◢ Career Paths
A career path sequences the right certifications, in the right order, with a capstone, so you finish ready for a named, in-demand role. One enrollment, one focus: career readiness.
A guided journey, not a pile of courses.
How a path works. 1 · Sequenced certifications The exact programs to take, in the order that builds real competence. No guesswork.
2 · A capstone Finish by building an end-to-end portfolio piece employers and recruiters can actually see.
3 · A named role Every path points at a specific, in-demand job title, and the skills to land it.
Choose your path
Eight routes to a cyber career. Each bundles its certifications below the price of buying them separately.
Outcome → GRC Analyst GRC Analyst Path Career-changers entering Cybersecurity through governance, risk & compliance, no technical background needed.
Build and maintain a risk register and run qualitative risk assessments Map controls across ISO 27001, NIST and SOC 2 Write policies and support internal & external audits The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 GRC Analyst Certification
Governance, risk & compliance core
3 ISO 27001 Internal Auditor
Audit against Annex A
4 SOC 2 Readiness
Gap to audit-ready
Capstone: full GRC package
Policies, risk register, control matrix, audit-prep report
Outcome → SOC Analyst SOC Analyst Path People who want to work in a Security Operations Center: monitoring, triaging alerts, and responding to incidents. A hands-on route into blue-team Cybersecurity, no prior experience needed.
Triage security alerts and investigate events with a structured workflow Run the detection-to-reporting incident response lifecycle Map monitoring and response to the NIST Cybersecurity Framework The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 CompTIA Security+ Prep
Baseline security knowledge
3 CompTIA CySA+ Prep
The Cybersecurity Analyst cert: detection & analysis
4 Incident Response & Reporting
Detection-to-reporting workflows
Capstone: triage & IR runbook
Investigate events and document the response end-to-end
Outcome → TPRM Analyst Third-Party Risk Path Analysts, IT and audit staff who want to specialize in vendor and third-party risk management.
Run end-to-end vendor due diligence with SIG & CAIQ Analyze SOC 2 reports and score vendor risk Build a vendor risk register and continuous-monitoring process The journey
1 GRC Analyst Certification
Your GRC foundation
2 TPRM Specialist
The third-party risk lifecycle
3 Vendor Questionnaire Mastery
SIG · CAIQ analysis
Capstone: third-party assessment
A full vendor risk assessment report
Outcome → ISO 27001 Implementer / Auditor ISO 27001 Path Those who want to build and audit an ISO 27001 ISMS: a globally recognized route into GRC and information-security management.
Define an ISMS scope, run an ISO risk assessment and build the risk treatment plan Write a defensible Statement of Applicability across the ISO 27002 controls Plan and run internal audits to ISO 19011: findings, nonconformities and CAPA The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 GRC Analyst Certification
Governance, risk & compliance core
3 ISO 27001 Internal Auditor
Audit against Annex A
Capstone: ISMS package
Scope, risk assessment, SoA and an internal audit report
Outcome → ISSO / Security Control Assessor ISSO & Security Assessor Path Those targeting federal information-system security roles, running the NIST RMF and assessing controls toward an authorization.
Run the NIST Risk Management Framework end to end (SP 800-37) Author SSP control implementation statements and a Security Assessment Report Perform ISSO duties: categorization, POA&Ms and continuous monitoring The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 NIST RMF Implementation
Categorize → authorize → monitor
3 ISSO Training
The day-to-day ISSO role
Capstone: RMF authorization package
Categorization memo, SSP sections, SAR finding and POA&M
Outcome → IT Auditor IT Auditor Path Analysts and audit staff who want to plan and run IT audits across NIST, ISO, SOX and COBIT.
Plan a risk-based IT audit: objectives, scope and test plans Test ITGCs (access, change, operations) and gather defensible evidence Write findings with root cause and present them to leadership The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 IT Audit & Controls Fundamentals
Control design & testing
3 ISO 27001 Internal Auditor
Audit against a framework
4 SOC 2 Readiness
Trust Services controls
Capstone: audit portfolio
Audit plan, test scripts, findings memo and report
Outcome → ISSO / RMF Analyst Federal & Defense Path Those targeting U.S. government and defense-contractor roles handling controlled information.
Protect CUI and prepare for CMMC L1 & L2 against NIST 800-171 Run the NIST RMF end to end (SP 800-37) Perform ISSO duties: SSPs, POA&Ms, continuous monitoring The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 CMMC Level 1 & 2 Practitioner
CUI & NIST 800-171
3 ISSO Training
The day-to-day ISSO role
4 NIST RMF Implementation
Categorize → authorize → monitor
Capstone: RMF authorization package
SSP, POA&M and authorization artifacts
Outcome → AI Governance Analyst AI Governance Path GRC professionals future-proofing into the fast-growing field of AI governance and risk.
Apply GRC fundamentals to AI systems and data Handle privacy & data protection (GDPR / UK GDPR) Govern AI risk, regulation and controls responsibly The journey
1 GRC Analyst Certification
Your GRC foundation
2 Privacy & Data Protection
GDPR / UK GDPR
3 AI GRC Practitioner
Govern AI risk & compliance
Capstone: AI governance framework
A working AI risk & governance program
Outcome → Cloud Security Analyst Cloud Security Analyst Path People moving into cloud security and compliance, bringing security or IT awareness into AWS and Azure environments. A practical route that pairs cloud fundamentals with security and governance.
Explain cloud architecture and the shared-responsibility model across AWS and Azure Configure identity, posture (CSPM), encryption and logging to secure a cloud environment Map NIST, CMMC, FedRAMP and ISO 27001 controls onto AWS and Azure The journey
1 Cloud Computing Foundations
How the cloud works, vendor-neutral
2 AWS Cloud Practitioner Prep
Core AWS, the entry credential
3 Microsoft Azure Fundamentals Prep
Core Azure (AZ-900)
4 Cloud Security & Governance
Secure and govern the cloud
Capstone: secure a cloud environment
Posture review, IAM, control mapping, evidence pack
Every path is backed by
Hands-on labs. A capstone. A real role. Add 1:1 coaching and resume support to any path, and finish ready to apply with confidence.
Fourth Tech is a 501(c)(3) nonprofit workforce development organization advancing Cybersecurity, AI, and Cloud Computing education.
© 2026 Fourth Tech. All rights reserved. Built on faith in Jesus Christ, who guides how we teach, lead, and serve.