Pivoting from infosec to a DFIR focus?
Hi all. I’m getting out of a six year stint in the army in a few months, and I basically have a few years of threat hunting / IR experience behind me. I spent a lot of time hunting on ICS networks which meant I was basically pulling images with FTK and then doing log/memory analysis from there. I want to pivot into more DFIR specific work, but I’m not sure the best way to build on my experience. I can’t afford a SANS course, and I planned on going through 13cubed’s courses, but I sorta was wondering if there was a better alternative as I think I probably already know a decent amount of what’s in them.
If someone like me had $1.5/$2k to spend on training or a cert, what would be my single best option? I’d like good training as a basis, but I’d also like to be able to put a cert on my resume if it helps me get through the HR filters in the future.
I know this is an annoying question, so I apologize in advance. If anyone has any solid advice I’d really appreciate it though. Have a good night!