From IT Support to GRC: A Career-Change Guide
Yes, service desk and IT support staff can move into governance, risk and compliance (GRC), and they usually start with more relevant experience than they realise. Access requests, asset records, change tickets and incident logs are the raw material that GRC teams turn into controls, evidence and risk decisions. What you normally need to add is the language of risk and frameworks, practice at writing policy, and an understanding of how audits work, and a realistic plan for building those alongside a full-time job is 6 to 12 months.
This guide is written for UK IT support staff. It shows which parts of your current job already count, what to learn, how to get GRC experience without changing employer, and how to put it on your CV.
Why IT support is a sensible route into GRC
GRC work is about showing that security is being run deliberately: someone decided what matters, controls exist, and there is evidence that they operate. A lot of that evidence lives in the systems IT support already uses every day. When an auditor asks “how do you know leavers lose access?” or “how are changes to production approved?”, the answer is usually a set of tickets.
That gives you two advantages over someone coming from a non-technical background. You know how the processes actually run, rather than how the policy says they run. And you know where the gaps are, because you are the person who sees the access request with no approval or the laptop that never made it into the asset register.
The shift is in perspective. In support you ask “is this ticket resolved?”. In GRC you ask “does this process reliably do what we have told customers, auditors and the board it does, and what happens if it does not?”.
Which of your IT support skills map directly to GRC
If your organisation uses ITIL, you will recognise the practice names below. ITIL was managed by AXELOS, which PeopleCert acquired in 2021, and PeopleCert lists Incident Management, Service Request Management, Change Enablement, IT Asset Management and Service Configuration Management among the ITIL 4 practices. The right-hand column shows where the same work appears in NIST Cybersecurity Framework (CSF) 2.0 and the UK’s Cyber Essentials scheme.
| What you do now | ITIL 4 practice | GRC equivalent | Where frameworks mention it |
|---|---|---|---|
| Maintaining asset records or a CMDB | IT Asset Management, Service Configuration Management | Asset inventory, defining the scope of an audit or certification | CSF 2.0 ID.AM-01 and ID.AM-02 (inventories of hardware, software, services and systems) |
| Processing access requests, joiners, movers and leavers | Service Request Management | Access control, periodic access reviews, least privilege | CSF 2.0 PR.AA-05; Cyber Essentials “User access control” |
| Raising and implementing change tickets | Change Enablement | Change control evidence, risk assessment of changes | CSF 2.0 ID.RA-07 (changes and exceptions assessed for risk impact) and PR.PS-01 (configuration management) |
| Logging and escalating incidents | Incident Management | Incident response, breach records, lessons learned | CSF 2.0 Incident Management (RS.MA) |
| Patching and building devices | n/a (varies by organisation) | Vulnerability and configuration controls | Cyber Essentials “Security update management” and “Secure configuration” |
| Writing knowledge articles and how-to guides | n/a (varies by organisation) | Writing procedures and supporting policy | CSF 2.0 Policy (GV.PO) |
PeopleCert frames Change Enablement around maximising the number of successful service and product changes, with risks assessed and changes authorised and scheduled. GRC looks at the same process from the other side: is every change assessed, approved and recorded, and could you prove it to an auditor six months later?
Documentation is the transferable skill people most often undersell. If you have written a knowledge article that colleagues actually follow, you have practised the core skill behind a good procedure: clear steps, written for the person doing the job.
The knowledge gaps to close
Most IT support staff need to build four things.
1. Risk
Support work is reactive: something breaks and you fix it. Risk management asks what could go wrong before it does, how likely and how damaging that would be, and what the organisation chooses to do about it. Learn how a risk statement is written, how risks are scored, the treatment options, and what a risk register is for.
2. Frameworks and standards
- ISO/IEC 27001:2022 specifies the requirements for an information security management system, including requirements for assessing and treating information security risks.
- NIST CSF 2.0, released in February 2024, organises security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is free to download and readable, which makes it a good first framework.
- Cyber Essentials is a UK certification scheme that the NCSC describes as the minimum standard of cyber security recommended by the Government. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. IASME is the NCSC’s delivery partner for it. As an IT support person you probably already operate most of these controls.
3. Policy writing
You need to know the difference between a policy (what the organisation requires and why), a standard (the specific rules that meet it) and a procedure (the steps someone follows). Mixing the three together is a common reason security documents go unread.
4. Audit and regulation
Learn how auditors test controls, in particular the difference between design effectiveness (is the control sensibly built?) and operating effectiveness (has it actually run, every time?). Learn the basics of UK data protection obligations too. For example, the ICO’s guidance says that when a personal data breach is likely to result in a risk to people’s rights and freedoms, you must report it to the ICO within 72 hours of becoming aware of it, where feasible, and that organisations should record all breaches, whether or not they are reported. If you handle incident tickets, that changes how you think about logging them.
Ways to get GRC experience in your current job
These are suggestions, not promises: what is possible depends on your organisation, and you should agree anything outside your normal role with your manager first. The aim is to produce real work you can describe in an interview.
- Offer to help with evidence. If your organisation holds Cyber Essentials or ISO/IEC 27001 certification, or goes through customer security questionnaires, someone has to gather screenshots, exports and ticket samples. Volunteer to help.
- Run an access review. Pick one system, export the user list, compare it with HR’s list of current staff, and report what you find to the system owner. That is a control test with a finding.
- Reconcile the asset register. Compare the asset records with what your device management tool can actually see. Document the gaps and how you would close them.
- Write or rewrite a procedure. Take a process you know well, such as the leavers process, and turn it into a short, owned, dated procedure.
- Look for patterns in incidents. If the same type of incident keeps recurring, write it up as a risk: what could happen, how likely, the impact, and a proposed treatment. Ask whether it can go on the risk register.
- Sit in on change approval. If there is a change advisory board, ask to observe and note how risk is discussed.
- Find the GRC or compliance team. In a larger organisation, ask for a short conversation about what their week looks like and where they need help.
Keep a simple log of each piece of work: what you did, why it mattered and what changed. That log becomes your CV bullets and your interview stories.
How to describe IT support experience on a GRC CV
Recruiters for GRC roles are scanning for control, risk and evidence language. Rewrite your support experience in those terms, without overstating it.
For example, imagine a service desk analyst whose CV currently says “Handled joiner, mover and leaver requests”. A GRC-focused version might read: “Operated the joiner, mover and leaver access process for around 300 users; identified that leaver requests lacked consistent manager approval and proposed a checklist that was adopted by the team.” Only use numbers and outcomes that are true for you.
Some practical rules:
- Lead with outcomes and controls, not tools. “Maintained hardware inventory used as the scope for Cyber Essentials” says more than a list of software names.
- Name frameworks only where you actually worked with them, and say how (for example “gathered evidence for”, not “implemented”).
- Add a short projects section for the work you did on purpose to build GRC skills, such as an access review or a procedure you wrote.
- Keep the technical skills. Being able to read a firewall rule or a group policy setting helps you judge whether a control really works, not just whether it is documented.
A 6 to 12 month plan
This plan assumes a few hours a week of study alongside full-time work. Stretch it if you need to; the order matters more than the speed.
| Months | Focus | Output to aim for |
|---|---|---|
| 1 to 2 | GRC basics, risk vocabulary, read NIST CSF 2.0 and the Cyber Essentials requirements | A one-page map of your organisation’s IT processes against the CSF functions |
| 3 to 4 | Policies, standards and procedures; how ISO/IEC 27001 is structured | One procedure written or rewritten at work, plus a sample policy for your portfolio |
| 5 to 6 | Risk assessment and risk registers; consider a foundation-level certificate | A small risk assessment of one system or process, with a risk register entry |
| 7 to 9 | Audit and evidence: control testing, findings and remediation | An access review or asset reconciliation completed and reported |
| 10 to 12 | Reporting to management, CV rewrite, applications | A short management summary of your findings, an updated CV, and applications for junior GRC, compliance or IT risk roles |
On certifications: a foundation-level qualification can help a CV get past a first screen. One UK option is the BCS Foundation Certificate in Information Security Management Principles, which BCS says has no formal entry requirements (candidates should have basic working IT knowledge) and covers risk management, security standards, legislation and business continuity. Treat more senior certifications as later goals. ISACA’s CRISC, for example, requires at least three years of relevant work experience.
Where LSCS fits
If you want to start now at no cost, our free Learning GRC in 12 Weeks course covers risk, policy writing, risk registers, audits and management reporting, with a video and written summary for each session; the session on supporting audit and compliance requirements is a good one for IT support staff to begin with. For mentor-led support, the GRC Mentorship programme runs over six months at £150 a month and is aimed in part at IT professionals moving into GRC, with policy drafting, risk registers, mock audits, a capstone project and CV guidance. Contact us for dates.
Frequently asked questions
Can I move from IT support to GRC without a degree?
Entry requirements are set by each employer, so check the job adverts you are interested in. Whatever your qualifications, practical evidence from IT support, such as an access review or a procedure you wrote, gives you something concrete to show.
How long does it take to move from IT support into GRC?
A realistic plan is 6 to 12 months of part-time study and on-the-job projects before applying for junior GRC, compliance or IT risk roles. It depends on your time and the opportunities at your current employer.
Does ITIL help with a GRC career?
Yes, indirectly. ITIL 4 practices such as Change Enablement, Incident Management and IT Asset Management cover processes that GRC teams test and rely on for evidence.
Which framework should I learn first?
NIST CSF 2.0 is free and readable, and Cyber Essentials is a UK scheme whose five controls most IT support staff already operate. Move on to ISO/IEC 27001 once you understand the basics.
Which certification should an IT support person take for GRC?
A foundation-level qualification such as the BCS Foundation Certificate in Information Security Management Principles has no formal entry requirements. Senior certifications such as ISACA’s CRISC require at least three years of relevant experience, so they are later goals.
References
- PeopleCert (2021). PeopleCert completes Axelos acquisition. https://www.peoplecert.org/news-and-announcements/2021/peoplecert-completes-axelos-acquisition
- PeopleCert (accessed 2026). ITIL 4 practices. https://www.peoplecert.org/en/pages/itil4-practices
- NIST (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST (2024). NIST Releases Version 2.0 of Landmark Cybersecurity Framework. https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework
- NCSC (accessed 2026). Cyber Essentials: overview. https://www.ncsc.gov.uk/cyberessentials/overview
- ISO/IEC (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection: Information security management systems: Requirements (IEC Webstore listing). https://webstore.iec.ch/publication/79694
- ICO (accessed 2026). Personal data breaches: a guide. https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
- BCS (accessed 2026). BCS Foundation Certificate in Information Security Management Principles. https://www.bcs.org/qualifications-and-certifications/certifications-for-professionals/information-security-and-data-protection-certifications/bcs-foundation-certificate-in-information-security-management-principles/
- ISACA (accessed 2026). Get CRISC Certified. https://www.isaca.org/credentialing/crisc/get-crisc-certified
- London School of Cybersecurity (accessed 2026). How to write security policies, standards and procedures. https://lscs.io/learn/grc/writing-security-policies-standards-procedures/
- London School of Cybersecurity (accessed 2026). Supporting audit and compliance requirements. https://lscs.io/learn/grc/supporting-audit-and-compliance-requirements/
Stay Ahead With LSCS
Get critical Cybersecurity updates, events invitations, and industry analysis. Our immersive, hands-on training is the most direct path to a high-growth cyber career.