I've seen activity on the SANS Advisory board asking whether one of these courses or both should be taken. I've taken both. I don't work in information security in IT or OT, yet, so my opinion is formed based on the fact that I have no work experience in either field.
There is some overlap between the courses, as indicated on the SANS website. At first, this annoyed me a little, however, SANS does this for a purpose: One, repetition is one key to learning. Two, sometimes people have a lot of time between getting certs. SANS doesn't usually require prerequisites either, so they want to make certain that people understand the foundational material before diving into the more in depth stuff.
I found ICS to be easier. It was a lot of ICS terminology that I was unfamiliar with. The course covered Windows/Linux a small amount, but I didn't feel as though it was quite in depth about those particular operating systems as SEC 401. Don't get me wrong, SEC 401, still scratched the surface, because there is a lot to Windows and Linux that would be difficult to cover in a 6 day course.
The index writing to prepare for the cert for ICS was easier; Less material to cover. I usually try to put important notes along with the Topic, Book, Page, because I don't want to have to look through 5-6 books while I'm doing the exam. With some of the material, I was comfortable enough just to list the Topic, Book, Page. I was fairly certain that I knew it, but I just wanted to have that handy just in case something slipped my mind during the exam. (If you need help index writing, as I mentioned before, Hacks4Pancakes has a post on her blog with excellent advice.) I made a short post on here as well.
The index writing for SEC 401 is a nightmare. There's over 1K pages between all the books, not including the Lab Book! My instructor recommended 8 weeks to work on it. He wasn't kidding.
SANS gives good advice on their website. If you want to get into OT, then ICS 410 would be a good course for you. For those who regularly work in OT, you may consider a higher level course like ICS 515. For a good idea of what may be covered in ICS 410, look at write-ups for the SANS ICS Security Challenge by Robert M. Lee. I have one here, (It's a Multi-Part Write Up, so you'll have to look at my other posts), or you can Google search write-ups by other people. ICS 410 does not cover memory or traffic analysis, so as far as that challenge goes, it's about up to the 300 Level Questions. Remember that that probably doesn't cover everything that is in the class; the class and technology changes over the years, it's just an idea of what you might expect from ICS 410.
SEC 401 was a breeze to begin with. A lot of material that I'd already read between SEC 301 and ICS 410. It isn't difficult per say, just a lot of settings to remember on Days 5 and 6 between Windows and Linux. If you're comfortable with either environment (or both), it should make your studying easier. There may be things that you are unaware of tucked away in those books, so I'd at least skim the pages. I'm not deeply familiar with either, so this was completely new to me. One more note: The course author made this course very repetitive. Some subjects are covered more than once. This is done on purpose. If you repeat it, you're more likely to remember it. (Oddly enough, I knew more Linux than Windows. I guess it makes sense, considering I've been studying open-source tools via Linux. Been playing with Bash on Windows. Wonder if I can install Remnux/SIFT on there?)
If you want to get into IT, obviously, SEC 401 is probably best for you, but be prepared because it is a long bootcamp style course with hours from 9 AM - 7 PM. Then there's the 8 weeks working on the index. (Seriously, it's no joke.) Good luck.
As for which cert GICSP or GSEC. Depends on what you want to do. GICSP for OT. GSEC for IT. GSEC seems to be more widely known, though, so you might consider your marketability for seeking jobs now or future jobs as a factor to weigh in this decision.
