The GRC analyst path
You turn a security standard into things the organization actually does, and prove it did them. It is the most reachable security role for non-technical backgrounds — audit, admin, project, legal transfer in — and the least hands-on of this family: written artifacts carry the role.
Published 2026-10-09 · generated from the lesson data · serves GRC analyst
Work the groups in order. Each checkpoint is a gate: do not move on until you can do it unaided. The capstone is level 4 — original work, made public, verifiable by a stranger.
Foundations, lighter
Read for vocabulary — enough networking, HTTP, and crypto language to read a control intelligently. The packet labs are optional on this path.
Risk and continuity
Asset security
Assessment and testing
Running the program
AI governance
Governance frameworks
Checkpoints
- One control mapped to exact evidence — the control, the artifact that proves it, where it lives.
- A risk written so a director can decide on it: one page, no jargon.
- A policy a real employee could follow without asking questions.
The capstone
Level 4 — Extend: Complete published GRC work product. A risk assessment of a fictional company, a control implementation guide, or an audit plan — published and written to be used, not to be admired. That is the artifact a hiring stranger checks.