The work itself
What you would spend time doing
Translate obligations into controls, examine evidence and explain gaps to decision-makers. This route focuses on governance, risk and assurance; hands-on identity engineering has its own route.
Governance & risk
GRC (Audit, Risk, Compliance)
Governance and risk work that connects control evidence to accountable decisions.
Explore the work, check your starting point and try one scoped task before committing to a course or exam.
Try this pathway in practiceThe route
Where this route starts: GRC Analyst
A general route, not a personal plan. Linked guides describe the broader role family; a junior or support starting point may have a narrower remit. Compare the responsibilities with the actual vacancy.
Phased progression
Build foundations, demonstrate the work, then choose how to deepen or broaden your responsibility.
Progress through demonstrated capability and agreed responsibility. These stages are not a fixed timetable or a salary ladder.
Build the foundations
Foundations
Practical focusBuild literacy and lab habits. These are study options, not mandatory exams; choose the platform relevant to your target work.
Something to demonstrateA short account of what you can already do and the next gap to investigate.
In focus CGRC · ISO 27001 Lead Implementer
Demonstrate readiness
First role in this route
Practical focusExplore GRC Analyst responsibilities. Check the supervision and prior experience expected; demonstrate the relevant work before increasing your scope.
Something to demonstrateA requirement-to-evidence matrix and risk note with an owner, proposed action and verification method.
In focus GRC Analyst
Demonstrate reliable practice
Specialisation
Practical focusTake on a scoped responsibility, test your decisions and collect feedback. Add a credential only where it supports that work.
Something to demonstrateA test record and feedback showing how you improved a piece of work.
In focus CRISC · CISA
Broaden responsibility
Deepen, lead or move sideways
Practical focusGRC Manager, Security Manager, or CISO-track. Judgement, board reporting, programme ownership.
Something to demonstrateExamples of broader ownership, with the scope and responsibility agreed.
In focus CISSP
Your starting point
What to bring to this route
Build clear writing, evidence evaluation and enough technical context to question a control claim. Prior audit, operations or business experience may provide relevant examples.
Ask a course provider or employerDoes the role test controls and influence decisions, or mainly collect documents for audits?
The verdict
You're good at writing for non-technical audiences. You can hold a control framework in your head without losing the plot.
Framework paperwork can become detached from actual operation. Clarify access to evidence, relationships with control owners and how unresolved risk reaches a decision-maker.
Certification sequence
Study options, not a checklist. Choose for the work you need to demonstrate, then check the provider’s current requirements and renewal terms.
Primary
Explore these first
Compare the subject with the work you want to do. Check eligibility before committing.
- ISO 27001 Lead ImplementerPlanning, implementing and improving an information security management system against ISO/IEC 27001.
- CRISCIdentifying and assessing technology risk, choosing responses and monitoring whether controls are doing their job.
- CISAAuditing information systems: planning the work, testing controls and evaluating governance, delivery and operations.
- CISMSecurity governance, risk management, programme management and managing the response to incidents.
Supporting
For a particular platform or gap
Choose one when its syllabus addresses a gap you need to practise.
Long-term
As your responsibility grows
Revisit when your scope changes. Experience and renewal requirements still apply.
Practical projects
Produce something you can explain, test and improve with feedback.
A scoped starting exercise
Try the work before choosing the route
Take a fictional access-review policy and three sample evidence items. Decide which requirements are supported, identify a gap and propose a proportionate improvement.
What to keepA requirement-to-evidence matrix and risk note with an owner, proposed action and verification method.
Free text worksheet · no account needed. Add your checks, results and feedback as you work.
Review the evidence
- Does the evidence demonstrate the control operating, rather than just a policy existing?
- Is the recommendation proportionate, with a named decision-maker and a way to verify closure?
Label planned, simulated and completed work accurately. A practice exercise helps you test your interest and reasoning; it does not establish production experience or guarantee an interview.
Compliance SpecialistRisk AnalystSecurity Manager
- ·Internal audit → security audit pivot
- ·PM → security PM → GRC
Realistic expectations
Check these assumptions against the course, vacancy or team you are considering.
Misconception
That a title or credential establishes readiness by itself. GRC readiness depends on interpreting requirements, evaluating evidence and communicating risk.
Readiness check
GRC readiness depends on interpreting requirements, evaluating evidence and communicating risk. Audit, operations and business experience can contribute. Identity engineering is a related but distinct technical remit.
What this is based on
Editorial route and career guidance. No separate external evidence review is recorded for this assessment.
Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.
Where this fits