So you want to become a GRC Analyst?

Awesome! Here’s a free Career Development Plan template full of resources that I think you’ll find helpful.

It’s the best-of-the-best I’ve discovered in my mid-career transition to GRC, broken into Harvard’s recommended ratio to grow yourself faster of:

• 10% Education

• 20% Relationships

• 70% Experiences

This template format and the menu of resources inside it would also be helpful to a broad range of other target job areas and career stages.

Table of Contents

• TARGET JOB

• SKILL ASSESSMENT

  • TECHNICAL COMPETENCIES

    • Compliance & Audit (CISA Domains)

    • Assess Risk (CISSP Domains)

    • Instill Governance

    • Speak ‘Security’ With the Business

  • ENABLING COMPETENCIES

    • Acting Ethically & Professionally

    • Leading

    • Collaborating

    • Managing Self

    • Adding Value

    • Solving Problems & Making Decisions

    • Communicating

• ACTION PLAN

  • 70% EXPERIENCES

    • Hunt (e.g. ask a Mentor) for GRC Stretch Assignmen …

    • Internships, co-ops, entry level roles

    • Start a Blog and/or YouTube channel

    • Volunteer

  • 20% RELATIONSHIPS

    • Mentorship

    • Peer learning

    • Security Community

  • 10% EDUCATION

    • (Audio)books

    • Podcasts

    • Blogs/Newsletters

    • YouTube

    • Free Industry Resources

    • Paid Courses / Certs

TARGET JOB

SKILL ASSESSMENT

Rate your current skill level on a scale from 1 (weakest) to 5 (strongest)

TECHNICAL COMPETENCIES

Compliance & Audit (CISA Domains)

Trust but verify. Are we provably compliant?

• Domain 1. Information Systems (IS) Auditing Process

• Domain 2. Governance & Management of IT

• Domain 3. IS Acquisition, Development & Implementation

• Domain 4. IS Operations & Business Resilience

• Domain 5. Protection of Information Assets

Assess Risk (CISSP Domains)

Is risk level within tolerance?

• Domain 1. Security & Risk Management

• Domain 2. Asset Security

• Domain 3. Security Architecture and Engineering

• Domain 4. Communication & Network Security

• Domain 5. Identity & Access Management

• Domain 6. Security Assessment & Testing

• Domain 7. Security Operations

• Domain 8. Software Development Security

Instill Governance

Does everyone know the company’s risk appetite, and make decisions aligned to it?

• Policies

• Procedures

• Standards

Speak ‘Security’ With the Business

• Cyber Risk Management Action Plan (CR-MAP)

• Customer Security Assurance & Trust Center

ENABLING COMPETENCIES

Source: CPA Competancy Map, which applies perfectly to GRC and many other professions

Acting Ethically & Professionally

• Ethical Behvaviour

• Integrity & Trustworthiness

• Questioning Mindset

• Due Care

• Objectivity

Leading

• Strategic focus

• Risk Management

• Organizational Culture Advocacy

• Influence and Consensus Building

Collaborating

• Inclusivity

• Teamwork

• Relationship Building

• Project Management

Managing Self

• Adaptability, Resilience & Agility

• Initiative

• Continuous Improvement

• Talent Management

Adding Value

• Business Context

• Creativity and Innovation

• Performance Evaluation and Accountability

Solving Problems & Making Decisions

• Issue Identification

• Analysis

• Recommendations

• Implementation and Change Management

Communicating

• Audience and effectiveness

• Active Listening

• Communication

ACTION PLAN

70% EXPERIENCES

Resume bullets to show you can add value from day 1

Hunt (e.g. ask a Mentor) for GRC Stretch Assignments:

• Prepare for and manage an audit through planning, execution and reporting phases

  • Write a SOC2 System Description or ISO27001 Statement of Applicability

  • Check-in with control owners to document or update control narratives and test a sample

  • Manage a gantt chart and weekly status reports

• Perform Third Party Risk Assessments

  • Review intake forms and work with requestor to complete risk assessment

  • Send questionnaires to the vendor and/or review their Trust Centre materials

• Perform Security Risk Assessments

  • Meet with business requestors to fill out a Risk Assessment template and create a Data Flow Diagram

• Create or review security policies and standards with subject matter experts

• Run and report on an internal phishing campaign