GRC Analyst

GRC sits at the intersection of security, audit, and business risk. GRC Analysts translate frameworks (ISO 27001, NIST CSF, SOC 2, PCI-DSS) into operational controls, run risk assessments, manage third-party assurance, and own evidence collection for audits. It is one of the fastest-growing entry routes into cyber for candidates from audit, consulting, law, or compliance backgrounds. ## Career milestones ### Year 0 (entry) — Junior GRC Analyst / Risk Analyst _Salary: £32k–£42k_ Evidence collection, control walkthroughs, third-party vendor questionnaires, supporting ISO/SOC 2 audits. ### Year 1–2 — GRC Analyst / Information Security Analyst _Salary: £45k–£60k_ Run risk assessments, own a control domain end-to-end, support Stage 1/2 audits, manage policy lifecycle. ### Year 3–4 — Senior GRC Analyst / GRC Consultant _Salary: £60k–£80k_ Lead client-facing ISMS implementations, draft Statement of Applicability, present to risk committees. ### Year 5+ — GRC Manager / Head of GRC _Salary: £80k–£120k_ Own the GRC programme, manage 3–8 analysts, brief CISO and risk committee, choose GRC tooling (Vanta, Drata, OneTrust, ServiceNow GRC). ## Core skills - ISO 27001 ISMS clauses 4–10 + Annex A - NIST CSF 2.0 functions - SOC 2 Trust Services Criteria - Risk register design (likelihood × impact, treatment options) - Evidence collection automation (Vanta/Drata/Hyperproof) - Audit interviewing technique - Policy writing in plain English - GDPR + UK Data Protection Act ## Recommended certifications - `security-plus` - `iso-27001` - `cism` - `crisc` - `cissp` ## First 90 days in the role Map every control in your scope to an owner and an evidence source. Build a risk register from scratch (or rebuild the inherited one). Sit in on every audit walkthrough — silently for the first month, then leading from month 2. ## Common pitfalls Becoming a checklist robot. Senior GRC roles reward people who can argue a risk position to a non-technical executive, not people who can recite Annex A controls. Practise translating a control gap into 'what is the business impact and what would mitigate it?'