How to Become a GRC Analyst in the UK: Skills, Routes and Roadmap

This guide covers what the job involves day to day, the standards you will meet, the skills that matter, the main routes in, and a month-by-month learning roadmap.

What does a GRC analyst do day to day?

GRC stands for governance, risk and compliance. Governance sets direction and accountability, risk management decides what the organisation worries about and in what order, and compliance shows a third party that the first two are really happening. A GRC analyst works across all three, and the job is mostly writing, structuring and evidencing rather than operating security tools.

A typical week might include:

• Risk work: running a risk assessment workshop with a system owner, scoring the risks found, and updating the risk register with an owner and a treatment decision for each.
• Policy work: reviewing an access control policy that is due its annual review, or drafting a procedure so that staff know exactly what to do.
• Compliance mapping: taking a requirement (from a standard, a contract or a customer questionnaire) and identifying which internal control meets it and what evidence proves it.
• Audit support: collecting evidence for an internal or external auditor, and tracking findings until they are closed.
• Supplier risk: reviewing a new supplier’s security answers before a contract is signed.
• Reporting: turning all of the above into a short summary for management that says whether the organisation is exposed, whether that is improving, and what decision is needed.

The free LSCS lesson What is GRC? explains how the three parts depend on each other, and Cybersecurity compliance explained covers mapping and evidence in more detail.

The frameworks and laws a UK GRC analyst needs to know

You do not need to memorise every framework. You need to understand what each one is for, who asks for it, and how its requirements turn into controls and evidence. These four come up often in UK roles:

A few details are worth knowing early:

• ISO/IEC 27001: the organisation compares the controls it needs against the reference list in Annex A and records the result in a Statement of Applicability, including the justification for excluding any Annex A control.
• NIST CSF 2.0: the Govern Function covers the organisation’s cybersecurity risk management strategy, roles and responsibilities, policy and oversight, which is GRC territory almost word for word.
• Cyber Essentials: the five technical controls are firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus checks the same controls with independent technical testing. The scheme is delivered through IASME, the NCSC’s Cyber Essentials Delivery Partner.
• UK GDPR: when a personal data breach is likely to pose a risk to people’s rights and freedoms, the ICO must be notified as soon as possible and, where feasible, within 72 hours. GRC analysts often help design and test the process that makes this possible. The Data (Use and Access) Act 2025 changed parts of the regime, and the ICO is updating its guidance, so check the ICO site rather than older summaries.

Once these four are comfortable, add NIST SP 800-53, ISO/IEC 27002, the CIS Controls and ISO 31000 (risk management). The core skill is the same throughout: one well-designed control usually satisfies requirements in several frameworks at once.

The skills employers look for

GRC is one of the more accessible entry points into cybersecurity because the core skills transfer from many other jobs. In practice, the people who do well can show:

• Clear writing. Policies, risk statements and management reports are the main outputs of the role. If a busy manager cannot understand a risk in two sentences, it will not get a decision.
• Structured thinking. Breaking a vague concern (for example, “our suppliers worry me”) into specific risks with owners, likelihood, impact and treatment options.
• Enough technical literacy. You do not need to configure a firewall, but you do need to understand what one does, what multi-factor authentication protects against, and what a vulnerability scan report is telling you.
• Stakeholder skills. Much of the job is asking good questions of engineers, HR, legal and finance, and getting evidence from people who are busy with other things.
• Comfort with spreadsheets and documents. Risk registers, control trackers and management dashboards are often built in Excel or similar tools, so being quick and tidy with them helps.
• Judgement about proportion. Knowing when a control is genuinely needed and when it is box-ticking that the business will quietly ignore.

Routes into GRC in the UK

There is no single entry route, and many GRC analysts did something else first. The common paths are:

1. From IT support or service desk. You already understand access requests, patching and asset lists, which are the raw material of many controls. Volunteering to help with audit evidence or a Cyber Essentials submission is a natural first step. (We cover this move in detail in a separate article on switching from IT support to GRC.)
2. From audit, compliance, legal or risk roles. You already understand evidence, regulation and control testing. The gap is usually security knowledge, which the frameworks above help close.
3. From project, operations or administrative roles. Process mapping, document control and stakeholder management transfer directly. Focus on building security vocabulary and a portfolio.
4. From university. Graduates from any discipline can apply for junior GRC, information security or compliance analyst roles. A portfolio matters more than the subject of your degree.

Job titles vary, so search for more than “GRC analyst”: information security analyst (governance), cyber risk analyst, compliance analyst, information security officer, third-party risk analyst and IT auditor all overlap. For pay, see our separate guide to GRC salaries in the UK rather than relying on a single headline figure.

A 12-month GRC learning roadmap

This plan assumes around five to eight hours a week alongside a job. Each stage ends with something you can show an employer.

For a sense of what a good risk register looks like, read What is a risk register and how to use one, and for the assessment process itself, How to conduct a cyber risk assessment.

On certifications: ISC2 lists two years of required work experience for CGRC, and ISACA requires three years of information systems audit, control or security experience for CRISC, so for most newcomers they are a later step; we compare CGRC, CRISC and ISO/IEC 27001 courses in a separate article.

Common mistakes when starting out

• Collecting frameworks instead of applying them. Knowing the names of ten frameworks is less useful than having mapped one control set properly.
• Treating compliance as security. Compliance shows that specific requirements were met at a point in time. It is a floor, not a ceiling, and good GRC analysts say so.
• Writing for auditors, not for staff. A policy nobody can follow creates risk rather than reducing it.
• Skipping the portfolio. Hiring managers for junior roles want to see work. Anonymised samples of a policy, a register and a report are often more persuasive than another course certificate.

How the free LSCS GRC course and mentorship fit

If you want a structured place to start, the London School of Cybersecurity publishes Learning GRC in 12 Weeks, a free course of twelve sessions, each with a video and a written summary. It runs from what GRC is through governance, risk management, compliance, control domains, policy writing, risk assessment, management reporting, risk registers and audit support, and maps closely onto months 1 to 10 of the roadmap above.

For people who want a mentor alongside them, the GRC Mentorship programme runs for six months at £150 a month. It combines self-paced material with weekly live mentor-led sessions, and includes policy drafting, risk registers, mock audits, three mini-projects and a capstone project, plus CV, LinkedIn and mock interview support. Cohort dates are not fixed in advance, so contact us for dates.

Frequently asked questions

Do I need a technical background to become a GRC analyst?

No. GRC work is mainly writing, structuring and evidencing, so people move in from audit, legal, project, operations and IT support roles. You do need enough technical literacy to understand what common security controls do.

Which framework should I learn first?

Start with ISO/IEC 27001:2022, because its management system structure gives the other frameworks somewhere to fit, then learn NIST CSF 2.0, Cyber Essentials and the security parts of UK GDPR. The skill that matters is mapping requirements to controls and evidence.

How long does it take to become a GRC analyst?

With five to eight hours of study a week, a realistic plan is around 12 months to build the knowledge and a portfolio for junior roles. People already working in audit, compliance or IT may move faster.

Is there a GRC bootcamp or course in London?

LSCS, based in Harrow, London, offers a free 12-session GRC course online and a six-month GRC Mentorship programme at £150 a month with live online sessions. Contact LSCS for cohort dates.

Do I need a certification to get my first GRC job?

Not always. Some certifications, such as ISC2’s CGRC, require prior work experience, so many newcomers rely on a portfolio of policies, risk registers and reports for their first role.

References

• International Organization for Standardization and International Electrotechnical Commission (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection: Information security management systems: Requirements (IEC Webstore listing). https://webstore.iec.ch/publication/79694
• Slovenian Institute for Standardization (SIST) (2022). ISO/IEC 27001:2022 redline preview (third edition compared with second edition). https://preview.sist.si/sist-preview/82875/4d4c8d99950c4b39aaa39cf5cb9a0bf3/ISO-IEC-27001-2022.pdf
• International Organization for Standardization (2022). ISO/IEC 27001:2022. https://www.iso.org/standard/27001
• National Institute of Standards and Technology (2024). The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
• National Cyber Security Centre (2026). Cyber Essentials overview. https://www.ncsc.gov.uk/cyberessentials/overview
• Information Commissioner’s Office (2026). A guide to the data protection principles. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/
• Information Commissioner’s Office (2026). Personal data breach. https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/
• legislation.gov.uk (2026). UK GDPR, Article 33: Notification of a personal data breach to the Commissioner. https://www.legislation.gov.uk/eur/2016/679/article/33
• legislation.gov.uk (2018). Data Protection Act 2018 (c. 12). https://www.legislation.gov.uk/ukpga/2018/12/contents
• legislation.gov.uk (2025). Data (Use and Access) Act 2025 (c. 18). https://www.legislation.gov.uk/ukpga/2025/18/contents
• ISC2 (2026). CGRC: Governance, Risk and Compliance Certification. https://www.isc2.org/certifications/cgrc
• ISACA (2026). CRISC: Certified in Risk and Information Systems Control. https://www.isaca.org/credentialing/crisc
• ISACA (2026). Get CRISC certified. https://www.isaca.org/credentialing/crisc/get-crisc-certified
• London School of Cybersecurity (2026). Learning GRC in 12 Weeks. https://lscs.io/learn/grc/
• London School of Cybersecurity (2026). GRC Mentorship Program. https://lscs.io/grc-mentorship-course-details/