response. This Incident Response Certification Course helps professionals investigate security incidents, strengthen response capabilities, analyze evidence, manage cyber threats, and prepare for incident response roles through structured, hands-on cybersecurity training.
40 Hours / 5 DaysAdvanced3.9 · 2,654 reviews
Training calendar
Upcoming four-month course schedule
A new weekday and weekend batch starts every week. Each batch runs for 5 training days, based on the course duration of 40 Hours / 5 Days.
Weekend batches
November 2026
09:00–15:00 · flexible hours
$799per learner
07 Nov 2026
25 of 25 seats available
14 Nov 2026
25 of 25 seats available
21 Nov 2026
25 of 25 seats available
28 Nov 2026
25 of 25 seats available
Weekend batches
December 2026
09:00–15:00 · flexible hours
$799per learner
05 Dec 2026
25 of 25 seats available
12 Dec 2026
25 of 25 seats available
19 Dec 2026
25 of 25 seats available
26 Dec 2026
25 of 25 seats available
Weekend batches
January 2027
09:00–15:00 · flexible hours
$799per learner
02 Jan 2027
25 of 25 seats available
09 Jan 2027
25 of 25 seats available
16 Jan 2027
25 of 25 seats available
23 Jan 2027
25 of 25 seats available
30 Jan 2027
25 of 25 seats available
Course curriculum
What you’ll learn
40 Hours / 5 DaysAdvanced
Module 1: Introduction to Incident Handling and Response
- Information security threats and attack vectors
- Attack and defense frameworks
- Information security concepts and incidents
- Incident management fundamentals
- Incident response automation and orchestration
- Incident handling best practices
- Cybersecurity standards and frameworks
- Incident handling laws and legal compliance
Module 2: Incident Handling and Response Process
- Incident handling and response lifecycle
- Preparation and incident response planning
- Incident recording and assignment
- Incident triage and prioritization
- Incident notification and escalation
- Incident containment procedures
- Evidence gathering and forensic analysis
- Incident eradication and recovery
- Post-incident activities
- Information sharing and reporting
Module 3: Forensic Readiness and First Response
- Fundamentals of first response
- Securing and documenting the incident scene
- Identification and collection of digital evidence
- Evidence preservation procedures
- Evidence packaging and transportation
- Chain of custody concepts
- Forensic readiness planning
- Incident documentation and evidence handling
Module 4: Handling and Responding to Malware Incidents
- Malware incident identification
- Malware incident preparation
- Malware detection and analysis
- Malware containment techniques
- Malware behavioral analysis
- Malware eradication procedures
- System recovery after malware incidents
- Malware incident case studies
- Malware response best practices
Module 5: Handling and Responding to Email Security Incidents
- Email security incident fundamentals
- Preparation for email incident response
- Phishing and malicious email detection
- Email incident analysis
- Email threat containment
- Malicious attachment and link investigation
- Email incident eradication
- Recovery from email security incidents
- Email security incident case studies
- Email response best practices
Module 6: Handling and Responding to Network Security Incidents
- Network security incident fundamentals
- Network incident response preparation
- Network traffic and security event analysis
- Network attack detection
- Network incident containment
- Network evidence collection and investigation
- Network threat eradication
- Network recovery procedures
- Network security incident case studies
- Network incident response best practices
Module 7: Handling and Responding to Web Application Security Incidents
- Web application security incidents
- Web application attack vectors
- Web incident response preparation
- Web attack detection and analysis
- Web incident containment
- Web application evidence collection
- Web incident eradication
- Web application recovery
- Web security incident case studies
- Web application incident response best practices
Module 8: Handling and Responding to Cloud Security Incidents
- Cloud security incident fundamentals
- Cloud incident response preparation
- Cloud threat detection and analysis
- Cloud security incident containment
- Cloud evidence gathering
- Cloud incident eradication
- Cloud environment recovery
- Cloud incident investigation case studies
- Cloud incident response best practices
- Cloud security monitoring considerations
Module 9: Handling and Responding to Insider Threats
- Insider threat fundamentals
- Malicious and negligent insider activities
- Insider threat detection
- Insider incident investigation
- Insider threat containment
- Evidence collection and analysis
- Insider threat eradication
- System and account recovery
- Insider threat case studies
- Insider threat response best practices
Module 10: Handling and Responding to Endpoint Security Incidents
- Endpoint security incident fundamentals
- Endpoint incident response preparation
- Endpoint threat detection and analysis
- Endpoint evidence collection
- Endpoint incident containment
- Malware and suspicious process investigation
- Endpoint incident eradication
- Endpoint recovery procedures
- Endpoint security incident case studies
- Endpoint incident response best practices
Entry requirements and prerequisites
- Basic Cybersecurity Knowledge
Candidates should have a foundational understanding of cybersecurity concepts, security threats, vulnerabilities, and defensive security practices before joining Incident Response Professional Certification Training in United States. - Information Security Fundamentals
Basic knowledge of information security principles, security controls, risk management, and organizational security practices is recommended for effective incident response training. - Networking Fundamentals
Understanding TCP/IP, DNS, HTTP/HTTPS, network protocols, firewalls, and network security concepts can help learners analyze and respond to network security incidents. - Operating Systems Knowledge
Familiarity with Windows and Linux operating systems, system processes, files, users, permissions, and basic administration is recommended for cybersecurity incident investigation. - Security Monitoring Knowledge
Candidates should have basic awareness of security monitoring, security alerts, logs, and event analysis to understand incident identification and response workflows. - Incident Management Awareness
A basic understanding of cybersecurity incidents, incident classification, escalation, documentation, and response procedures is beneficial for learners pursuing advanced incident response skills. - SIEM Fundamentals
Familiarity with SIEM concepts, security event correlation, log analysis, and alert investigation can support practical learning during Incident Response Certification Training in United States. - Threat and Attack Awareness
Candidates should understand common cyber threats, attack vectors, malware, phishing, ransomware, insider threats, and other security incidents encountered in enterprise environments. - Basic Digital Forensics Knowledge
Familiarity with evidence collection, preservation, file analysis, system artifacts, and forensic investigation concepts can help learners understand incident evidence gathering and analysis. - Cybersecurity Work Experience
Relevant experience in cybersecurity or information security is recommended for this advanced-level program. EC-Council currently identifies cybersecurity professionals with at least one year of experience among eligible ECIH candidates. - Analytical and Problem-Solving Skills
Strong analytical thinking and problem-solving abilities can help candidates investigate security events, identify indicators of compromise, analyze evidence, and determine appropriate incident response actions. - Commitment to Practical Cybersecurity Learning
Candidates should be prepared to participate in practical incident response exercises covering incident validation, triage, evidence gathering, containment, eradication, recovery, and post-incident activities.
Career value
Reasons to choose this course
Develop Advanced Incident Response Skills
Build practical expertise in incident detection, analysis, triage, containment, eradication, and recovery to strengthen your cybersecurity career in United States.
Master Cybersecurity Incident Investigation
Learn structured techniques for investigating security incidents, analyzing evidence, identifying threats, and supporting effective incident handling and response operations.
Strengthen Digital Forensics Knowledge
Develop practical knowledge of evidence gathering, forensic analysis, documentation, and preservation to support incident investigations and cybersecurity response activities.
Build Malware and Threat Response Expertise
Learn to handle malware incidents, analyze attack techniques, and apply systematic response procedures to strengthen your incident handling capabilities.
Enhance Network and Cloud Incident Handling Skills
Develop knowledge for responding to network, web application, cloud, endpoint, and other cybersecurity incidents across modern enterprise environments.
Prepare for Incident Response Career Roles
Build career-focused skills relevant to Incident Responder, Incident Handler, Cybersecurity Analyst, SOC Analyst, CSIRT Analyst, and Digital Forensics roles.
Advantages
Turn learning into practical capability
Hands-On Incident Response Training
Gain practical exposure to incident handling workflows and scenario-based exercises that help develop skills for responding to real-world cybersecurity incidents. EC-Council's ECIH program includes extensive hands-on labs.
Structured Incident Handling Methodology
Learn a systematic approach covering preparation, triage, notification, evidence gathering, containment, eradication, recovery, and post-incident activities.
Comprehensive Cyber Incident Coverage
Develop knowledge for responding to malware, email security, network security, web application, cloud, insider threat, and endpoint security incidents.
Forensic Evidence and Investigation Skills
Strengthen your ability to gather, preserve, document, and analyze forensic evidence during cybersecurity incident investigations and response activities.
Practical Security Tools and Frameworks
Gain exposure to incident handling tools, attack and defense frameworks, threat intelligence concepts, and security response techniques used in modern cybersecurity operations.
Certification-Focused Career Preparation
Develop structured knowledge aligned with the EC-Council Certified Incident Handler (ECIH) certification and build skills relevant to professional incident response and cybersecurity roles.
Exam format & assessment
- Exam Code: 212-89
- Number of Questions: 100
- Exam Duration: 3 Hours
- Test Format: Multiple Choice
- Exam Delivery: EC-Council Exam Portal
- Passing Score: EC-Council uses form-specific cut scores; the current official information states that these can range from 60% to 78%, depending on the exam form.
- Key Exam Areas: Incident handling and response, forensic readiness and first response, malware incidents, email security incidents, network security incidents, web application security incidents, cloud security incidents, insider threats, and endpoint security incidents.
- Eligibility: Candidates can qualify by completing official/authorized ECIH training. Candidates seeking to take the exam directly generally need at least one year of relevant work experience and must complete EC-Council's eligibility process.
- Exam Preparation: StepMerit Learning's Incident Response Professional Certification Training provides structured preparation covering incident detection, triage, evidence gathering, containment, eradication, recovery, and post-incident response.
Bring your learning together
Course conclusion
Incident Response Professional Certification Training in United States provides comprehensive knowledge and practical skills for identifying, investigating, containing, eradicating, and recovering from cybersecurity incidents. The course covers incident handling, digital forensics, malware response, email and network incidents, web application security, cloud incidents, insider threats, and endpoint security. With structured hands-on learning and certification-focused preparation, learners can develop job-ready incident response capabilities for modern cybersecurity environments. StepMerit Learning supports professionals with practical training designed to prepare them for incident response, cybersecurity, SOC, and security operations roles.
Target audience
- Incident Response Professionals
- Cybersecurity Professionals
- SOC Analysts and Security Operations Professionals
- Digital Forensics Professionals
- Information Security Professionals
- Network Security Professionals
- Cyber Defense Professionals
- IT Security Administrators and Engineers
- Cyber Intelligence and Threat Analysts
- Penetration Testing Professionals
- Risk and Vulnerability Professionals
- Cybersecurity Professionals Preparing for ECIH Certification
Verified learning evidence
Expertise, recognition and learner outcomes
Course-specific expertise
- 9+ Years of Cybersecurity & Incident Response Experience
- 2,000+ Hours of Professional Training Delivered
- 1,200+ Professionals Trained
- 120+ Corporate & Professional Training Sessions
- 75+ Practical Incident Response Labs & Case Studies
- 600+ Hours of Incident Response & Security Operations Training
- 200+ Incident Investigation & Response Exercises
- 8+ Industry Sectors Covered Through Training
Documented learner outcomes
Problem Statement
Manufacturing organizations depend on IT, OT, and ICS systems, where cyber incidents can disrupt production, safety, and business operations.
How We Overcame the Problem
Learners implemented structured incident response covering detection, analysis, containment, eradication, recovery, and reporting.
Overall Implementation
Learners implemented an end-to-end workflow for incident identification, evidence collection, investigation, containment, recovery, and lessons learned.
Evidence of Learning
Learners demonstrated skills in analyzing alerts, investigating incidents, collecting evidence, containing threats, and documenting response actions.
Manufacturing Incident Response Workflow
Security Event → Detection → Analysis → Incident Identification → Containment → Eradication → Recovery → Reporting
Incident Detection Implementation
Learners analyzed manufacturing network, endpoint, server, and OT/ICS security events to identify suspicious activity.
Incident Investigation Implementation
Learners investigated malware, unauthorized access, suspicious network activity, and compromised manufacturing systems.
Containment & Recovery Implementation
Learners applied controlled isolation, threat removal, system restoration, and recovery procedures to reduce operational impact.
Problem-Solving Evidence
Learners addressed ransomware, compromised accounts, malware, unauthorized access, and production-system disruptions through structured response procedures.
Comparative Evidence
Learners compared incidents based on severity, affected systems, operational impact, attack indicators, containment priority, and recovery requirements.
Overall Outcome
Learners demonstrated practical incident response skills for protecting manufacturing IT, OT, and ICS environments and supporting operational resilience.
Final Evidence
A manufacturing incident-response scenario, security alerts, investigation evidence, containment actions, recovery procedures, incident reports, and lessons-learned documentation provide evidence of practical competency.
Helpful answers for planning your training
Frequently asked questions
Incident Response Professional Certification Training is a cybersecurity program focused on incident handling and response, including incident detection, triage, evidence gathering, containment, eradication, recovery, and post-incident activities. The training is aligned with the EC-Council Certified Incident Handler (ECIH) certification.
The course is suitable for cybersecurity professionals, incident responders, SOC analysts, information security professionals, digital forensic professionals, network security professionals, cyber defense professionals, and other IT security professionals interested in incident handling and response.
Learner reviews
Rated by 2,654 learners
Rating and review totals are controlled per course in the CRM.
3.9out of 5
Popular cities in United States
Compare city information, course curriculum, exam details and ways to enquire.
Book with clarity
Clear pricing, protected approval and learner support
Approval before payment
A secure payment link is shared only after the CRM team confirms the request.
Live instructor-led delivery
Ask questions during the session and learn alongside a scheduled cohort.
Verified learner feedback
Published course feedback is linked to completed learner records and CRM approval.
Visible schedules
Review weekday and weekend dates, duration, timezone and seat availability before booking.