Boardroom Forum invitations open this summer
IRC Incident Response Consortium Est. 2017 Join the community
Home/Training/Learning paths/Moving from IT into IR
Path 02 · 8 steps · 4 to 6 weeks alongside the day job

Moving from IT into IR

“I am moving from IT into IR, what’s the route”

The route

Work top to bottom.

Every step opens something already published on this site. Skip what you already know; the order matters more than the completeness.

01
Read IRC blog

What is incident response

Start with the map. IR reuses most of what you know; this shows where it fits.

02
Read Books and frameworks

SANS Incident Handler's Handbook

The classic bridge document for people with systems skills. Short, practical, and speaks fluent sysadmin.

03
Do Playbook Policy Engine

Work the Unauthorized Access and Elevation of Privilege playbooks

The two playbooks closest to your existing instincts. You already know the systems; these add the response discipline.

04
Do Practitioner Runbooks

Business email compromise: contain, assess, recover

The Runbook where IT administration maps most directly to response. If you have run a mail tenancy, you are halfway there.

05
Read Document library

Incident Response Plan and Security Incident Response Procedures

What an IR programme looks like on paper. Read both from the document library, then compare with what your current employer has.

06
Read Practitioner Runbooks

The post-incident review that changes things

The habit that separates IR professionals from firefighters. Also the best interview answer you will ever give.

07
Read Tooling

The useful links index

The tooling and reference material practitioners actually use. Pick two tools and learn them properly rather than ten superficially.

08
Join IRC community

Apply for Practitioner membership and a mentor

A mentor who made the same move is worth more than any course. Ask for one.

Other routes

Not your stage?