Learn/Governance, Risk & Compliance (GRC)

Set direction and assurance

Governance, Risk & Compliance (GRC)

Translate security into frameworks, evidence and risk decisions that auditors, customers and executives accept.

Entry barrier: MediumFirst role: 6 to 18 months from audit or compliance$154k–$322k/yrtypical now

Looking for the salary side? Pay, the employers hiring and open GRC roles, together on one page.

The job, briefly

GRC (governance, risk and compliance) is the side of security that sets policy, measures risk and proves to outsiders that controls work. GRC analysts and engineers run compliance programs such as SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and CMMC, collect evidence and guide audits, assess the risk of new systems and vendors, answer customers' security questionnaires and keep the policy library current. It is one of the few security specialties where organization and writing weigh as much as technical depth.

Day to day

Map the organization's controls to frameworks such as SOC 2, ISO 27001, NIST CSF or NIST SP 800-53
Collect and organize audit evidence, then support external auditors through fieldwork
Run risk assessments on systems, changes and business decisions, and keep the risk register current
Review vendors' security before contracts are signed, and reassess the critical ones every year
Answer security questionnaires from customers and prospects, often through a public trust center
Write and update policies, and check that teams actually follow them

Worked examples

Prepare for a first SOC 2 Type II audit

Your company needs a SOC 2 report to win larger customers. You choose the trust services criteria in scope, map existing practices to controls and find the gaps (no formal access reviews, no written incident response plan, inconsistent offboarding), then work with engineering and HR to close them before the observation period begins. You connect a compliance automation tool such as Vanta or Drata to gather evidence automatically and guide the auditors through fieldwork, answering their requests from what you collected.

Assess a new vendor

Marketing wants an analytics tool that will receive customer email addresses. You request the vendor's SOC 2 report and read its exceptions and complementary user entity controls, check where data is stored and for how long, confirm it supports SSO and look for past breaches. The report shows one exception in change management; you rate the vendor medium risk, require SSO and a data processing agreement and set a date to reassess.

Answer a security questionnaire

A prospective customer sends a long questionnaire based on the SIG Lite. You answer from your control library and earlier responses, ask engineers to confirm the handful of answers that have changed, attach your SOC 2 report under NDA and disclose one honest gap with a remediation date. The deal moves faster, and the new answers go into the library for next time.

Who does well here

GRC suits organized people who write clearly and like turning vague requirements into concrete checklists. Common backgrounds include IT audit, financial audit, compliance, legal and privacy work, project management and IT administration. You need enough technical understanding to judge whether a control really works and to talk credibly with engineers, but not the ability to build the systems yourself.

Signs it suits you

You enjoy structure: frameworks, checklists and evidence that stands up to scrutiny
You can explain a requirement to an engineer clearly and without condescension
You can keep many deadlines, owners and documents moving at once
You are curious enough to ask how a control actually works, not only whether it exists

Requirements

Familiarity with at least one major framework (SOC 2, ISO 27001, NIST CSF, PCI DSS) and with how audits run
Strong writing and organization, and comfort working with legal, HR and engineering teams
A security baseline such as Security+ helps career changers show they understand the controls they assess; CISA, CRISC, ISO 27001 Lead Auditor and CGRC come into play with experience

Useful skills

SOC 2, ISO 27001 and NISTAudit management and evidenceRisk assessment and registersThird-party risk managementPolicy writingCompliance automation tools

A route in

1Learn the main frameworks by reading them: the SOC 2 trust services criteria, ISO 27001 Annex A and NIST CSF 2.0 are a good start
2Earn Security+ for the technical baseline, then an audit or risk credential once you have the experience it asks for (CISA wants five years of relevant work with up to three waivable, CRISC three years)
3Look for compliance work inside your current job, such as audit support, policy updates, vendor reviews or access reviews
4Build a small portfolio: a sample risk assessment, a policy you wrote and a control mapping between two frameworks
5Apply for GRC analyst, IT audit, compliance analyst and third-party risk roles; audit firms and compliance automation companies regularly hire juniors
6Add technical depth over time, such as cloud fundamentals or scripting, which leads toward GRC engineering roles that automate evidence and controls

Myths and reality

Myth: GRC is paperwork for people who are not technical.

Reality: The best GRC people understand systems well enough to tell a real control from a checkbox. Engineers respect a GRC analyst who can read a cloud configuration or a log export, and the field is moving toward automated evidence and controls written as code.

Myth: Passing an audit means the company is secure.

Reality: An audit shows that defined controls operated during a period. It does not prove they were the right controls or that attackers cannot get in. Good GRC teams treat compliance as a floor and steer effort toward the risks that matter most.

Myth: GRC is a career dead end.

Reality: It leads into risk management, privacy, security program management, audit leadership and CISO roles, many of which put communication and business judgment first. Plenty of security leaders started on the governance side.

Salary

Salary ranges on open GRC roles currently center on $154k–$322k/yr. The median sits at $176000, measured over the 126 openings that publish a range.

Salaries, employers and open GRC roles Every kind of security work, side by side →

Questions career changers ask

Can I get into GRC without a technical background?

Yes, more readily than into most security specialties, particularly from audit, compliance, legal or project management work. You will still need enough technology to assess controls credibly, so pair your existing strengths with a security baseline such as Security+ and keep learning how the systems you assess work. Current openings are on the GRC roles page.

SOC 2 or ISO 27001: which is which?

SOC 2 is an attestation report issued by a CPA firm under AICPA standards, common with US customers, describing controls against the trust services criteria. ISO 27001 is an international certification of an information security management system, more common in Europe and with global customers. Many companies hold both, and their controls overlap heavily.

What is GRC engineering?

A newer branch that applies engineering to compliance: pulling evidence automatically through APIs, writing controls as code, building dashboards of control health and adding compliance checks to pipelines. It suits people who combine GRC knowledge with scripting or cloud skills, and sits between this guide and security engineering.

Which GRC credential is worth earning first?

Security+ is a sensible first step for career changers. After a few years, CISA suits audit-leaning paths, CRISC suits risk management, ISO 27001 Lead Auditor or Implementer suits ISO-heavy employers and CGRC suits US federal work. CISSP becomes relevant for senior roles and for security leadership.