How to Become a GRC Analyst: What 194 Open Compliance and Risk Roles Ask For

What governance, risk and compliance work involves from one week to the next, what 194 open GRC postings asked for and paid on 12 November 2026, and the routes that lead into a first seat.

A GRC analyst turns a company's security into proof that outsiders accept. The job is to map the company's controls to frameworks such as SOC 2, ISO 27001 and NIST SP 800-53, gather the evidence that auditors and customers request, assess the risks the company runs and the vendors it relies on, and keep the policies that say how its data is protected. The honest route in rarely starts with a job titled "GRC Analyst": of 194 open GRC postings this board read on 12 November 2026, only 3 carried an intern, junior or level-one title, and the postings that stated a minimum asked for five years at the median. Most people cross over from work that already produces evidence or tests controls (IT audit, IT administration, privacy and legal work, project management in a regulated team), add one framework and one certification on top, and aim first at the analyst, coordinator and customer-trust seats that ask for two or three years.

The rest in brief. ISO 27001 (named in 71% of the postings) and SOC 2 (62%) are the frameworks the work runs on, and the median posting named five frameworks at once. CISSP (53%) and CISA (45%) are the certifications named most, though about two in three postings that name one list it as preferred rather than required. Employers stated a middle salary of $157,500 for GRC titles without a level word, $164,550 for senior titles and $257,500 for directors and above, across 100 distinct US-dollar ranges. And the field is splitting in two: titles calling the job an engineer (47) were exactly as common as titles calling it an analyst (47), and the engineer postings named Python almost five times as often (43% against 9%).

How the figures were measured. CyberJobs.cc reads the open security roles of 298 employers from their own hiring systems every hour, 2,150 of them on the night this guide was measured. The GRC sample started from the 215 roles the board files under governance, risk and compliance, plus the 38 roles filed under other specialties whose titles name GRC, compliance, risk, audit, privacy, assurance, FedRAMP or information system security officer work. Reading them removed 59 of those 253, jobs that carry a GRC-sounding label but are something else (zero trust product engineering, insider threat investigation, cloud security engineering, sales engineering, and engineers building a GRC software product), which left 194 postings at 106 employers. Each one was read in full from the board's job feed as it stood just after midnight on 12 November 2026, Central European time, and counted for the level its title names, the years it asks for, the frameworks, certifications and tools it names, its technical asks, its degree wording, its workplace, any clearance and its stated pay. Of the 194, 117 are based in the United States and 7 are written in French or Korean. Pay comes only from ranges employers published: 115 postings stated a yearly range in US dollars, 100 of them distinct once a role listed in several cities is counted once. "The middle" means the median midpoint of those ranges, and "typical" follows the board's one definition, from the 25th percentile of midpoints to the 90th percentile of range tops. Counts the board can redo are live: it holds 215 GRC roles as you read this, 65 of them remote. Figures from outside the board link to the page that states them, with its date.

Contents

1. What GRC is, and why companies pay for it
2. The work, task by task
3. The frameworks that run the work
4. Titles and the GRC ladder
5. What 194 open postings ask for
6. The skills to build first, and why in that order
7. Certifications: what employers name, and when each is worth it
8. Routes into GRC from where you stand today
9. GRC analyst salary by level, title and employer
10. How technical GRC is becoming
11. Where GRC leads
12. A twelve-month plan
13. Questions people ask about becoming a GRC analyst

1. What GRC is, and why companies pay for it

Governance, risk and compliance are three answers to a single problem: the people who depend on a company's systems cannot inspect those systems themselves. A bank buying software cannot read the vendor's cloud configuration. A regulator cannot sit in every engineering meeting. A board of directors cannot review each access grant. Each of them still has to decide whether to trust the company, so each relies on something the company produces about itself, checked by someone independent. GRC is the function that produces it.

Governance is deciding who owns which security decision, and writing that down where it can be checked: the policies, the standards beneath them, the committee that approves exceptions, the named owner of each control. When NIST revised its Cybersecurity Framework to version 2.0 on 26 February 2024, the one new function it added was Govern, and the agency described cybersecurity as "a major source of enterprise risk that senior leaders should consider" alongside finance and reputation - NIST, February 2024.

Risk is estimating what could go wrong, how likely it is and what it would cost, then choosing what to do about each item: fix it, accept it with a named owner and an expiry date, transfer it (to an insurer or a contract), or stop doing the thing that creates it. The record of those choices is the risk register.

Compliance is proving to an outsider that the company meets a stated standard: a SOC 2 report from a CPA firm, an ISO 27001 certificate, a FedRAMP authorization, a clean regulatory exam.

The economics explain where the jobs are. Without a shared attestation, every large customer would send its own auditors or a 300-question spreadsheet; with one, the company is examined once and shows the result to everyone. That trade is worth most to companies that sell to other businesses or handle regulated money, and the board's postings follow it. On 12 November, GRC made up 14.7% of all security postings at software and internet companies, 13.6% at AI labs and 12.4% at banks, payment and crypto firms, against 6.4% at cloud and data infrastructure companies and 5.3% at security software vendors (whose security hiring is dominated by the engineers who build their products). Regulators keep raising the stakes on the governance side too. Since rules the SEC adopted on 26 July 2023, US public companies must disclose a material cybersecurity incident on Form 8-K, generally within four business days of deciding it is material, and describe their risk management and board oversight in the annual 10-K - SEC, July 2023. In Europe, NIS2 made top management accountable for failures in cybersecurity risk management measures - European Commission, read November 2026.

One clarification saves confusion when searching. "Compliance" also names a large banking function that enforces anti-money-laundering and sanctions rules. That is a different job with a different ladder. This guide covers security GRC: the work of proving that systems and data are protected. The board's GRC guide describes the specialty itself; this one is about getting into it.

The analyst sits in the middle of an unusual web. The controls belong to other people (engineering owns the deployment pipeline, IT owns laptops, HR owns onboarding), so a GRC analyst gets almost nothing done alone. Of the 194 postings, 68% talked about stakeholders or cross-functional work, 41% named legal teams or counsel among the people the role works with, and 18% described it as customer-facing. A useful mental model: the analyst is the company's translator between what a standard says, what engineers actually built, and what an auditor will accept as evidence that the two match.

2. The work, task by task

Job titles in GRC are inconsistent, but the tasks are not. The chart counts how many of the 194 postings named each recurring activity in their description of the job.

The audit cycle

Audits appear in 81% of the postings, which makes them the spine of the job. An audit cycle has a predictable shape. Someone scopes it (which systems, which framework, which period), the team runs a readiness check against the controls, the auditor sends a request list, control owners produce evidence, the auditor tests a sample and interviews people in walkthroughs, and the findings come back to be fixed. Superhuman's GRC analyst posting reads like a summary of that cycle: "Plan and run quarterly audits from scoping through report and findings closeout," with readiness work ahead of each fieldwork window. Many companies run several audits a year (a SOC 2 Type II period, an ISO surveillance audit, a PCI assessment, a customer's own audit), so the analyst's calendar is a rolling sequence of them. Of the postings, 27% referred to external auditors or audit firms by name of role and 16% to internal audit, the company's own team that reviews controls before outsiders do.

Evidence, and the platforms that hold it

Evidence is named in 62% of postings, and it is where a newcomer's first months go. Evidence is anything that shows a control operated: a ticket proving a change was approved before it was deployed, a list of leavers matched against disabled accounts, a screenshot of encryption settings, a signed policy acknowledgment. The skill is less about collecting files than about judging them: is this the complete population, does it cover the whole audit period, would an auditor accept it? Talkdesk's GRC analyst posting describes the modern version of the job, managing the GRC platform daily and keeping its integrations with cloud providers, identity, ticketing and code repositories working so that evidence is collected automatically wherever possible. Remediation tracking, chasing the fixes that findings require until they close, appears in 54% of postings and is the unglamorous half of the same work.

Risk assessments and the risk register

Risk assessments appear in 42% of postings and risk registers in 22%. In practice an analyst interviews the owners of a system or process, identifies what could fail, rates each item for likelihood and impact on the company's scale, and records an owner and a treatment. Delinea's GRC analyst posting in Mexico City asks the hire to keep the cybersecurity risk register "including ratings, owners, treatment plans, and remediation progress through closure," and to manage the register of policy exceptions alongside it. The more senior version translates technical findings into business terms: GitLab's senior security risk engineer builds "a risk register that translates technical vulnerabilities, control gaps, and third-party risk findings into quantified, business-relevant risk statements." Quantitative methods are still a minority interest; 18 postings (9%) mentioned FAIR or quantified risk.

Vendors and third parties

Third-party risk shows up in 37% of postings. Every SaaS tool, contractor and data processor a company adopts extends its attack surface, so someone must review them before contracts are signed and again on a schedule. Nebius's security compliance coordinator posting lists the material such a review weighs: "questionnaires, SOC reports, ISO certifications, policies, and other security and compliance evidence." The core skill is reading another company's SOC 2 report critically: what was in scope, what the auditor found, and which controls the report expects the customer to operate itself.

Customer questionnaires and the trust center

The mirror image of vendor review is answering the reviews customers send you. Security questionnaires and due diligence questionnaires appear in 27% of postings, and customer trust or trust-center work in 23%. Several postings are built entirely around it: AlphaSense's client assurance analyst in Bengaluru answers due diligence questionnaires in what the posting calls a "high-volume, process-driven role", and Cloudflare's customer security compliance specialist helps sales and legal teams explain the company's security posture. These seats are among the most accessible in GRC because the work rewards accuracy and writing more than years.

Policies, exceptions and training

Policy work appears in 39% of postings: writing and maintaining the security policies and standards, collecting the yearly acknowledgments, handling requests to deviate from them. Training or educating other teams appears in 34%, partly formal security awareness training (9%) and partly teaching control owners what an auditor will want.

Government authorization work

A quarter of postings (25%) mention the vocabulary of US government authorization: authorization to operate, system security plans, plans of action and milestones (POA&Ms), continuous monitoring and the eMASS system that defense programs use to manage authorization packages. This is the territory of the information system security officer (ISSO), the GRC title of the defense world. Second Front's ISSO posting asks for "assessor-ready documentation and clear control narratives"; Anduril's ISSO postings add security technical implementation guides (STIGs) and container scan results to the package. The work is the same discipline as commercial GRC, applied to a system that needs a government official's signature before it can run.

How the mix changes with the employer

The same title means different weeks at different employers, and it pays to read which kind a posting is. At a software company selling to enterprises, GRC is pulled by sales: certifications to win deals, questionnaires to close them, a trust center to keep customers informed. At a defense or aerospace company, it is pulled by authorization: packages, POA&Ms, continuous monitoring and clearances. At a bank, payment firm or crypto exchange, it is pulled by regulators: DORA in Europe, examinations and regulatory requests elsewhere (12% of postings mentioned regulators or regulatory exams). At an AI lab, it is all three plus a new layer of AI governance, as section 10 shows. Choosing a first employer partly chooses which of these muscles you build.

3. The frameworks that run the work

A framework is a published list of controls (or criteria, or requirements) that a company agrees to meet, plus a way for someone independent to check that it does. GRC postings name a lot of them: the median posting in the sample named five, half named five or more, and only 21 of the 194 named none of the frameworks counted here.

Selling to businesses: ISO 27001 and SOC 2

ISO 27001 (137 postings, 71%) and SOC 2 (121, 62%) dominate, and 114 postings named both. They answer the same buyer question in two dialects. ISO 27001 certifies a management system: the company defines its scope, assesses its risks, picks controls from the standard's annex and is certified by an accredited body, with surveillance audits between recertifications. SOC 2 is an attestation report written by a CPA firm against the AICPA's Trust Services Criteria; a Type II report tests whether the controls operated over a period, typically months. US buyers ask for SOC 2, buyers elsewhere often ask for ISO, and a company selling globally holds both. That is why "crosswalk" (a mapping that shows one control satisfying requirements in several frameworks) appeared in 26% of postings.

SOC 2 itself is about to move. The AICPA has put new criteria out for comment, posting its exposure drafts of a proposed 2027 version of the SOC 2 Trust Services Criteria on 26 October 2026 - AICPA, October 2026. One summary of the draft counts a cut from 61 criteria to 50, AI wording added to the points of focus under 17 criteria, and comments requested by 15 January 2027 - SOC2Auditors.org, updated October 2026. Anyone entering GRC now will help companies move from the 2017 criteria to the new ones if they are adopted.

Selling to government: FedRAMP, NIST SP 800-53 and CMMC

The US federal family is the second large block: 84 postings (43%) named FedRAMP, NIST SP 800-53, CMMC, NIST SP 800-171 or the Risk Management Framework. NIST SP 800-53 is the catalog of security and privacy controls underneath most of them, organized in 20 families, and NIST issued a minor release, 5.2.0, on 27 August 2025 - NIST CSRC, updated August 2025. FedRAMP applies that catalog to cloud services sold to federal agencies, and it is in the middle of its biggest change: FedRAMP 20x, announced in March 2025, replaces document-heavy reviews with key security indicators validated automatically where possible, on the principle that "continuous evidence of what is happening is stronger than a policy saying it should happen," and the program plans to stop accepting new certifications under the old Rev5 process on 11 June 2027 - FedRAMP, read November 2026. FedRAMP was named most often by security software vendors (18 postings) and software companies (13).

CMMC is the defense contractor's version. The rule that puts it into contracts took effect on 10 November 2025, and its second phase, which requires third-party Level 2 certifications at award for applicable contracts, was scheduled to begin on 10 November 2026 - Cooley, September 2025. It appeared in 18 postings. Both programs pull GRC hiring toward people who can read NIST's control language fluently.

Payments, health and public companies: PCI DSS, HIPAA and SOX

PCI DSS (64 postings, 33%) governs anyone who stores, processes or transmits card data, and its version 4 brought 51 future-dated requirements that became mandatory on 31 March 2025 - PCI Security Standards Council, August 2024. HIPAA (36, 19%) covers health data in the US, with HITRUST (10) as the certification many health customers request. SOX (22, 11%) and SOC 1 (26, 13%) are the financial-reporting side: the IT general controls (access, change management, operations) that support a public company's financial statements. SOX work is closest to classic IT audit, and it pays: Anthropic's lead for security controls assurance on SOX stated $410,000 to $510,000.

Privacy and European rules: GDPR, DORA and NIS2

GDPR appeared in 58 postings (30%) and the California privacy laws in 21, usually as obligations the security program has to support rather than as the analyst's whole job. Privacy-led roles exist (ISO 27701 was named 22 times, and a head of privacy appears in section 11), but most GRC postings treat privacy as one more set of requirements in the crosswalk. Two European laws are newer. DORA, which has applied to EU financial entities since 17 January 2025, sets rules for ICT risk management, third-party providers, incident reporting and resilience testing - EIOPA, read November 2026; it was named in 21 postings, 7 of them at finance and crypto employers. NIS2, whose transposition deadline for member states was 17 October 2024, reaches 18 critical sectors - European Commission, read November 2026; 11 postings named it.

AI: ISO 42001, the NIST AI RMF and the EU AI Act

The fastest-arriving block is AI governance. ISO 42001, the management-system standard for AI, was named in 42 postings (22%), the NIST AI Risk Management Framework in 24 and the EU AI Act in 22; together, 50 postings (26%) named at least one AI framework. Talkdesk's GRC analyst manages crosswalks that already include ISO 42001 next to SOC 2 and ISO 27001. The EU AI Act's timetable has also shifted: an amending regulation published in the Official Journal on 24 July 2026 moved the high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI built into products regulated under Annex I - Paul, Weiss, July 2026. For a newcomer, the delay is useful: the deadlines that will create the most AI compliance work fall after the time it takes to become competent in the field.

Which framework to learn first

Because a typical posting names five frameworks, no employer expects you to know all of them deeply. What they expect is fluency in one and the ability to map it onto the others. ISO 27001 or SOC 2 is the right first one for almost everyone: together they appear in 144 of the 194 postings, and their controls (access management, change management, logging, vendor management, incident response, business continuity) recur in every other framework under different numbering. Add NIST SP 800-53 if you aim at government work, PCI DSS for payments, and ISO 42001 if you want the newest specialty.

4. Titles and the GRC ladder

GRC has no standard title. The 194 postings used analyst, engineer, specialist, coordinator, officer, lead, consultant, auditor, manager and several hybrids ("Security Risk & Compliance, SOX IT"). Grouping them by the noun in the title shows how the field is organized, and where the technical line runs.

Read the first two rows together. Analysts and engineers were equally numerous, asked for the same median years, and were paid within $16,000 of each other at the middle; the difference is what they do with those years. Analyst postings describe running programs and judging evidence; engineer postings describe building the systems that collect evidence and test controls automatically, which is why they name Python almost five times as often. Exactly 21 postings used the literal title "GRC Analyst" or "Governance, Risk and Compliance Analyst", and the board's GRC job title page lists those and their relatives as they open.

The rungs

By the level word in the title, the 194 broke down as follows: 1 internship, 2 junior or level-one titles, 70 with no level word, 49 senior, 13 lead, 15 staff, 7 principal, 17 managers, 9 program managers, 9 directors and 2 VPs or heads. The ladder has a missing bottom. Palo Alto Networks' GRC engineer internship at its California headquarters, Brex's GRC Engineer I in São Paulo and Alan's junior GRC security engineer in France were the only titled starting points that night.

The years asked step up the ladder, with one oddity. Among the postings that stated a number, titles with no level word asked for a median of 5 years (49 stating), senior titles also 5 (41), lead, staff and principal titles 7 (27), managers and program managers 6.5 (20), and directors and above 10 (10). Analyst titles with no level word asked a little less, a median of 4 (13 stating). The oddity is that "senior" asked no more than a plain title, which says less about seniority than about how small GRC teams are: in a team of three, the person without a level word often is the senior one. It also means the realistic target for a newcomer is a plain title whose posting asks for two or three years, not one labelled junior.

Management arrives early in GRC compared with engineering specialties: managers were asked for fewer years than lead, staff and principal titles. A GRC team's main output is a program run through other people's controls, so the step from running a program to running a team is short. The career paths guide compares this ladder with the other nine specialties.

5. What 194 open postings ask for

The table gathers the asks that decide whether you can apply, before the sections below explain them.

Experience

Three quarters of postings stated a minimum, and the median was five years. Only 23 asked for three or fewer and 10 for two or fewer. Those low-experience postings cluster in a few kinds of seat: customer-trust and questionnaire analysts (Talkdesk's customer trust analyst and AlphaSense's client assurance analyst asked for two and one), coordinators (Nebius, two), early-career analysts at fast-growing companies ( Chainguard, Talkdesk and Delinea, two to three), and government ISSOs ( Apex, Two Six Technologies and Second Front asked for three, with a clearance). Chainguard's remote GRC analyst opening in the UK, at $89,000 to $105,000, is unusually explicit: "This is an earlier-career, hands-on role. You don't need to have led an audit or built a GRC function before."

The years asked are years of related work, not years titled GRC. Postings commonly accept audit, IT, security or compliance experience toward the total, which is why the routes in section 8 matter more than a title.

Degrees

Fewer than half the postings (44%) mentioned a degree at all, and half of those (43) accepted equivalent experience in the same sentence. When a field was named next to the degree, it was most often cybersecurity or information security (39), computer science (35) or information systems and technology (29); accounting, finance or business came up 14 times and law only twice. Only 4 postings mentioned a master's degree, an MBA or a law degree. A degree helps with screening at large employers, but GRC is not a field that gates on one.

Certifications

Of the 114 postings that named a certification, 69 framed it as preferred, a plus or a way to stand out, 33 as required or expected, and 12 left it unclear. Required certifications concentrate in two places: government seats, where the Defense Department's 8570 and 8140 baseline makes a listed certification a condition of the job (11 postings named it), and senior or audit-heavy roles that ask for CISA or CISSP outright. Section 7 goes through which certifications are named and when each one is worth sitting.

Tools

The GRC platform has become the analyst's workbench: 81 postings (42%) named one or described a "GRC platform" or compliance tool. The names that recurred were Vanta (31 postings), Drata (25), ServiceNow (17, not always its risk module), OneTrust (15), eMASS (10, the defense system), Archer (8), AuditBoard (6), Hyperproof and Secureframe (5 each) and Xacta (4). Jira was named 16 times and spreadsheets 15. The specific product matters less than it seems: they share one model of controls, owners, tests and evidence, and someone who has run one learns another in weeks.

Technical skills

Cloud literacy is the most common technical ask (29% named AWS, Azure or Google Cloud), followed by scripting of any kind (23%), Python (17%), APIs (14%) and SQL (9%). These asks are not spread evenly: 20 of the 47 engineer-titled postings named Python, against 4 of the 47 analyst titles. Peregrine's GRC analyst posting in Washington, DC is typical of what an analyst is expected to know technically: "strong awareness of security best practices in cloud environments," naming AWS services such as GuardDuty, Security Hub and AWS Config, without asking for code.

Writing and people

Strong written communication was named in 38% of postings, more than any single technical skill. That is not a soft extra. Control narratives, policies, risk statements and questionnaire answers are all writing, and an auditor or a customer judges the company by them.

Remote work, location and clearances

29% of GRC postings were remote (57 of 194), and the board keeps the remote GRC roles on their own page. Remote seats paid somewhat less at the middle, as section 9 shows. 117 of the 194 were based in the United States; France (7), South Korea, India and the UK (6 each), Singapore (5), Canada and Israel (4 each) followed, and 10 were open worldwide. A US security clearance was named in 19 postings: 14 required an active clearance, 11 of those at defense and aerospace employers ( Anduril Industries alone had five), and 5 preferred one or accepted eligibility. Government ISSO seats are a realistic door for veterans and for anyone already cleared, and the cleared roles page lists them across all specialties.

6. The skills to build first, and why in that order

The order below follows the frequency of the asks above and the dependency between them: each step makes the next one easier, and the early steps are the ones a first GRC interview tests.

Step 1: read one framework end to end

Pick ISO 27001 or the SOC 2 Trust Services Criteria and read the whole thing, then a mapping of it to NIST SP 800-53. The goal is vocabulary: what a control objective is, what "design" and "operating effectiveness" mean, how access management, change management, logging and vendor management are phrased. Most first interviews include a question such as "how would you prepare a company for its first SOC 2 Type II?", and the answer is a walk through this material.

Step 2: learn how an audit actually tests things

Learn the mechanics behind evidence: populations, samples, the audit period, a test of design against a test of operating effectiveness, what makes a screenshot unacceptable (no date, no system name, partial list). This is the knowledge that separates someone who has been through an audit from someone who has read about one, and it is the main reason people from audit firms move into GRC easily.

Step 3: write like the auditor is reading

Practise the four documents every GRC team produces: a control narrative (what the control is, who runs it, how often, what proves it), a policy section, a risk statement (cause, event, consequence, with an owner) and a questionnaire answer that is accurate without promising more than the company does. 38% of postings ask for strong writing because each of these will be read by someone who can hold the company to every word.

Step 4: a risk method you can explain

Learn one structured way to rate risk: likelihood and impact on a defined scale, inherent and residual risk, treatment options, risk acceptance with expiry. NIST SP 800-30 is the method named in several postings (and FAIR, the quantitative alternative, in 13). Then build a small register: ten real risks for an imaginary company, each with an owner, a rating and a treatment.

Step 5: enough technology to tell whether a control is real

The analyst who can read an identity provider's settings, a cloud account's logging configuration or a deployment pipeline's approval step catches gaps before the auditor does. This is where 29% of postings ask for cloud knowledge. You do not need to build cloud systems, but you should be able to read an access policy, know what a security group does and recognize what centralized logging looks like.

Step 6: one GRC platform

With 42% of postings naming a platform, hands-on time with one is worth having. The value is not the vendor's buttons but the model: controls linked to frameworks, tests linked to controls, evidence linked to tests, owners and due dates on everything.

Step 7: third-party risk from both sides

Read a real SOC 2 report from a vendor your current employer uses, if you can get access, and write a one-page review: scope, exceptions found, controls the customer is expected to operate, and what you would ask the vendor. Then answer a short questionnaire as if you were the vendor. Together these two skills appear in more than a third of postings.

Step 8: automation, once the rest is solid

Python (17% overall, 43% of engineer titles), APIs and SQL turn manual evidence work into scheduled jobs, and they are the road from analyst to GRC engineer. Learn them after the domain, not before: a script that collects the wrong evidence perfectly is still a finding. Section 10 explains why this step now matters more than it did.

7. Certifications: what employers name, and when each is worth it

The chart counts the certifications named in the 194 postings.

Two things stand out. First, the most-named certifications are ones a beginner cannot hold yet, because each requires years of verified work. Second, most postings list several in one breath ("CISSP, CISA, CRISC or CISM preferred"), so any one of them satisfies the ask. The board's certifications page ranks them across every specialty, and the table below sets the GRC counts beside what each one requires or signals.

What each one signals

CISA is the auditor's credential, and it reads as "this person knows how controls are tested." It suits people coming from audit and anyone whose target seat is audit-heavy (SOX, internal audit, SOC 2 programs). CRISC is the risk credential: the lowest experience gate of the ISACA three, and the most direct match for risk analyst and risk management lead titles. CISM signals management of a security program and fits the manager track. CISSP is the broad security credential; GRC postings name it most because it is the one hiring managers recognize across all of security, and it carries extra weight for analysts who want to show technical breadth. Security+ matters chiefly in government seats, where it is the most common way to meet the Defense Department baseline. CGRC maps most closely to the NIST Risk Management Framework work of an ISSO, though only 7 postings named it. The board's comparisons weigh the common pairs: CISA against CRISC, CISM against CISA, CISSP against CISA and CISSP against CISM.

A sensible order

For someone without GRC experience, the order that fits the gates is: Security+ if you are aiming at government work (ISSO postings list it among the certifications that satisfy the Defense Department's 8570 and 8140 baseline); otherwise an ISO 27001 credential or the CISA exam, taken before the experience is complete, which both ISACA and ISC2 allow, so that your résumé shows the knowledge while the years accumulate. Once the years are there, CISA or CRISC turns the passed exam into the credential, and CISSP or CISM follows for the senior and management rungs. Do not stack credentials in place of experience: the postings asked for a median of five years and treated certifications as a plus about two times in three.

8. Routes into GRC from where you stand today

The most useful way to plan a move into GRC is to ask which part of the job you already do. Each route below starts from a common job and names the gap to close.

From IT audit or external audit

This is the shortest route, and employers say so. Thirty postings mentioned IT audit, and nine said outright that they would welcome a background at a Big 4 or other audit firm, among them Anthropic's SOX roles, Lyft's senior security assurance analyst and Crusoe's senior GRC analyst. Auditors already know populations, samples, walkthroughs and findings; what they lack is the view from inside, where the evidence has to be produced rather than judged, and where fixing a finding means persuading an engineering team. Lead with that on a résumé: the controls you tested, the frameworks, and any finding you followed to remediation. The usual landing seat is a senior analyst or assurance analyst role, not an entry-level one.

From IT administration, help desk or systems work

IT staff run many of the controls auditors test: joiners, movers and leavers, access reviews, laptop encryption, patching, backups, change tickets. That is evidence you have produced, whether or not anyone called it compliance. The gap is the framework view: knowing which requirement each of those tasks satisfies and how an auditor will sample it. A practical move is to volunteer for your employer's next audit as a control owner, then for the evidence coordination itself. Customer-trust and questionnaire seats also fit IT people well, because the questions are about how systems are run.

From legal, privacy or compliance work

Legal and privacy professionals bring the hardest skill to teach: reading a requirement precisely and writing a commitment that is true. GDPR appeared in 30% of GRC postings and legal teams or counsel in 41%, so a privacy background maps onto real demand, and several roles sit directly on the line (privacy engineer, head of privacy, legal assurance). The gap is technical literacy: what the controls are in practice and how they are evidenced. Pair your background with ISO 27701 or the CIPP family for privacy-weighted seats, or with ISO 27001 for general GRC. Compliance officers from regulated industries face a similar move; the BLS puts the median compliance officer's pay at $80,730 in May 2025 - BLS Occupational Outlook Handbook, updated October 2026, well below what security GRC postings state, which is part of why the move is worth making.

From project or program management

Running an audit is running a program: a calendar, dependencies, owners, status reports and deadlines that cannot slip. Superhuman's GRC analyst runs "the audit program as one program," and nine postings were program manager titles, among them OpenAI's GRC program manager for audit and controls ($216,000 to $252,000) and Stripe's security GRC program manager for third-party risk. Project management was named in 24 postings. The gap is the domain: a framework and its audit mechanics (steps 1 and 2 in section 6).

From security operations or engineering

People already in security can move sideways into GRC engineering, the fastest-growing corner of the field. They bring the technical half (cloud, logs, scripting) and need the audit half. The move is common enough that the board's SOC analyst guide and its career map treat it as a standard path; the career paths guide compares the cost of each sideways move.

From military or government service

Veterans and government staff, especially those with a clearance, have the most direct route of all: the ISSO seat. Of the 16 ISSO and accreditation postings, the plain-titled ones asked for a median of five years, but three asked for three, and they stated ranges such as Apex's $104,000 to $143,000, Anduril's $124,000 to $164,000 and Second Front's $150,000 to $170,000 (remote, with a Secret clearance). Experience with the Risk Management Framework, eMASS, STIGs and POA&Ms transfers directly, and Security+ meets the baseline most of them require.

With no experience at all

Honesty first: the board held three titled starting points in GRC that night, so a cold start is the hardest route. It is not impossible, and the postings show where it works. The entry-level roles page and the internships page list the titled openings across security as they appear. Beyond them, the realistic first seats are the ones built on accuracy rather than years: questionnaire and due diligence analysts, customer-trust analysts, security compliance coordinators and early-career analysts at fast-growing companies. Alan's junior GRC posting asks for someone who has "automated at least one manual task (a script, a tool, an AI workflow)" and promises "a dedicated coach from day one". The broader guide to getting into cybersecurity covers the general first-job problem; for GRC specifically, the proof that replaces experience is a small portfolio: a policy set, a risk register, a SOC 2 readiness assessment of an imaginary company and a vendor review, all written to the standard of step 3.

Is GRC a non-technical cybersecurity job?

Partly. It is the largest security specialty where most roles do not ask you to write code: only 9% of analyst postings named Python. But "non-technical" is the wrong expectation. 29% of postings named a cloud provider, and the analyst who cannot tell whether a control is really in place becomes a forwarder of screenshots, which is exactly the work automation is taking away. The accurate description is that GRC needs technical literacy without technical production, at least at the analyst rung.

9. GRC analyst salary by level, title and employer

The board recomputes GRC pay every hour from every posting that states a range. As this page loads, the figures read:

In the 12 November sample, the middle stated salary was $175,000, the typical span $153,000 to $306,000, and the median range ran from $150,500 at the bottom to $200,000 at the top. The GRC salary page splits today's figures by seniority, workplace and employer, and the salary calculator estimates a figure for your own mix.

By level

The samples behind the bars are small at the top: 33 distinct ranges for titles with no level word, 26 for senior, 25 for lead, staff and principal together, 9 for managers, 4 for program managers and 8 for directors and above. The shape still says something useful. The first step that pays is not "senior" (about $7,000 at the middle) but the move to lead, staff or principal (about $36,000 more) or to director (about $100,000 above the plain title). AI labs pull the plain-title bar up, because they rarely put levels in titles and pay the most; without them, the middle reads $155,000 with no level word, $164,100 for senior titles, $200,000 for lead, staff and principal and $169,375 for managers and program managers, with directors unchanged at $257,500.

Titles that literally say GRC analyst behaved like the rest of the analyst family. Seven distinct ranges for "GRC Analyst" with no level word had a middle of $157,750, from Chainguard's remote UK seat at $89,000 to $105,000 to Perplexity's $200,000 to $220,000 for a posting that asked for six or more years. Senior GRC analyst titles stated a middle of $150,000 across five ranges, from Ping Identity's $115,000 to $159,000 to Roblox's $180,570 to $224,310. Roblox's principal security GRC analyst, at $288,020 to $335,580, shows how far the specialist track reaches.

By title family

Across all levels, engineer and architect titles stated a middle of $175,000 (25 ranges), analysts $159,000 (27), ISSO and accreditation titles $160,000 (11), specialists and coordinators $152,500 (7), and manager, director and VP titles $226,000 (20). The engineer premium is modest at the middle and grows with level: lead, staff and principal engineer titles stated $203,000 against $164,500 for analysts at the same rungs. GRC engineering examples show the range: Box's GRC controls automation engineer at $115,500 to $145,000, Plaid's security engineer for GRC at $156,000 to $213,600, Verkada's GRC engineer at $200,000 to $250,000 and Reddit's senior software engineer for GRC at $190,800 to $267,100.

By employer

The ranges behind each bar: 10 at AI labs, 9 at finance and crypto firms, 35 at software and internet companies, 13 at defense and aerospace companies, 12 at cloud and data companies and 19 at security software vendors. AI labs stand apart: All nine of Anthropic's GRC postings stated $255,000 or more at the bottom of their range. The AI lab, finance, software and defense pages show every security role at each kind of employer.

Remote, abroad and the government figure

Remote GRC postings stated a middle of $164,100 (39 ranges) against $178,545 for on-site and hybrid ones (61), so remote work cost about $14,000 at the middle in this sample. Outside the United States few postings state pay at all; Alan's junior GRC seat in France stated €61,000 to €70,000. As a wider benchmark, the government's survey of the whole economy found a median of $129,180 for information security analysts in May 2025, and the BLS expects the occupation to grow 21% between 2025 and 2035, with roughly 14,100 openings a year - BLS Occupational Outlook Handbook, updated August 2026. The board's figures run higher because its employers are technology, finance, AI and defense companies rather than the whole economy, and because only postings that publish a range are counted.

10. How technical GRC is becoming

The equal split between analyst and engineer titles is the clearest sign of a change in the field. Its cause is structural, and it is worth understanding before choosing where to start.

Why the work is being automated

Most of the hours in traditional GRC go into moving evidence: asking a control owner for a screenshot, checking it, filing it, and doing the same for the next framework that needs the same control. That work has three properties that make it a target for software: it repeats every audit cycle, its inputs already live in systems with APIs (cloud accounts, identity providers, ticketing, code repositories), and its outputs are judged against written criteria. Once a company holds several certifications, the cost of doing it by hand grows with every framework added, while the cost of an automated pipeline barely grows at all. The postings show the shift happening: 77 of the 194 (40%) mentioned compliance automation, automated evidence, continuous control monitoring or continuous compliance, and 20 named compliance or policy as code. Legora's GRC engineer posting compresses the philosophy into a sentence: "Anything manual twice a quarter gets automated." Regulators are moving the same way: FedRAMP 20x is built on validating security indicators automatically instead of reviewing documents. Even the companies selling the tools are hiring for it; Vanta listed three full-stack engineering roles for its GRC product, at up to $263,000, which this guide's sample excluded because they build software rather than run a program.

AI in the daily work

The newest layer is AI used by the GRC team itself. 61 postings (31%) at 39 employers asked the hire to use AI tools or to build AI-assisted workflows for GRC work: drafting control narratives, summarizing evidence, answering questionnaires, triaging vendor reviews. Vercel's GRC analyst posting says it wants someone "who wants to build GRC with AI, and you do not need to be an engineer to do it." Anthropic's SOX roles ask the hire to use language models as daily working tools and to have "grounded, specific views on which SOX assurance workflows AI can run today and which it can't yet." Motive's director of security compliance and trust is expected to be personally building evidence automation and AI-assisted questionnaire responses "rather than delegating it to a tooling vendor." The common thread is a human who stays accountable: Deliveroo's and Legora's GRC engineers run agentic workflows for evidence analysis and control testing "with a human in the loop where assurance demands it."

AI as the thing being governed

The second AI trend runs the other way: AI systems are a new subject for GRC. As section 3 showed, 26% of postings named ISO 42001, the NIST AI RMF or the EU AI Act. Some titles now carry it: xAI's security engineer for GRC frameworks and AI governance, Coupang's staff security engineer for AI GRC, Trace3's GRC and AI governance architect, and Anthropic's security risk and compliance role for agent security, which writes the policies for how AI agents are built, deployed and operated. The SOC 2 draft criteria add AI points of focus too. The board's AI security jobs page follows these roles in every specialty.

What stays human, and what it means for a newcomer

Reasoned from first principles, automation takes the parts of GRC that are retrieval and formatting, and leaves the parts that are judgment and negotiation. Deciding what is in scope for an audit, whether a compensating control is good enough, whether a risk should be accepted and by whom, how to tell a customer the truth about a gap without losing the deal, how to get an engineering team to fix something before the auditor arrives: none of this is retrieval. The consequence for a newcomer is double-edged. The clerical tasks that used to train juniors (collecting screenshots, filling spreadsheets) are shrinking, which is part of why titled entry seats are so rare. In exchange, an entrant who shows judgment and can automate one tedious step is worth more than a whole team of screenshot collectors used to be. The practical advice: learn the domain first, then add enough scripting and AI tooling to remove your own busywork, and say so on your résumé.

11. Where GRC leads

GRC careers branch in four directions after the analyst years, and the postings show pay and asks for each.

Management of the GRC function. Coinbase's opening for a GRC manager wanted at least eight years across technology risk, IT controls, audit or compliance, and offered $193,970 to $228,200 for a remote seat; WHOOP's senior manager of GRC stated $185,000 to $205,000. Directors run the whole program: Figma's director of GRC stated $235,000 to $317,000, Motive's director of security compliance and trust $225,000 to $305,000, and CLEAR's director of security compliance $225,000 to $275,000. Further up, Zania's VP of GRC listed a minimum of twelve years in GRC, IT audit or security compliance.

The specialist track. GRC also rewards depth without a team: Roblox's principal security GRC analyst ($288,020 to $335,580), Palo Alto Networks' principal GRC business engineer ($170,000 to $275,000) and Anthropic's staff security engineer for risk engineering ($320,000 to $405,000) are individual contributors. Risk engineering in particular is growing into its own track, with titles at Asana, GitLab and Anthropic.

Privacy and audit leadership. Privacy is a natural branch: the head of privacy The New York Times is hiring, a vice-president seat, wants at least fifteen years and pays $275,000 to $315,000, and Roblox's senior director of privacy, product and platform security stated $457,970 to $525,510. Audit has its own top: Coupang's director of cybersecurity audit and continuous assurance and Ebury's senior internal audit manager for IT and information security.

Toward the CISO seat. GRC is one of the few security specialties that already speaks the language of boards, budgets and regulators, which is what the top job demands, and the SEC and NIS2 rules have made that language more valuable. What GRC people usually lack for a CISO seat is operational depth (running incident response, owning engineering teams), so the common path runs through a broader security management role first. In the government's own description of the occupation, analysts can rise to chief security officer or to another computer and information systems manager post - BLS Occupational Outlook Handbook, updated August 2026. The board's security leadership guide covers that ladder, and the highest paying jobs ranking sets the destinations side by side.

12. A twelve-month plan

A plan for someone with a few years of adjacent work (IT, audit, legal, project management) and no GRC title yet. Someone starting from nothing should expect the same steps to take longer, with an IT or audit job first.

Months 1 to 3: the domain. Read ISO 27001 or the SOC 2 criteria end to end, then a mapping to NIST SP 800-53. Learn audit mechanics (step 2 in section 6). Ask to help with your current employer's next audit or customer questionnaire, in any role.

Months 4 to 6: proof you can show. Build the four-document portfolio: a policy, a risk register of ten risks, a SOC 2 readiness assessment of an imaginary company, and a vendor review based on a real SOC 2 report if you can get one. Sit the first credential that fits your target (Security+ for government, an ISO 27001 credential or the CISA exam for commercial work).

Months 7 to 9: one tool and one automation. Get hands-on with one GRC platform, and automate one evidence task with a script or an AI-assisted workflow, documented well enough that someone else could run it. This single item puts you ahead of most applicants for analyst seats.

Months 10 to 12: apply where the asks are lowest. Target the postings that ask for two or three years and that value your origin: questionnaire and customer-trust analysts, compliance coordinators, early-career analysts at fast-growing companies, or ISSO seats if you hold a clearance. Rewrite your résumé so each past job is framed as controls you ran, evidence you produced or risks you managed, and prepare for interviews that will ask you to walk through an audit and to explain a risk to someone outside security.

13. Questions people ask about becoming a GRC analyst

What does a GRC analyst do?

A GRC analyst keeps a company's security program provable. Day to day that means running audits for frameworks such as SOC 2 and ISO 27001, collecting and checking evidence, tracking fixes for findings, assessing risks and vendors, answering customers' security questionnaires and maintaining policies. In the 194 postings read on 12 November 2026, audits appeared in 81%, evidence in 62% and risk assessments in 42%.

What is GRC in cybersecurity?

Governance, risk and compliance: deciding who owns which security decisions (governance), estimating and treating what could go wrong (risk), and proving to outsiders that the company meets a standard (compliance). It exists because customers, regulators and boards cannot inspect a company's systems themselves and rely on independent attestations instead. The board holds 215 GRC roles right now.

How much does a GRC analyst make?

On the board right now, open GRC postings state a middle of $176k/yr a year, with a typical span from $154k/yr to $322k/yr. In the 12 November sample, titles with no level word stated a middle of $157,500 and senior titles $164,550, while directors and above stated $257,500. AI labs paid the most and security software vendors the least.

Can you become a GRC analyst with no experience?

It is possible but slow. Only 3 of the 194 postings carried a starting-rung title, and those stating a minimum asked for five years at the median. The realistic first seats are questionnaire, customer-trust and coordinator roles, and early-career analyst roles at fast-growing companies, a few of which asked for one or two years. A portfolio of GRC documents and one automated evidence task are the best substitutes for experience.

Is GRC a good job for someone non-technical?

It is the security specialty where coding is least often required: only 9% of analyst-titled postings named Python. But 29% of all GRC postings named a cloud provider, and analysts who can read a configuration are worth more than those who cannot. Expect to need technical literacy, not technical production.

Which certification is best for GRC?

The postings named CISSP (53%) and CISA (45%) most, then CISM (35%) and CRISC (25%). All four require years of experience before you are certified, though you can take the exams first. For a beginner, Security+ suits government seats and an ISO 27001 credential suits commercial ones; CISA or CRISC becomes the strongest signal once you have the experience.

Do GRC analysts need to code?

Analysts mostly do not: 4 of 47 analyst postings named Python. GRC engineers do: 20 of 47 engineer postings named it, and 40% of all postings mentioned compliance automation or continuous control monitoring. Learning to script is the road from analyst to the better-paid engineering side of GRC.

Will AI replace GRC analysts?

It is replacing the clerical part. 31% of postings asked hires to use AI tools in GRC work, and several employers describe agentic workflows that collect evidence and draft questionnaire answers. The judgment calls (scope, risk acceptance, negotiating fixes, dealing with auditors and customers) stay with people, and 26% of postings now add AI governance itself to the job.

Are GRC jobs remote?

29% of the 194 GRC postings were remote, and the board's remote GRC page holds 65 of them right now. Remote roles stated a middle about $14,000 lower than on-site and hybrid ones in the sample, and government ISSO seats are mostly on site.

Realistically, how long is the path to a first GRC role?

From an adjacent job (IT, audit, legal, project management), about a year of deliberate preparation is realistic: three months for a framework and audit mechanics, three for a portfolio and a first credential, three for a tool and an automation, and three for applications. From no work experience, expect an IT, audit or support job first, since the postings ask for years of related work rather than years in GRC itself.