GRC Analyst Path
Career-changers entering Cybersecurity through governance, risk & compliance, no technical background needed.
Assessed work, a capstone and a verified credential
What the path adds
Membership covers foundation reading. A path is where the work is assessed and the credential is earned.
- Marked work
- Your written submissions are assessed against a rubric, not ticked off.
- Cumulative assessment
- One exam across the whole path, not a quiz per course.
- Capstone
- A final piece of real work, reviewed.
- Portfolio artefact
- Something you can put in front of a hiring manager.
- Verified credential
- A Professional Path Credential with a public verification page.
What this path makes you able to do.
- Build and maintain a risk register and run qualitative risk assessments
- Map controls across ISO 27001, NIST and SOC 2
- Write policies and support internal & external audits
The 5-step path.
- 1View course
Cybersecurity Foundations
The core concepts & landscape
- 2View course
GRC Analyst Certification
Governance, risk & compliance core
- 3View course
ISO 27001 Internal Auditor
Audit against Annex A
- 4View course
SOC 2 Readiness
Gap to audit-ready
Capstone: full GRC package
Policies, risk register, control matrix, audit-prep report
Hands-on lab work.
Every step above is backed by real practice in Atlas, our simulated workbench. You do the work an employer would hand you, and you keep the artifacts as portfolio evidence.
Third-Party Risk Assessment
Run a vendor through the full TPRM lifecycle: due diligence, a security questionnaire, a SOC 2 review, risk scoring, and continuous monitoring. Then decide whether to approve, mitigate, or walk away.
ISO 27001 ISMS Implementation
Stand up a real ISMS end to end: scope and context, leadership, the risk assessment and treatment, the asset inventory, and the Statement of Applicability across all 93 Annex A controls, the way a lead implementer builds it for certification.
SOC 2 Readiness Assessment
Take a company from gap to audit-ready: map controls to the Trust Services Criteria, run the gap analysis, write the findings using the five Cs, and build the remediation plan before the CPA engagement.
GRC Program Foundations
Build a GRC program from scratch: governance and scope, the core policy library, and a cross-framework control matrix that maps each control once to NIST, ISO 27001, SOC 2, and CMMC. Implement once, comply many.
Privacy & Data Protection
Stand up a privacy program: build the Records of Processing Activities with the right GDPR lawful bases, run a DPIA on the high-risk profiling, and handle data-subject rights and transfers across GDPR and CCPA.
HIPAA Security & Risk Analysis
Make a healthcare provider HIPAA-defensible: run the foundational ePHI risk analysis, then assess the Security Rule's Administrative, Physical, and Technical safeguards (Required vs. Addressable), the way an OCR audit tests them.
Hands-on labs. A final exam & capstone. A real role.
You finish with a portfolio you can show, a cumulative exam, and the skills to land the GRC Analyst role.
Not sure this is the one? Take the free fit and aptitude check first: twelve short questions, instant answer.