GRC Specialist
Senior GRC work, advise and automate: governance, risk in money, one control set, then the consultant or engineer route.
- LevelExperienced
- Live classes16, two hours each
- Classroom time32 hours
- Modules6
- Before you startAbout two years in GRC
Check you are ready in thirty seconds
Tick what you have done. Six or more, start here; three to five, talk to us; fewer, start with GRC Analyst.
Nothing is sent anywhere: the count stays on your screen.
0 of 8
Start with GRC Analyst. It builds every one of these from the beginning. See GRC Analyst
Either could fit. We will tell you which to start with. Book a free call
You are ready for GRC Specialist. It starts where this list ends. Enrol
The roles it prepares you for
Senior GRC roles, consulting and engineering.
- Senior GRC AnalystOwning the programme day to day
- GRC ConsultantAdvisory firms and consultancies
- ISO 27001 Lead Auditor or ImplementerCertification and readiness work
- Security Risk ManagerRisk in money, in front of the board
- GRC EngineerCompliance as code and automated evidence
- Third-Party Risk LeadSuppliers, cloud and concentration risk
What you will be able to do
Tasks you can do at senior level.
- Design a governance model and a current-and-target profile, and write the board paper that funds it.
- Put a cyber risk in money with Open FAIR and a Monte Carlo model, and defend the range.
- Run one control set across ISO 27001, NIST, SOC 2, PCI DSS and the regulators of the UK, EU and US.
- Lead an audit, from the plan and the sample to graded findings and the report.
- Run a consulting engagement: scope, proposal, gap assessment, roadmap and the client presentation.
- Automate evidence in Azure, Microsoft 365 and AWS, and build a control dashboard.
6 modules, 16 live classes
Open any module to see what it covers. The core comes first; the capstone is where you choose your route.
01Governance & Strategy
Designing governance with NIST CSF 2.0, COBIT 2019, ISO/IEC 27014 and the UK Cyber Governance Code of Practice; building or rescuing an ISMS across countries; risk appetite, business cases, roadmaps and the board paper.
02Quantified & Emerging Risk
From heat map to money with Open FAIR and a Monte Carlo model in Excel; AI governance with ISO/IEC 42001, the NIST AI RMF and the EU AI Act; cloud and supplier concentration risk.
03Frameworks & Regulation
One control set for ISO 27001, NIST CSF 2.0 and SP 800-53, SOC 2, PCI DSS v4.0.1, CIS Controls and NCSC CAF; regulated sectors in the UK, EU, US, the Gulf and Asia-Pacific; SOC 2 readiness, questionnaires and trust centres.
04Audit & Consulting
Leading audits with ISO 19011 and ISO/IEC 27007, sampling and grading findings; a consulting engagement from proposal and gap assessment to the report and the client-board presentation.
05GRC Engineering
Compliance as code: controls as testable checks, continuous control monitoring, OSCAL and policy as code; evidence automated in Azure, Microsoft 365 and AWS; a control dashboard built with PowerShell or Python.
06Capstone
Your route, presented to a panel: a gap assessment, roadmap and board paper (consultant), or an evidence pipeline and dashboard (engineer).
International standards first, regional rules beside them
The same method works in London, Dublin, New York, Pune or Dubai.
International
The standards employers everywhere name. Taught first, in every module.
ISO/IEC 27001 and 27002, ISO/IEC 27005 and ISO 31000, ISO 22301, ISO/IEC 27701, ISO/IEC 42001, NIST CSF 2.0, NIST SP 800-53, NIST AI RMF, CIS Controls, COBIT 2019, SOC 2, PCI DSS v4.0.1, Open FAIR, CSA STAR
Both programmes
United Kingdom
In full detail, beside the international standard in every module.
UK GDPR and the DPA 2018, Data (Use and Access) Act 2025, NIS Regulations and NCSC CAF, Cyber Security and Resilience Bill, Cyber Essentials and Plus, FCA and PRA operational resilience, Cyber Governance Code of Practice
Both programmes
European Union
For firms with EU customers or offices, and for EU roles.
GDPR, NIS2, DORA, EU AI Act, Cyber Resilience Act
Analyst: GDPR, NIS2, DORA, Specialist: all
United States
The rules US-owned employers and US audit teams work to.
SOX IT general controls, HIPAA, State privacy laws, SEC cyber disclosure, NYDFS Part 500, CMMC and FedRAMP
Analyst: SOX, HIPAA, state privacy, Specialist: all
India and Asia-Pacific
Read with the same method, as worked examples.
India DPDP Act, Singapore MAS TRM, Australia Essential Eight, APRA CPS 234
Analyst: India DPDP, Specialist: all
The Gulf
Worked examples for regional roles.
Saudi NCA ECC, UAE Information Assurance standard
GRC Specialist
What employers ask for
We read the UK GRC adverts in our own job engine and built the modules around what they ask for most.
Share of 711 GRC adverts our job engine read, 7 October to 5 November 2026.
Two routes from one senior core
Everyone takes the core and both route modules. The capstone is where you specialise.
The consultant route
- Audit plans, sampling and graded findings
- Proposals, statements of work and gap assessments
- Maturity scoring and roadmaps
- The client-board presentation
The engineer route
- Controls rewritten as testable checks
- Evidence from Azure, Microsoft 365 and AWS
- OSCAL and policy as code
- A control dashboard in PowerShell or Python
How the classes run
Built for people with a full-time job.
- Live, two-hour classes1 hour 45 of teaching, then 15 minutes for your questions.
- WhenTwo live classes a week, arranged around your job
- Time each weekAround 12 hours a week in total, including the classes
- Working files, not slidesWorking files on one fictional company, our KQL lab, and tools shown live by your tutor.
- Every session recordedA missed class, or a second pass over a hard topic, is never a problem.
How you earn the badge
To earn the MCW Certified GRC Specialist badge you attend at least 80% of classes and pass every assignment and the capstone, each handed in by the final class. Everyone who completes the classes also receives a Certificate of Course Completion, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not an ISO, ISACA, ISC2 or BCS certification.
Priced by the class
The class rate times the classes, plus your CV rewrite and LinkedIn optimisation. Instalments are available.
£1,000in total
- 16 classes × £55
- £880
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £1,000
Or half now (£500) and the balance by class 8, or an instalment plan: ask us.
After you enrol
- You get an order confirmation by emailStraight away.
- We agree your start date and scheduleClasses run twice a week, arranged around your job.
- Your learning portal opensSign in with your MyCyberWay account. Once you are in your batch, your classes, Teams links, recordings, labs and quizzes are all in the learning portal.
- Your tutor sends the primer and your filesA short primer and the working files for module one reach you before your first class.
We do not guarantee employment, a particular salary, or a pass in any third-party exam. Outcomes depend on your own effort, your background and the job market – what we can promise is the teaching, the feedback and the support described above.
What the fee includes
- Live, tutor-led teaching
- Every session recorded
- Working files you keep
- Hands-on practice
- Assignments marked by your tutor
- CV rewrite and LinkedIn optimisation
- Mock interviews
- Job feed while you are registered
- Verifiable certification badge
- Support after you are placed
Not included: Third-party certification exam fees; Copies of the ISO standards themselves, which ISO sells; Your own computer.
Questions people ask first
Anything else, ask us. A person replies.
How much experience do I need?
About two years in GRC, audit, risk or compliance – or a security role with governance duties – or the GRC Analyst badge. If you tick six of the eight in the self-check, you are ready. Three to five, book the fit call and we will tell you straight.
Do I have to choose consultant or engineer now?
No. Everyone takes both route modules, because most senior roles need a little of each. You choose your route for the capstone, near the end, once you have tried both.
I am not a programmer. Can I do the engineer route?
Yes, if you want it: the scripts are short, given to you as a starting point, and explained line by line. If code is not for you, take the consultant route for the capstone – you still learn what automation can and cannot prove.
Is it tied to one country’s rules?
No. The international standards come first – ISO, NIST, SOC 2, PCI DSS – then the UK in full, then the EU, the US, India, Asia-Pacific and the Gulf as worked examples of one method: find what applies, turn it into obligations, map it to one set of controls, prove it with evidence.
Does it include an exam?
No. GRC Specialist covers ground that CISM, CRISC, CISA, ISO/IEC 27001 Lead Implementer and Lead Auditor, and ISC2 CGRC also cover, and your tutor will tell you which fits your next step. Exams are booked and paid separately.
What happens if I miss a class?
Every session is recorded and shared. Give 48 hours’ notice to reschedule and there is no charge. Attendance below 80% affects eligibility for the badge and for the Certificate of Course Completion.
Do you guarantee a job or a promotion?
No, and be cautious of anyone who does. What is included is a CV rewritten for senior roles, an optimised LinkedIn profile, case-study mock interviews, Premium Jobs from joining your batch until three months after your final class, and a private job group. Outcomes depend on your effort, your background and the market.
How do I get into my course after I enrol?
Your MyCyberWay account is created when you check out, and it is also your sign-in to the learning portal. Once we have agreed your start date and schedule and placed you in your batch, your classes and their Join on Teams links, recordings, working files, quizzes and calendar are all there.
Can my employer pay?
Yes. Tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).
Not sure you are ready for Specialist?
Book a free 20-minute call. We will tell you honestly which programme fits, even if it is none of them yet.