GRC career path: roles, skills and certifications from analyst to head of GRC

You were hired as the first GRC person at a growing tech firm, usually to get a SOC 2 report or an ISO 27001 certificate over the line before an enterprise deal stalls. The audit is in hand. Now you are wondering what the GRC career path looks like from here, and what to learn next.

This guide maps that path as UK employers hire for it: the five stages from GRC analyst to head of GRC and beyond, what each stage owns, the skills and certifications that move you up, and what UK government labour market data shows about pay and demand. It is written from the view of Harry West, our founder, who has spent about 20 years in cybersecurity, including roles as Head of Information Security at the UK National Audit Office and Global CISO at Rackspace Technology and Pepper Advantage.

What is the typical GRC career path?

The typical GRC career path runs through five stages: analyst, specialist or consultant, manager or lead, head or director of GRC, then an executive role such as CISO, chief risk officer or chief compliance officer. Most UK cyber job adverts ask for 2 to 6 years' experience. Progress depends more on owning outcomes than on collecting certifications.

The stages are not fixed rungs. Small firms often skip one, and many people move sideways into privacy, audit or third-party risk before moving up. The useful question at each stage is the same: what do you own, and what would you need to own next?

That 2 to 6 years figure comes from the Department for Science, Innovation and Technology's Cyber security skills in the UK labour market 2025 report. It found that 63% of core cyber job postings in 2024 asked for mid-level experience of 2 to 6 years. The figure covers cyber roles in general, not GRC alone.

What are the GRC job titles at each stage?

GRC job titles vary by firm size and sector, but they cluster into five stages. Analyst and specialist roles do the work, the GRC lead or manager runs the programme day to day, the head of GRC or director of GRC sets its direction, and the executive owns the risk at board level.

In a 25 to 100 person tech firm, stages 1 to 3 often sit in one person. If that is you, read the table as a list of jobs you already do and the order in which to hand them to others as the team grows.

What does a GRC analyst do?

A GRC analyst keeps the evidence behind a firm's security and compliance claims accurate and current. Day to day, that means collecting audit evidence, updating the risk register, answering supplier and customer security questionnaires, reviewing policies, tracking actions to closure and preparing material for the auditor or the risk committee.

The work looks administrative from outside. It is not. Every questionnaire answer is a claim a customer may rely on in a contract, and the analyst is often the last person to check that the claim is true.

A typical week might include chasing an engineering team for access review records, mapping a new customer's questionnaire to existing ISO 27001 controls, and writing up an action from a supplier review. In a firm preparing for its first audit, it also includes building the evidence that a SOC 2 readiness assessment or an ISO 27001 implementation depends on.

The UK Cyber Security Council's Cyber Security Governance and Risk Management specialism describes this work as "the monitoring of compliance with agreed cyber security policies and the assessment and management of relevant risks".

How do you become a GRC analyst?

Many people become a GRC analyst by moving across from a nearby role, not by starting cold. The common entry routes are external or internal audit, regulatory compliance, IT service management and security operations. Each one already teaches part of the job: testing controls, reading rules, running systems or handling incidents.

DSIT's 2025 report shows why the sideways move is the realistic GRC analyst roadmap. Demand for entry-level candidates with less than a year's experience fell to 17% of core cyber job postings in 2024, from 25% in 2022. Within the cyber sector, 28% of recruits came from non-cyber roles, against 15% who were career starters.

What each route brings:

• From audit: you already test controls and write findings. Learn the security frameworks and how engineering teams produce evidence.
• From compliance: you already read regulation and track obligations. Learn the technical controls behind a security policy.
• From IT or service management: you already run the systems auditors ask about. Learn to document and evidence what you do.
• From security operations: you already handle incidents and alerts. Learn risk assessment and how to write for a non-technical reader.

The first role often has a different name. A compliance analyst, IT audit associate or risk analyst job can be a GRC analyst role in all but title. Read the duties, not the heading: the GRC analyst career path starts with the work, whatever the advert calls it.

Which GRC certifications help at each stage?

GRC certifications help most when they match the work you already do. CGRC suits analysts and specialists running a compliance programme, CISA suits audit, CRISC suits IT risk, and CISSP suits people heading towards security leadership. ISO 27001 Lead Implementer and Lead Auditor courses show you can build or audit a management system.

The ISACA and ISC2 rules come from each body's own pages: CISA, CRISC, CGRC and CISSP. ISACA lets you sit the CISA and CRISC exams before you meet the experience rule, but you are only certified once you do.

ISC2 lists GRC analyst, GRC manager and GRC director among the roles the CGRC is designed for. That makes it the most direct fit for the main path. Employers do not all ask for the same letters, so we recommend checking the job adverts you are aiming at before you choose.

A certification shows you have learned the material. Only owned outcomes show you can do the job.

What does the UK market pay for GRC roles?

DSIT's 2025 labour market report puts the median advertised salary for a core cyber security job in 2024 at £55,000, 12% above the median for the wider IT labour market of £48,900. London roles had a mean of £69,800 against a UK mean of £58,800. These are cyber-wide figures: DSIT does not publish GRC-specific pay.

The same report adds context a job seeker should weigh:

• Fewer adverts. Core cyber job postings fell 33% from 2023 to 2024, the second year of decline. The report describes the market as having moved from a candidate's market to an employer's market.
• Graduate starting pay. Cyber security graduates in full-time work had a median salary in the £30,001 to £35,000 band within 15 months of graduating.
• Governance is the common specialism. 42% of cyber sector businesses employed people in governance and risk management, the most common of the 15 specialisms in the UK Cyber Security Council's framework.
• Audit and governance are hard to fill. Among cyber businesses with hard-to-fill vacancies, 24% cited audit and assurance roles and 21% governance and risk management roles.

The salary figures come from online job adverts analysed by Lightcast, a base of 32,370 core cyber postings, and only adverts that state a salary feed them. DSIT notes that fewer adverts did so in 2024 than in 2023. Treat them as a market signal, not a pay band for a GRC analyst salary or a head of GRC offer.

What changes when you become a GRC lead or head of GRC?

A GRC lead or head of GRC stops doing most of the evidence work and starts owning the programme. That means setting the plan and budget, reporting risk to the board, deciding what to build in-house and what to buy, and bringing in outside help, such as auditors, specialists or a fractional CISO, when the team cannot cover the gap.

Four things change at this level:

1. You own the programme, not the tasks. The audit calendar, the risk register and the control set become your responsibility, even when others do the work.
2. You hold a budget. You decide where money goes: tooling, external audit, training, contractors or another hire.
3. You report to the board. Directors need to know which risks matter and what you recommend. ISO 27001's requirements on monitoring, measurement, analysis and evaluation are a good model for the measures behind that report.
4. You decide when to bring in outside help. A small team cannot hold every specialism. Knowing when to buy expertise, and how to brief it, is now part of the job.

The step from director of GRC to an executive role adds formal accountability. A CISO, chief risk officer or chief compliance officer answers for the risk itself, not only for the programme that manages it.

The jump from GRC lead to head of GRC is not about knowing more controls. It is about being the person the board trusts to say which risk matters.

What other routes branch off the GRC career path?

Not every GRC career path goes straight up. Common branches lead into GRC engineering, privacy, third-party risk, internal audit, and vCISO or fractional work. Each one builds on the same core of controls, evidence and risk, and each can lead back into a head of GRC role later with a sharper specialism.

• GRC engineering. Automating evidence collection and control monitoring with code, so compliance runs as a system rather than an annual project. It suits people who enjoy scripting and working with engineering teams.
• Privacy. Data protection work under UK GDPR, often with a privacy information management system such as ISO 27701. It suits people who like regulation and the legal side of risk.
• Third-party risk. Assessing suppliers and managing the risk they bring, the work behind ISO 27001 Annex A 5.19 on supplier relationships. It suits people who like structured assessment and negotiation.
• Internal audit. Independent assurance over controls, including IT general controls. It suits people who like testing and writing findings, and it is the natural home of the CISA.
• vCISO and fractional work. Senior people who lead security and GRC for several smaller firms at once. It usually comes after head of GRC or CISO experience, not before.

How does the UK Cyber Security Council fit into a GRC career?

The UK Cyber Security Council gives a UK route that sits alongside certifications. Its Cyber Career Framework sets out 15 specialisms, including governance and risk management, and suggests pathways between them. The Council, which holds Royal Chartered status, also awards four professional titles that reflect progression and expertise.

The Cyber Career Framework describes each specialism's responsibilities, skills and common job titles. The Council says it is a flexible guide for planning a career, not a standard to follow rigidly. For a GRC professional, the governance and risk management specialism is the closest fit, with audit and assurance a natural neighbour.

The professional titles are Associate, Practitioner, Principal and Chartered Cyber Security Professional. Unlike a certification, a title is assessed against the Council's professional standards, so it speaks to competence and commitment as well as knowledge.

We recommend looking at the titles once you reach lead level. A chartered title is a UK-recognised signal that travels well with regulated clients and public sector buyers.

What are the common mistakes on the GRC career path?

The common mistakes on the GRC career path are collecting certifications without owning outcomes, staying in evidence work too long, chasing the title instead of the scope, and never learning to speak to the board. Each one slows progress because it builds knowledge that nobody else can see working.

• Certifications without outcomes. A CRISC with no risk decisions behind it is a weak story at interview. Pair each certification with something you ran.
• Staying in evidence work. If every task you do ends with "collected", start owning a process that ends with "decided" or "fixed".
• Chasing titles. A head of GRC title at a firm with no programme can teach less than a GRC lead role at a firm with a mature one.
• Avoiding the board. Ask to present one risk to a leadership meeting before you need to. It is the skill that most separates a manager from a head of GRC.

A career built only on audits passed has a ceiling. A career built on risks reduced does not.

Frequently asked questions