GRC Analyst Salary in the UK: What the Data Shows
There is no single UK salary for a GRC analyst, and no public source tracks that exact job title. The closest data, from ITJobsWatch, shows that UK permanent job adverts citing GRC skills quoted a median of £75,000 in the six months to 10 November 2026, with the middle half between £55,000 and £95,000. Those adverts include architects, consultants and managers, so analyst roles usually sit lower: adverts titled Security Analyst had a median of £55,000 over the same period.
This article sets out what each source actually measures, why the figures disagree, and what the data can and cannot tell you about pay as you progress from analyst to manager.
The headline numbers, and what they measure
ITJobsWatch tracks UK IT job adverts and publishes salary percentiles calculated, in its own words, “directly from the figures quoted in job vacancy postings”. It counts each vacancy once, even if it was posted on several job boards. Its GRC page covers permanent vacancies citing GRC skills, which is a different measure from its job title pages: ITJobsWatch reads a job title only from the title of an advert.
| Permanent ads citing GRC, 6 months to 10 Nov 2026 | UK | London | UK excluding London |
|---|---|---|---|
| Salaries quoted | 368 | 152 | 195 |
| 10th percentile | £45,000 | £57,500 | £41,750 |
| 25th percentile | £55,000 | £75,000 | £48,750 |
| Median | £75,000 | £90,000 | £60,000 |
| 75th percentile | £95,000 | £100,750 | £83,750 |
| 90th percentile | £111,500 | £120,000 | £102,750 |
Three things to keep in mind when reading this table:
- These are advertised salaries, not what people were actually paid. Many adverts give no salary at all.
- The sample is small. 368 salaries across the whole UK is a thin base, and regional figures thin out quickly. Some regional breakdowns rest on fewer than ten quoted salaries, which is far too few to rely on.
- The figures move. The UK median for the same six-month period was £69,248 in 2025 and £70,000 in 2024. Treat any single period as a snapshot.
Why the GRC median overstates typical analyst pay
An advert only has to cite GRC skills to be counted. ITJobsWatch’s breakdown of job titles in those adverts shows the mix: Architect appeared in 18.3% of them, Consultant in 16.3% and Analyst in 10.7%, with Security Manager, Governance Manager, Compliance Manager and Head of Security also on the list. A median across that mix describes a blend of seniorities, not an analyst salary.
ITJobsWatch makes the same point about its own figures: “the salary and rate figures for a broad title describe a mixture of specialisms and levels”. Title-based figures help a little, although none of them is a clean match for “GRC Analyst”, which ITJobsWatch does not track as a separate title.
| Advert job title (UK permanent, 6 months to 10 Nov 2026) | Salaries quoted | 25th percentile | Median | 75th percentile |
|---|---|---|---|---|
| Cybersecurity Analyst | 189 | £42,500 | £47,500 | £65,000 |
| Security Analyst | 341 | £44,000 | £55,000 | £75,000 |
| Security Manager | 529 | £55,000 | £66,690 | £85,000 |
| Information Security Manager | 50 | £65,000 | £75,000 | £97,500 |
| Head of Security | 67 | £80,000 | £92,500 | £100,000 |
| Head of Information Security | 24 | £90,000 | £99,500 | £100,875 |
Be careful with “Governance Analyst”. ITJobsWatch lists a £60,000 median for UK permanent adverts with that title in the six months to 10 November 2026, but the skills most often named in those adverts are information governance and data governance, so it mostly describes data roles rather than cyber GRC.
Why salary sources disagree
If you compare salary guides, you will see different numbers for what sounds like the same job. That is usually down to method, not error:
- Adverts versus surveys. Advert data reflects what employers offer for open roles. Survey data reflects what people in post report earning. The two answer different questions.
- Skill versus title. A count of ads mentioning “GRC” catches senior roles that use the term. A title-based count misses analysts whose adverts are titled something else, such as “Information Security Analyst” or “Risk and Compliance Officer”.
- Missing salaries. The UK government’s Cyber security skills in the UK labour market 2026 report found that 76% of online postings for core cyber roles in 2025 gave no salary information. Any advert-based figure rests on the minority that did.
- Mean versus median. ITJobsWatch uses the median because a few very high salaries pull an average upwards. The same government report gives both: a mean advertised salary of £60,800 and a median of £58,050 for core cyber job postings in 2025.
- Period and coverage. A rolling six-month window, a calendar year and a one-off survey will rarely line up.
The government report, published on GOV.UK on 29 September 2026 and based on research carried out by Ipsos and Perspective Economics for the Department for Science, Innovation and Technology, does not break salaries down by GRC or analyst role. Its figures cover core cyber roles as a whole.
What drives GRC pay, where the data supports it
Seniority. This is the clearest effect in the title data above: medians rise from the analyst titles to manager and head-of titles.
London versus elsewhere. In the ITJobsWatch GRC data for permanent adverts in the six months to 10 November 2026, the London median (£90,000) was £30,000 above the UK-excluding-London median (£60,000). The government report shows the same pattern for core cyber roles in 2025, with London offering the highest mean advertised salary of any region at £70,200.
Contract versus permanent. Contract roles citing GRC quoted a median daily rate of £575 over the six months to 10 November 2026, with the middle half between £492 and £656 (316 rates quoted). A day rate is not comparable to a salary without allowing for unpaid gaps between contracts, holidays and the costs contractors carry themselves.
Certifications. Over the same period, CISSP was named in 20.1% of permanent GRC adverts and CISM in 16.2%. Across all UK permanent adverts in the same six months, those citing CISM had a median salary of £80,000, and those citing CISSP also had £80,000. That shows the certifications appear in well-paid adverts, many of them senior. It does not prove that holding one adds a fixed amount to your pay.
Sector. We found no public, dated source that breaks GRC pay down by sector, so we make no claim about it. What the advert data does show is which frameworks employers name: ISO/IEC 27001 appeared in 38.7% of GRC adverts, NIST in 26.7% and GDPR in 18.9%, and 16.6% mentioned security clearance.
Progression from analyst to manager
No public dataset follows individual GRC careers over time, so the path below is a typical structure, not a measured one. The titles map to the rows in the table above.
- Analyst (GRC, compliance, risk or security analyst): evidence gathering, control testing, maintaining the risk register, supporting audits.
- Senior analyst or consultant: running risk assessments and audits end to end, writing policy, advising the business.
- Manager (GRC manager, information security manager): owning the programme, reporting to senior management, managing people.
- Head of information security or CISO: setting direction and owning security risk at board level.
Demand for these skills is visible in the government research. It asked UK cyber security businesses which of the 15 specialisms in the UK Cyber Security Council’s Cyber Career Framework they employ staff in, and cyber security governance and risk management came top (45%). Among firms with hard-to-fill vacancies, it was also the most commonly cited hard-to-fill specialism (27%). The same report notes that principal-level roles, with around 6 to 9 years of experience, became significantly harder to fill.
What about entry-level GRC salaries?
The honest answer is that the data is thin. Neither ITJobsWatch nor the government report publishes a figure for junior or graduate GRC roles. The 10th percentile of UK permanent GRC adverts in the six months to 10 November 2026 (£45,000) is not an entry salary, because the adverts behind it are mostly experienced roles.
The nearest official indicator is broader. The government report’s analysis of HESA Graduate Outcomes data found that graduates working in cyber professional roles (mostly from cyber security and computer science courses) had a median full-time salary in the £30,001 to £35,000 band within 15 months of graduating (2022/23 graduates, HESA Graduate Outcomes survey 2023/24). That covers all cyber roles, not just GRC, and only graduates.
How to use these numbers
- Use a range, not a point. The 25th to 75th percentile range tells you more than any median.
- Match like with like: the same title, location, contract type and period.
- Check the sample size before trusting a regional or niche figure.
- Read the job description, not the title. A “GRC Analyst” advert asking for five years of audit leadership is a senior role.
- Recheck before you negotiate. ITJobsWatch figures cover a rolling six-month window, so they will have moved by the time you read this.
Building GRC skills with LSCS
If you are preparing for a first GRC role, our free Learning GRC in 12 Weeks course covers risk assessment, policy writing, risk registers and audit support. You can start with the session on supporting audit and compliance requirements. For structured support, the GRC Mentorship programme runs for six months at £150 a month and includes mentor-led sessions, portfolio projects and mock interviews. Contact us for dates.
Frequently asked questions
What is the average GRC analyst salary in the UK?
No public source tracks the GRC Analyst title on its own. UK permanent adverts citing GRC skills had a £75,000 median in the six months to 10 November 2026 (ITJobsWatch), but they include senior roles. Adverts titled Security Analyst had a £55,000 median over the same period.
How much do GRC roles pay in London?
ITJobsWatch recorded a £90,000 median for London permanent adverts citing GRC in the six months to 10 November 2026, against £60,000 for the UK excluding London. Both figures mix analyst and senior roles.
What is the day rate for GRC contract work in the UK?
UK contract adverts citing GRC quoted a median of £575 a day in the six months to 10 November 2026, with the middle half between £492 and £656 (ITJobsWatch).
Do CISSP or CISM increase GRC pay?
Adverts citing CISM or CISSP had medians of £80,000 in the six months to 10 November 2026, but many of those adverts are senior roles. The data shows an association, not a fixed premium for holding the certificate.
Why do GRC salary guides give different figures?
They measure different things: advertised or reported pay, skills or job titles, mean or median, and different periods and samples. Always check what a figure measures before comparing it.
References
- IT Jobs Watch (2026). Governance, Risk Management and Compliance (GRC): UK permanent job trends, 6 months to 10 November 2026. https://www.itjobswatch.co.uk/jobs/uk/grc.do
- IT Jobs Watch (2026). GRC Job Trends in London. https://www.itjobswatch.co.uk/jobs/london/grc.do
- IT Jobs Watch (2026). GRC Job Trends in the UK excluding London. https://www.itjobswatch.co.uk/jobs/uk%20excluding%20london/grc.do
- IT Jobs Watch (2026). GRC Contract Job Trends. https://www.itjobswatch.co.uk/contracts/uk/grc.do
- IT Jobs Watch (2026). Job title pages: Security Analyst, Cybersecurity Analyst, Security Manager, Information Security Manager, Head of Security, Head of Information Security, Governance Analyst. https://www.itjobswatch.co.uk/jobs/uk/security%20analyst.do (and equivalent title URLs)
- IT Jobs Watch (2026). CISSP and CISM job trends. https://www.itjobswatch.co.uk/jobs/uk/cissp.do ; https://www.itjobswatch.co.uk/jobs/uk/cism.do
- IT Jobs Watch (2026). About IT Jobs Watch (methodology). https://www.itjobswatch.co.uk/about
- Department for Science, Innovation and Technology (2026). Cyber security skills in the UK labour market 2026, published 29 September 2026. https://www.gov.uk/government/publications/cyber-security-skills-in-the-uk-labour-market-2026/cyber-security-skills-in-the-uk-labour-market-2026
Stay Ahead With LSCS
Get critical Cybersecurity updates, events invitations, and industry analysis. Our immersive, hands-on training is the most direct path to a high-growth cyber career.