Skip to main content
TechWaymark

Classroom mode. Nothing is saved to this machine and no personal detail is asked for.

Leave classroom mode
A governance analyst reviews a control spreadsheet and a policy document
Cybersecurity Used in TechWaymark Education

GRC Analyst

Turns security frameworks and risk into decisions the business can make, and evidence an auditor will accept.

Could I move into this role? See a day in the role

Role at a glance

The shape of the job

Typical UK pay£32–40k entry · £52–68k senior
ExperienceEntry to mid career
Work patternHybrid is common
Technical depthModerate, broad
People contactVery high
HoursOffice hours, busier around audits

Pay bands are TechWaymark practitioner estimates for UK roles, reviewed 2026-09, not survey data. They vary by region, sector and employer.

What the GRC Analyst role involves

  • You map what the organisation does against a framework such as ISO 27001, Cyber Essentials or NIST.
  • You collect and check evidence that controls actually work, not just that a policy says they should.
  • You maintain the risk register: what could go wrong, how likely, how bad, who owns it and what's being done.
  • You chase. Remediation actions, overdue reviews and supplier questionnaires don't finish themselves.
Read TechWaymark's full role verdict and reasoning
TechWaymark verdict

Governance and risk work that connects control evidence to accountable decisions.

Domain
Cybersecurity
Entry
£32–40k
Senior
£52–68k
Pick this if
  • You're good at writing for non-technical audiences
  • You can hold a control framework in your head without losing the plot
  • You're patient with calendars, evidence, and meetings about meetings
  • You want regular hours and no pager
Skip this if
  • You came into security because you wanted hands-on work
  • You can't bear repetitive evidence gathering during audit season
  • You think GRC is a soft entry into pentest or detection, the lateral move is hard

What "doing well" looks like in the seat

  • Auditors trust your evidence the first time, every time
  • Engineering teams come to you before they ship, not after
  • Your risk register reflects reality, not optimism
  • You can translate a finding into a control change without losing nuance
The bit you're probably underestimating

Framework paperwork can become detached from actual operation. Clarify access to evidence, relationships with control owners and how unresolved risk reaches a decision-maker.

Printed audit evidence with sticky notes beside a laptop
Evidence is the job. A control without proof is a claim.

Illustrative

A day in the role

  1. Chase three control owners for evidence due before next week's audit
  2. Review access review evidence. Hundreds of approvals, all within two minutes. Flag it
  3. Supplier security questionnaire for a new payroll provider. Check answers against their certificate
  4. Risk workshop with the IT manager about an unsupported server that can't be patched
  5. Write the risk exception: what's accepted, by whom, with what conditions and review date
  6. Update the ISO 27001 statement of applicability after a control change

An example day. Roles and organisations vary, and no two days match.

Day to day

What you'll work with

Frameworks

ISO 27001Cyber EssentialsNIST CSFUK GDPR

Tools

GRC platforms or well-kept spreadsheetsRisk registersPolicy managementSupplier assessment tools

Concepts

Control design vs operationRisk appetiteEvidence samplingExceptions and acceptance

Hiring reality

What employers actually expect

Must understand

  • Clear, precise writing
  • Can challenge evidence politely but firmly
  • Understands risk as likelihood and impact
  • Organised enough to run many actions at once

Commonly expected

  • Working knowledge of ISO 27001
  • Enough technical understanding to question IT teams
  • Experience with audits, internal or external
  • A cert such as ISO 27001 Lead Implementer or CISM later on

Sets you apart

  • Prior technical work (support, sysadmin, SOC)
  • Having run a control from design to audit
  • Writing risk in business language
  • Data protection experience

What this role isn't

It isn't box-ticking, and it isn't a non-technical way into security. The good GRC analysts can tell when evidence is theatre, and that takes knowing how the systems work.

How the role changes with seniority

1Junior

Collects evidence, maintains registers, supports audits and supplier assessments.

2Experienced

Owns controls and risk areas, runs audits, advises teams on meeting requirements.

3Senior / lead

Shapes the risk programme, reports to senior leadership, negotiates risk acceptance.

An analyst interviews a system owner across a meeting table
Much of the work is conversations with people who'd rather be doing something else.

Nobody puts this in the advert

The hard parts

The asymmetry

Lots of applicants, few with technical depth. Without it, you compete in a crowded pool.

Chasing people

Much of the week is follow-up. Some control owners treat you as an obstacle.

Paper vs reality

Policies often describe an organisation that doesn't exist. Spotting the gap can be unpopular.

Audit peaks

Workload is uneven. Audit months are intense.

More than one way in

How people actually get into it

From a technical role

Support, sysadmin or SOC first gives you the credibility employers struggle to find.

From audit, risk or compliance

Finance and legal compliance people move across, then learn the technology.

Graduate scheme

Consultancies and the Big Four run cyber risk intakes.

Apprenticeship

Some cyber apprenticeships include a governance pathway.

Evidence employers value

"Knows ISO 27001"

A gap assessment of a small organisation against a handful of controls, with evidence you'd ask for

"Detail-oriented"

An example of evidence you rejected and why it didn't prove the control worked

"Good communicator"

A one-page risk summary written for a non-technical director

Projects that prove it

Small pieces of work you can do on your own, and what each one shows an employer.

Run a mini gap assessment

2-3 evenings

Pick five Cyber Essentials requirements and assess a small organisation you know (a club, a family business, your own setup). Record the gaps and the evidence you'd need.

What it demonstrates

Framework interpretationEvidence thinkingPlain reporting

Write a risk register entry properly

1 evening

Choose a real-sounding risk, such as an unsupported server. Write likelihood, impact, owner, treatment, and a risk exception with conditions and a review date.

What it demonstrates

Risk articulationOwnership and accountabilityBusiness language

Challenge a piece of evidence

1 evening

Take a screenshot or report that claims a control works. Write what it does and doesn't prove, and what you'd ask for instead.

What it demonstrates

Critical reviewControl design vs operationProfessional challenge

Your next hops

Where GRC Analyst can take you

GRC AnalystRisk AnalystSecurity Manager

Other common branches

Compliance SpecialistSecurity ArchitectCISO

There is no single ladder. See the routes on the Atlas.

See the pathway to GRC Analyst

Worth the effort?

Certifications that complement it

CISSP

Relevant to the route into this role.

See certification verdict CISM

Management-focused security cert. More useful a few years in than as a first step.

See certification verdict SecurityX (formerly CASP+)

Relevant to the route into this role.

See certification verdict ITIL 4 Foundation

Relevant to the route into this role.

See certification verdict CEH

Relevant to the route into this role.

See certification verdict CRISC

Risk-specific and well regarded in GRC teams, particularly in financial services.

See certification verdict ISACA CISA

The audit credential. Fits if your GRC work leans towards assurance and audit.

See certification verdict (ISC)² CGRC

ISC2's governance cert. Newer, less often requested in the UK, but closely aligned to the day job.

See certification verdict

Interview reality

Questions you may be asked

Loading questions…

Practise with model answers in My Waymark

For educators

Used in TechWaymark Education

These modules use this page as investigation material in the classroom.

  • 1
    Technology is not one career

    An example of work that mainly protects systems, through decisions rather than tools

Where this fits

Roles connect to pathways, certs and other roles. Use one to test the next.

Roles to consider

Further reading

Could you realistically get here from where you are?

The Guided Route compares your background with this role and shows the honest route, hop by hop.

Try the free Guided Route About the Career Verdict

Last reviewed 2026-09. Photographs are illustrative.