Governance, risk and compliance (GRC) analysts are often hired to "own the audit", then judged on whether controls actually work, and many people enter the role without knowing which of those two jobs they have taken. This guide explains what a GRC analyst does day to day, the skills and tools that separate a document chaser from a trusted risk adviser, realistic routes in, the certifications that fit each stage, and where the role leads. It is written for people moving into GRC from IT, audit, legal or security operations, for analysts planning their next step, and for managers building a GRC team. The broad map of security roles is in the Cybersecurity Careers Guide; this page stays on GRC.
Key takeaways
- Evidence beats paperwork. The analysts who progress test whether a control operates, not only whether a policy exists, and can show the sample, the result and the exception.
- Frameworks are a shared language, not the job. Knowing ISO/IEC 27001:2022, NIST CSF 2.0, SOC 2 and the regulations your sector faces is the entry ticket; translating them into owners, tests and decisions is the work.
- Technical literacy is now expected. Cloud access reviews, identity controls and log evidence sit at the centre of most audits, so an analyst who can read an IAM policy or an access export is far more useful.
- Pick a certification for the stage you are at. CRISC suits risk work, CISA suits assurance and audit, ISC2 CGRC suits authorisation programmes, and CGEIT or CISM come later for governance leadership.
- Progression splits three ways. Most GRC careers move towards risk management, assurance and audit, or security governance leadership; decide which by your second year.
What the role does
NIST's NICE Framework task and knowledge statements describe the core of the work: "Assess the effectiveness of security controls" (T0309), determining the effectiveness of organisational cybersecurity policies and procedures (T1358), checking that acquisitions, procurement and outsourcing address cybersecurity requirements (T1369), and creating cybersecurity policies and procedures (T1543), backed by knowledge of risk management processes (K0675) and of cybersecurity laws and regulations (K0676). In practice a GRC analyst spends a typical week across four streams.
| Stream | Typical tasks | Outputs |
|---|---|---|
| Governance | Draft and review policies and standards, track exceptions, prepare committee papers, keep the control library current | Policy set, exception register, steering committee pack |
| Risk | Run risk workshops, score likelihood and impact, agree treatment with owners, chase overdue actions | Risk register entries, treatment plans, risk appetite reporting |
| Compliance and assurance | Map controls to frameworks, collect and test evidence, run internal audits, support external auditors | Control test results, statement of applicability, audit findings tracker |
| Third-party risk | Issue and assess security questionnaires, review supplier SOC 2 reports and ISO certificates, agree contract clauses | Supplier risk ratings, remediation conditions |
The balance depends on the employer. In a regulated bank the role leans to control testing and regulatory mapping (for example DORA in the EU; see the DORA Guide). In a SaaS scale-up it is often SOC 2 and ISO 27001 certification plus customer questionnaires. In US federal work it is the Risk Management Framework and system authorisation. At a consultancy you run the same tasks for many clients with less depth in each.
A worked example: an access control test
- Define the control: "Access to production systems is reviewed quarterly by the system owner and leavers are removed within one working day."
- Get the population: an export of production accounts and the HR leavers list for the period, generated by the system, not typed by a person.
- Sample and test: pick leavers and compare termination date with account disable date; check the review sign-off is dated and covers every account, including service accounts.
- Record exceptions: each late removal, orphaned account or unowned service account, with the owner's explanation.
- Rate and report: agree the finding rating and a remediation date, then retest.
That last point about service accounts is where many reviews fail: machine accounts, API keys and AI agent credentials are often outside the review population entirely. See the Access Reviews Guide and the NHI Ownership Guide.
Core skills and tools
| Skill | What good looks like | How to build it |
|---|---|---|
| Framework fluency | Can explain ISO/IEC 27001:2022 clauses 4 to 10 versus Annex A, the six NIST CSF 2.0 functions, SOC 2 trust services criteria, and how they overlap | Build your own mapping of ten controls across three frameworks. See the Control Mapping Guide |
| Risk assessment | Writes risks as cause, event and consequence; scores consistently; challenges owners on treatment | Rewrite twenty vague register entries. See the Risk Register Template |
| Control testing | Tests design and operating effectiveness, samples from system-generated populations, documents exceptions | Shadow an internal audit; reperform one test end to end |
| Technical literacy | Reads a cloud IAM policy, an access export, MFA and logging settings; knows what a service account is | Free cloud tenant; review its IAM and audit logs. See the Cloud IAM Review Checklist |
| Regulatory reading | Reads the primary text (EUR-Lex, regulator sites), not summaries, and tracks status changes | Summarise one regulation applicable to your sector from source |
| Writing and influence | Findings a manager can act on: condition, criteria, cause, effect, recommendation | Write every finding in that five-part form |
| Data handling | Spreadsheet skills (lookups, pivot tables), basic SQL or scripting to compare populations | Automate one evidence comparison |
Tools: most teams run a GRC platform for the control library, risk register, policy attestations and audit workflow, plus compliance automation that pulls evidence directly from cloud, identity and ticketing systems. Learn the concepts rather than one product: objects (risk, control, test, issue), workflows and integrations. See the GRC Platform Buyer's Guide and the Audit Evidence and Continuous Controls Monitoring Guide.
AI in GRC: AI governance is now a GRC deliverable in its own right, covering AI inventories, impact assessments and supplier AI risk. Analysts who understand the EU AI Act, ISO/IEC 42001 and AI agent identity risks are in short supply. See the AI Governance Guide.
Routes into the role
GRC is one of the few security disciplines with several genuine non-technical entry points. Common routes, and what each needs to add:
| Background | Strength you bring | Gap to close |
|---|---|---|
| IT service desk or system administration | Knows how access, patching and backups really work | Framework language, risk scoring, finding writing |
| Financial or internal audit | Sampling, evidence standards, independence | Technical controls, cloud and identity basics |
| Legal, privacy or compliance | Reading regulations, contract clauses | How controls are implemented and tested |
| SOC or security engineering | Credibility on technical controls and incidents | Risk methods, stakeholder management, patience with process |
| Graduate or apprenticeship | Fresh training, often a structured rotation | Real evidence of control testing |
The US Bureau of Labor Statistics groups much of this work under information security analysts, an occupation it says typically needs a bachelor's degree, with a median wage of $129,180 in May 2025 and projected employment growth of 21% from 2025 to 2035. That category is broad, so treat it as context rather than a GRC salary.
A step-by-step plan for your first GRC role
- Months 0 to 2: read ISO/IEC 27001:2022 and NIST CSF 2.0 at source; build a ten-control mapping.
- Months 2 to 4: volunteer for evidence collection in your current job (an access review, a supplier questionnaire, a policy refresh).
- Months 4 to 6: write three sample findings and one risk assessment as portfolio pieces with any confidential detail removed.
- Months 6 to 9: take an entry certification if it helps you past screening (for example ISC2 Certified in Cybersecurity), then apply internally or to SOC 2 heavy employers that hire juniors.
- Check yourself: if interviews stall on technical questions, spend a month on cloud IAM and logging; if they stall on process, shadow an auditor.
Certifications that help
Facts below are from each body's own pages, checked 24 October 2026; confirm current outlines and fees before booking. The table describes fit, it is not a ranking.
| Certification | Body | Content areas (official) | Best fit |
|---|---|---|---|
| CRISC | ISACA | Corporate IT Governance; Risk Assessment; Risk Response and Reporting; Technology and Security | Risk analysts and IT risk managers. See the CRISC Certification Guide |
| CISA | ISACA | IS Auditing Process; Governance and Management of IT; IS Acquisition, Development and Implementation; IS Operations and Business Resilience; Protection of Information Assets | Assurance, internal and external IT audit. See the CISA Certification Guide |
| CGRC | ISC2 | Seven domains (outline effective 15 June 2024) from GRC programme through scoping, control selection, implementation, assessment, system compliance and compliance maintenance; two years' experience required | RMF and system authorisation work |
| CGEIT | ISACA | Governance of Enterprise IT; IT Resources; Benefits Realization; Risk Optimization | Later career, governance leadership. See the CGEIT Certification Guide |
| ISO 27001 Lead Implementer or Lead Auditor | Various accredited training bodies | ISMS implementation or audit to ISO/IEC 27001 | ISMS roles and certification audits. See the ISO 27001 Lead Auditor and Lead Implementer Guide |
| CISM, CISSP | ISACA, ISC2 | Security management; broad security body of knowledge | Senior and management roles. See the CISM Certification Guide and CISSP Certification Guide |
ISACA lists the CRISC, CISA and CGEIT exam fee as US$575 for members and US$760 for non-members, plus a US$50 application processing fee after passing, and gives five years from passing the exam to apply for certification. ISC2 states CGRC is accredited under ISO/IEC 17024 and approved under US DoDM 8140.03.
Decision guidance: if your work is mostly registers and treatment plans, CRISC first; if it is mostly testing and audit support, CISA first; in US federal or defence work, CGRC; if you will run an ISMS, an ISO 27001 implementer course gives the most immediate value. Small organisations value one broad certification and hands-on breadth; large ones expect the specialist credential matching the team you join. More options are compared in the Cybersecurity Certifications Guide.
Progression
| Path | What changes | Build now |
|---|---|---|
| Senior GRC analyst, then GRC lead | Owns the control framework and audit calendar, manages analysts | Audit planning, stakeholder management, metrics |
| Risk management | Enterprise or technology risk, risk appetite, quantification | ISO 31000, NIST SP 800-37 RMF, scenario analysis. See the ISO 31000 Risk Management Guide |
| Assurance and IT audit | Independent testing, second or third line, external audit | Sampling, audit standards, CISA |
| Third-party and supply chain risk | Owns supplier programme and concentration risk | Contract clauses, SOC 2 report reading. See the Third-Party Risk Management Guide |
| Privacy | Data protection officer or privacy manager | GDPR, DPIAs, records of processing |
| AI and identity governance | Governs AI systems, AI agents and non-human identities | AI inventories, NHI ownership and access reviews. See the NHI Governance Maturity Model |
| Security governance leadership | Head of GRC, deputy CISO, CISO | Board reporting, budget, programme design. See the Board Cyber Risk Reporting Guide |
Framework mapping
| Framework | Where GRC analyst work sits |
|---|---|
| NIST CSF 2.0 | Govern: GV.RM Risk Management Strategy, GV.PO Policy, GV.OV Oversight, GV.SC Cybersecurity Supply Chain Risk Management; Identify: ID.RA Risk Assessment |
| NIST SP 800-53 Rev. 5 | CA-2 Control Assessments, CA-7 Continuous Monitoring, RA-3 Risk Assessment, PM-9 Risk Management Strategy |
| NIST SP 800-37 Rev. 2 | Risk Management Framework: categorisation, control selection, implementation, assessment, authorisation and continuous monitoring |
| ISO/IEC 27001:2022 | Clause 6.1 risk assessment and treatment, clause 9.2 internal audit, clause 9.3 management review, plus the statement of applicability |
| NICE Framework | Task and knowledge statements for control assessment and policy and planning (T0309, T1358, T1543, K0675, K0734) |
Measuring your progress
- Repeat findings: share of audit findings that recur year on year in your areas, falling.
- Remediation on time: percentage of findings and risk actions closed by the agreed date.
- Evidence automation: share of controls with system-collected rather than screenshot evidence.
- Exception hygiene: number of policy exceptions past their expiry date.
- Stakeholder pull: how often teams ask you in at design stage rather than at audit.
Common failure patterns
- Checkbox compliance: a certificate on the wall while the controls behind it fail. Several firms breached in recent years held certifications; the Snowflake breach campaign succeeded against customer accounts without MFA, a control most audit frameworks expected.
- Testing only human accounts: access reviews that exclude service accounts, API keys and tokens miss the identities attackers increasingly use.
- Screenshots as evidence: point-in-time images that cannot prove the control operated across the period.
- Risk registers nobody reads: vague entries with no owner, no date and no link to decisions.
- Reading summaries instead of the law: obligations get misstated when status changes are missed.
- Staying non-technical: analysts who cannot discuss how a control is implemented lose credibility with engineering and stall.
Practitioner checklist
- Read ISO/IEC 27001:2022, NIST CSF 2.0 and one sector regulation at source, not via summaries.
- Build a personal control mapping across at least three frameworks.
- Reperform one control test end to end, from system-generated population to rated exception.
- Write findings in condition, criteria, cause, effect and recommendation form.
- Learn to read a cloud IAM policy, an access export and an MFA configuration.
- Include service accounts, API keys and AI agent credentials in every access review you touch.
- Choose one certification that matches your current work: CRISC, CISA, CGRC or an ISO 27001 course.
- Track repeat findings and remediation on time as your own performance measures.
- Decide by year two whether you are heading to risk, assurance or governance leadership.
Standards and references
- CISA NICCS: NICE Framework, Security Control Assessment work role
- NIST: SP 800-37 Rev. 2 Risk Management Framework for Information Systems and Organizations
- NIST: Cybersecurity Framework 2.0
- ISO: ISO/IEC 27001:2022 Information security management systems, Requirements
- ISACA: CRISC Certification
- ISACA: CISA Certification
- ISC2: CGRC Certification Exam Outline
- US Bureau of Labor Statistics: Information Security Analysts, Occupational Outlook Handbook
Related NHI Mgmt Group resources: Cybersecurity Careers Guide · GRC Maturity Model · ISO 27001 Certification Guide · SOC 2 Guide · NIST CSF 2.0 Guide