GRC Analyst
Governance, risk, and compliance (GRC) analysts assess the management, operational, and technical security controls of an IT system and determine how effective they are. They also evaluate IT programs for compliance with published standards and with federal laws, regulations, and requirements.
Related job titles
- Security control assessor
- Information assurance compliance analyst
- IT auditor
- Information assurance auditor
- Controls validator
What They Do
11 tasks- Assess the effectiveness of security controls.
- Monitor and evaluate a system's compliance with IT security, resilience, and dependability requirements.
- Develop methods to monitor and measure risk, compliance, and assurance efforts.
- Perform risk analysis, covering threat, vulnerability, and probability of occurrence, whenever an application or system undergoes a major change.
- Perform security reviews, identify gaps in security architecture, and develop a security risk management plan.
- Verify that security postures are implemented as stated, document deviations, and recommend actions to correct them.
- Draft statements of preliminary or residual security risks for system operation.
- Maintain information systems assurance and accreditation materials.
- Review or conduct audits of IT programs and projects.
- Plan and conduct security authorization reviews and assurance case development for the initial installation of systems and networks.
- Review service performance reports, identify significant issues and variances, and start corrective actions where needed.
Knowledge and Skills
- Risk management framework (RMF) requirements
- The security assessment and authorization process
- Cybersecurity principles for managing risks to information and data
- Laws, policies, procedures, and governance related to critical infrastructure
- Organizational evaluation and validation requirements
- Conducting audits or reviews of technical systems
- IT security principles and methods, such as firewalls, demilitarized zones, and encryption
- Known vulnerabilities from alerts, advisories, errata, and bulletins
How to Become a GRC Analyst
ISACA describes a governance, risk, and compliance (GRC) analyst as responsible for ensuring compliance with legal standards and for identifying and mitigating IT-related risk. According to ISACA, GRC roles generally require an undergraduate degree.
ISACA lists the technical skills employers most often request for GRC analyst roles, among them risk analysis, ISO/IEC 27001, auditing, internal auditing, and security controls.
ISACA's Certified Information Systems Auditor certification requires 5 years of IS audit, control, assurance, or security work experience, and a bachelor's, master's, or doctorate degree in any field can replace 2 of those years. For candidates who passed the exam after November 2025, ISACA's Certified in Risk and Information Systems Control (CRISC) certification requires 3 years of work experience in risk assessment and in risk response and reporting, with no substitutions or waivers.
Certifications
23 certificationsThe DoD 8140 Qualification Matrix V2.1 lists 22 certifications as qualification options for DCWF work roles 612 Security Control Assessor and 805 IT Program Auditor, up to the proficiency level shown. Options aligned to a higher proficiency level also qualify for the lower levels. Rows marked "Not listed" are certifications that the sources on this page name for the role, as described in the FAQ.
| Certification | Issuer | DoD 8140 level |
|---|---|---|
| CCISO Certified Chief Information Security Officer · EC-Council | EC-Council | Up to Advanced |
| CCSP Certified Cloud Security Professional · ISC2 | ISC2 | Up to Advanced |
| CISA Certified Information Systems Auditor · ISACA | ISACA | Up to Advanced |
| CISM Certified Information Security Manager · ISACA | ISACA | Up to Advanced |
| CISSP Certified Information Systems Security Professional · ISC2 | ISC2 | Up to Advanced |
| CISSP-ISSEP Information Systems Security Engineering Professional · ISC2 | ISC2 | Up to Advanced |
| CySA+ CompTIA Cybersecurity Analyst · CompTIA | CompTIA | Up to Advanced |
| FITSP-A Federal IT Security Professional-Auditor-NG · Federal IT Security Institute | Federal IT Security Institute | Up to Advanced |
| FITSP-M Federal IT Security Professional-Manager-NG · Federal IT Security Institute | Federal IT Security Institute | Up to Advanced |
| GCSA GIAC Cloud Security Automation · GIAC | GIAC | Up to Advanced |
| GISF GIAC Information Security Fundamentals · GIAC | GIAC | Up to Advanced |
| GSLC GIAC Security Leadership · GIAC | GIAC | Up to Advanced |
| GSNA GIAC Systems and Network Auditor · GIAC | GIAC | Up to Advanced |
| RCCE Level 1 Rocheston Certified Cybersecurity Engineer Level 1 · Rocheston LLC | Rocheston LLC | Up to Advanced |
| CGRC/CAP Certified in Governance, Risk and Compliance · ISC2 | ISC2 | Up to Intermediate |
| CISSO Certified Information Systems Security Officer · United America Technoloiges, LLC | United America Technoloiges, LLC | Up to Intermediate |
| Cloud+ CompTIA Cloud+ · CompTIA | CompTIA | Up to Intermediate |
| GSEC GIAC Security Essentials · GIAC | GIAC | Up to Intermediate |
| PenTest+ CompTIA PenTest+ · CompTIA | CompTIA | Up to Intermediate |
| Security+ CompTIA Security+ · CompTIA | CompTIA | Up to Intermediate |
| SecurityX / CASP+ CompTIA SecurityX · CompTIA | CompTIA | Up to Intermediate |
| SSCP Systems Security Certified Practitioner · ISC2 | ISC2 | Up to Intermediate |
| CRISC Certified in Risk and Information Systems Control · ISACA | ISACA | Not listed |
Frequently Asked Questions
What does a GRC analyst do?→
A GRC analyst assesses how well an IT system's security controls work, monitors the system's compliance with security requirements, performs risk analysis when a system undergoes a major change, and documents deviations with recommended corrective actions. ISACA adds that the role most commonly supports organizational compliance initiatives and the development of governance frameworks, and monitors regulatory changes.
How do you become a GRC analyst?→
According to ISACA, GRC roles generally require an undergraduate degree. ISACA's Certified Information Systems Auditor certification asks for 5 years of IS audit, control, assurance, or security work experience, and a degree can replace 2 of those years.
What skills does a GRC analyst need?→
The Security Control Assessor work role lists knowledge of risk management framework (RMF) requirements, the security assessment and authorization process, and laws, policies, procedures, or governance related to critical infrastructure. ISACA lists risk analysis, ISO/IEC 27001, auditing, and security controls among the technical skills employers most often request for GRC analysts.
What certifications are relevant for a GRC analyst?→
ISACA's GRC analyst career page points to its CRISC certification, which ISACA describes as covering the management of enterprise IT risk and the implementation of information systems controls. NICCS lists ISACA's Certified Information Systems Auditor course under the NICE Framework's Security Control Assessment and Technology Program Auditing work roles.
What is the difference between a GRC analyst and a GRC manager?→
ISACA describes the GRC analyst as responsible for ensuring compliance with legal standards and for identifying and mitigating IT-related risk. It describes the GRC manager as developing, implementing, and maintaining the GRC strategy. That strategy includes a GRC framework aligned to enterprise goals, oversight of risk assessments and compliance, and management of the GRC tools used for stakeholder reporting.
Which DCWF work roles cover GRC analyst work?→
DCWF work role 612, Security Control Assessor, lists alternative titles such as information assurance compliance analyst, IT auditor, and controls validator. Work role 805, IT Program Auditor, lists titles including security control assessor and information assurance auditor.
Sources
- CISA: Security Control Assessor work role
- CISA: IT Program Auditor work role
- ISACA: GRC Analyst career page
- ISACA: GRC career area
- ISACA: GRC Manager career page
- ISACA: Requirements to become CISA certified
- ISACA: Requirements to become CRISC certified
- NICCS: Certified Information Systems Auditor (CISA) from ISACA
Role descriptions follow the sources listed above: U.S. government workforce data first, then standards bodies and, where named in the text, certification issuers. Certification options come from the DoD 8140 Qualification Matrix V2.1 (2025-09-19); the matrix and a specific job posting are the authority for a given position. This site is not affiliated with CISA, the Department of Labor, or the Department of Defense. Last verified Oct 28, 2026.