GRC Analyst
Your first job in governance, risk and compliance: the world’s standards first, then the rules of the UK, the EU, the US and India.
- LevelEntry
- Live classes16, two hours each
- Classroom time32 hours
- Modules6
- Before you startNo GRC experience needed
The roles it prepares you for
Every module is built from real GRC job adverts, and so are your CV and mock interviews.
- GRC AnalystIn-house or at a consultancy
- Compliance AnalystISO 27001, SOC 2, PCI DSS
- Risk AnalystCyber and IT risk
- IT Audit AssociateInternal audit or an audit firm
- Supplier Risk AnalystThird-party risk teams
- Privacy CoordinatorData protection teams
- Junior Security OfficerPolicy, awareness and reporting
- ISMS CoordinatorISO 27001 certification teams
What you will be able to do
Tasks you can do on day one of the job.
- Run a risk assessment with the people who own the risks, and keep a register they act on.
- Read ISO/IEC 27001 and NIST CSF 2.0 side by side, and write a Statement of Applicability and the policies behind it.
- Check the technical controls behind a policy – identity, patching, logging, cloud – through Cyber Essentials and CIS Controls.
- Collect and grade audit evidence from Microsoft 365, Azure and AWS, and help run an internal audit from plan to corrective actions.
- Handle the GRC side of a data breach and a supplier review, under UK GDPR and GDPR.
- Write the monthly GRC pack and a one-page board summary, and present them.
- Answer an external auditor’s requests on a timetable, and respond to a nonconformity.
6 modules, 16 live classes
Open any module to see what it covers. Each teaches the international standard first, then how the UK and other regions apply it.
01GRC Foundations
How governance, risk and compliance fit together, the Three Lines Model, and policies, standards and procedures. The international frameworks employers name – ISO/IEC 27001, NIST CSF 2.0, CIS Controls, COBIT, SOC 2, PCI DSS – and the laws organisations answer to in the UK, the EU, the US and India.
02Risk Management
ISO 31000, ISO/IEC 27005 and NIST SP 800-30 in practice: likelihood and impact, appetite and tolerance, the risk workshop, a register owners act on, exceptions, key risk indicators and the monthly risk report.
03Standards & Controls
ISO/IEC 27001:2022 – clauses, Annex A and the Statement of Applicability – mapped to NIST CSF 2.0 and SP 800-53; policies people follow, AI use included; and the technical controls GRC staff must read, through Cyber Essentials and CIS Controls.
04Evidence & Audit
What counts as evidence, sampling and workpapers, SOX general IT controls, evidence from Microsoft 365, Azure and AWS with a query as proof, and an internal audit from plan to corrective actions.
05Privacy, Suppliers & Resilience
Privacy at work under UK GDPR and GDPR, and how US and Indian law differ; DPIAs and breach clocks; supplier risk, SOC 2 reports and contract clauses; business impact analysis, continuity and who reports what, when.
06GRC in Practice
KPIs and KRIs, the monthly GRC pack and the board one-pager, then audit week: an external auditor’s requests on a timetable and a nonconformity to answer.
International standards first, regional rules beside them
The same method works in London, Dublin, New York, Pune or Dubai.
International
The standards employers everywhere name. Taught first, in every module.
ISO/IEC 27001 and 27002, ISO/IEC 27005 and ISO 31000, ISO 22301, ISO/IEC 27701, ISO/IEC 42001, NIST CSF 2.0, NIST SP 800-53, NIST AI RMF, CIS Controls, COBIT 2019, SOC 2, PCI DSS v4.0.1, Open FAIR, CSA STAR
Both programmes
United Kingdom
In full detail, beside the international standard in every module.
UK GDPR and the DPA 2018, Data (Use and Access) Act 2025, NIS Regulations and NCSC CAF, Cyber Security and Resilience Bill, Cyber Essentials and Plus, FCA and PRA operational resilience, Cyber Governance Code of Practice
Both programmes
European Union
For firms with EU customers or offices, and for EU roles.
GDPR, NIS2, DORA, EU AI Act, Cyber Resilience Act
Analyst: GDPR, NIS2, DORA, Specialist: all
United States
The rules US-owned employers and US audit teams work to.
SOX IT general controls, HIPAA, State privacy laws, SEC cyber disclosure, NYDFS Part 500, CMMC and FedRAMP
Analyst: SOX, HIPAA, state privacy, Specialist: all
India and Asia-Pacific
Read with the same method, as worked examples.
India DPDP Act, Singapore MAS TRM, Australia Essential Eight, APRA CPS 234
Analyst: India DPDP, Specialist: all
The Gulf
Worked examples for regional roles.
Saudi NCA ECC, UAE Information Assurance standard
In GRC Specialist
What employers ask for
We read the UK GRC adverts in our own job engine and built the modules around what they ask for most.
Share of 711 GRC adverts our job engine read, 7 October to 5 November 2026.
How the classes run
Built for people with a full-time job.
- Live, two-hour classes1 hour 45 of teaching, then 15 minutes for your questions.
- WhenTwo live classes a week, arranged around your job
- Time each weekAround 10 hours a week in total, including the classes
- Working files, not slidesWorking files on one fictional company, our KQL lab, and tools shown live by your tutor.
- Every session recordedA missed class, or a second pass over a hard topic, is never a problem.
How you earn the badge
To earn the MCW Certified GRC Analyst badge you attend at least 80% of classes and pass every assignment and the master assessment, each handed in by the final class. Everyone who completes the classes also receives a Certificate of Course Completion, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not an ISO, ISACA, ISC2 or BCS certification.
Priced by the class
The class rate times the classes, plus your CV rewrite and LinkedIn optimisation. Instalments are available.
£760in total
- 16 classes × £40
- £640
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £760
Or half now (£380) and the balance by class 8, or an instalment plan: ask us.
After you enrol
- You get an order confirmation by emailStraight away.
- We agree your start date and scheduleClasses run twice a week, arranged around your job.
- Your learning portal opensSign in with your MyCyberWay account. Once you are in your batch, your classes, Teams links, recordings, labs and quizzes are all in the learning portal.
- Your tutor sends the primer and your filesA short primer and the working files for module one reach you before your first class.
We do not guarantee employment, a particular salary, or a pass in any third-party exam. Outcomes depend on your own effort, your background and the job market – what we can promise is the teaching, the feedback and the support described above.
What the fee includes
- Live, tutor-led teaching
- Every session recorded
- Working files you keep
- Hands-on practice
- Assignments marked by your tutor
- CV rewrite and LinkedIn optimisation
- Mock interviews
- Job feed while you are registered
- Verifiable certification badge
- Support after you are placed
Not included: Third-party certification exam fees; Copies of the ISO standards themselves, which ISO sells; Your own computer.
Questions people ask first
Anything else, ask us. A person replies.
How is this different from GRC Specialist?
GRC Specialist is for people already working in GRC, audit, risk or compliance – about two years in. It moves on to governance and the board, cyber risk in money, one control set across many frameworks and regulators, leading audits and consulting engagements, and GRC engineering. Start here if you are new to GRC; the GRC Analyst badge meets GRC Specialist’s entry check.
Do I need security experience to start?
No. This is the entry point to GRC and it is built for people with none. You need to write clearly, use a spreadsheet and give it about 10 hours a week. Still unsure? Book the fit call and we will tell you straight.
Is GRC technical?
Partly. You will not configure systems, but you will read them: GRC teams check identity, patching, logging and cloud controls, and nearly a fifth of GRC adverts ask for that. Module 03 teaches it from the ground up, and the one evidence query in our lab is taught from nothing.
Is it tied to one country’s rules?
No. Every module teaches the international standard first – ISO/IEC 27001, NIST, SOC 2, PCI DSS – then the UK rules, then how the EU, the US, India and the Gulf differ. Learners in the UK get the detail UK employers expect; learners elsewhere get a method that works with any rulebook.
What do I need for the practical work?
Excel and Word, or free equivalents, and a browser. The evidence queries run in our own KQL lab in the learning portal. GRC platforms, Microsoft Purview and Azure Policy are shown live by your tutor, so nothing needs a paid licence of your own.
Does it include an exam?
No. GRC Analyst covers much of the ground of BCS CISMP, ISO/IEC 27001 Foundation and ISC2 CC, and your tutor will tell you which exam fits your next step. Exams are booked and paid separately.
What happens if I miss a class?
Every session is recorded and shared. Give 48 hours’ notice to reschedule and there is no charge. Attendance below 80% affects eligibility for the badge and for the Certificate of Course Completion.
Do you guarantee a job?
No, and be cautious of anyone who does. What is included is a rewritten CV, an optimised LinkedIn profile, mock interviews against real role specifications, Premium Jobs from joining your batch until three months after your final class, and a private job group. Outcomes depend on your effort, your background and the market – and we will be straight with you about all three.
How do I get into my course after I enrol?
Your MyCyberWay account is created when you check out, and it is also your sign-in to the learning portal. Once we have agreed your start date and schedule and placed you in your batch, your classes and their Join on Teams links, recordings, working files, quizzes and calendar are all there.
Can my employer pay?
Yes. If you are buying for a business, tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).
Not sure which GRC programme fits?
Book a free 20-minute call. We will tell you honestly which programme fits, even if it is none of them yet.