Jobs › GRC Analyst
GRC Analyst Jobs
GRC Analyst roles across governance, risk, compliance, and AI governance.
Open GRC Analyst roles (2)
Senior Information Security & GRC Analyst (2 positions)
Cybersecurity GRC Analyst
About the GRC Analyst role
The GRC Analyst is the most common entry point into a governance, risk, and compliance career. Analysts keep the control environment running day to day: they test controls, track findings, maintain risk registers, and help the business answer audit and regulatory requests. It is hands-on, detail-heavy work, and it is where most GRC and AI-governance leaders started. As AI enters the control environment, analysts are increasingly the ones documenting how models are governed.
What a GRC Analyst does
- Test and document internal controls against frameworks like SOC 2, ISO 27001, and NIST
- Maintain risk registers and track remediation of findings
- Gather evidence and respond to internal and external audit requests
- Support vendor and third-party risk reviews
- Help map controls across multiple frameworks
- Track emerging requirements, including AI governance controls
Core skills
- Attention to detail and strong documentation habits
- Working knowledge of common control frameworks
- Comfort with spreadsheets and GRC tooling
- Clear written communication for findings and reports
- Basic understanding of IT and security concepts
- Curiosity about regulation and how rules map to controls
Certifications that help
Train for these through the GRC Careers certification guides.
Where it sits on the career ladder
GRC Analyst (Entry) · GRC Manager →
How to break into this role
Most GRC Analysts come in from adjacent work: IT support, audit, security, or a compliance-heavy operations role. A degree helps but is not required; what hiring managers screen for is care with detail, clear writing, and a basic grasp of how controls and frameworks work. Start by learning one framework well (SOC 2 or ISO 27001), get comfortable gathering evidence, and add a foundational certification. From there the path runs to GRC Manager and beyond.
BLS put the 2024 median at $78,420. In 2026, market trackers show averages from roughly $99,000 to $120,000, with the top quartile above $160,000. Financial centers and senior governance roles sit at the top of that range.
Sources: BLS, 2024 median
FAQ
Not necessarily. Many analysts move in from IT, audit, security, or operations roles. Hiring managers prioritize attention to detail, clear writing, and a basic understanding of control frameworks over years of direct GRC experience.
A foundational risk or audit certification is a strong start. CRISC, CISA, and CDPSE are commonly cited, though some require work experience; entry candidates often begin with framework knowledge such as SOC 2 or ISO 27001 while they build hours.
Testing and documenting controls, maintaining risk registers, gathering audit evidence, supporting vendor risk reviews, and mapping controls across frameworks. Increasingly that includes documenting how AI models are governed.
All GRC jobs · Job alerts