GRC Specialist Programme

GRC Specialist is for people who already work in governance, risk, compliance or audit and want the consultant or engineer route. It covers governance design and the board paper, cyber risk put in money, one control set across ISO 27001, NIST, SOC 2, PCI DSS and the regulators of the UK, EU and US, leading audits and consulting engagements, and GRC engineering – evidence automated in Azure, Microsoft 365 and AWS. It ends with a capstone on your chosen route, presented to a panel.

What you will be able to do

• Design a governance model and a current-and-target profile, and write the board paper that funds it.
• Put a cyber risk in money with Open FAIR and a Monte Carlo model, and defend the range.
• Run one control set across ISO 27001, NIST, SOC 2, PCI DSS and the regulators of the UK, EU and US.
• Lead an audit, from the plan and the sample to graded findings and the report.
• Run a consulting engagement: scope, proposal, gap assessment, roadmap and the client presentation.
• Automate evidence in Azure, Microsoft 365 and AWS, and build a control dashboard.
• Govern the use of AI with ISO/IEC 42001, the NIST AI RMF and the EU AI Act.

The curriculum — 6 modules, 16 classes

1. 01

   Governance & Strategy 3 classes

   Designing governance with NIST CSF 2.0, COBIT 2019, ISO/IEC 27014 and the UK Cyber Governance Code of Practice; building or rescuing an ISMS across countries; risk appetite, business cases, roadmaps and the board paper.

2. 02

   Quantified & Emerging Risk 3 classes

   From heat map to money with Open FAIR and a Monte Carlo model in Excel; AI governance with ISO/IEC 42001, the NIST AI RMF and the EU AI Act; cloud and supplier concentration risk.

3. 03

   Frameworks & Regulation 3 classes

   One control set for ISO 27001, NIST CSF 2.0 and SP 800-53, SOC 2, PCI DSS v4.0.1, CIS Controls and NCSC CAF; regulated sectors in the UK, EU, US, the Gulf and Asia-Pacific; SOC 2 readiness, questionnaires and trust centres.

4. 04

   Audit & Consulting 3 classes

   Leading audits with ISO 19011 and ISO/IEC 27007, sampling and grading findings; a consulting engagement from proposal and gap assessment to the report and the client-board presentation.

5. 05

   GRC Engineering 3 classes

   Compliance as code: controls as testable checks, continuous control monitoring, OSCAL and policy as code; evidence automated in Azure, Microsoft 365 and AWS; a control dashboard built with PowerShell or Python.

6. 06

   Capstone 1 class

   Your route, presented to a panel: a gap assessment, roadmap and board paper (consultant), or an evidence pipeline and dashboard (engineer).

What is included

• Live, tutor-led teaching – two hours per class: 1 hour 45 minutes of teaching, then 15 minutes for your questions. Not pre-recorded video.
• Every session recorded – a missed class or a second pass over a difficult topic is never a problem.
• Working files you keep – the governance chart, risk model, control crosswalk, audit plan, gap report and evidence scripts you build in class, all on one fictional company, ready to talk through at interview.
• Hands-on practice – Excel risk models, evidence queries in our KQL lab, PowerShell or Python automation, and live tutor demonstrations of Azure Policy, Defender for Cloud and Microsoft Purview.
• Assignments marked by your tutor – reviewed by a person, with written feedback. They are what the certification is assessed on.
• CV rewrite and LinkedIn optimisation – ATS-friendly and written for the roles you are applying to. £120 of separately priced work, included.
• Mock interviews – run against real GRC consultant and GRC engineer specifications, with direct feedback afterwards.
• Job feed while you are registered – vetted openings through MyCyberWay Premium Jobs, free from joining your batch until three months after your final class.
• Verifiable certification badge – issued through Sertifier on passing the assessed work, with a unique ID and a public verification link.
• Support after you are placed – most people have questions in their first weeks in a new role, and that is when having somebody to ask is worth the most.

What is not included

• Third-party certification exam fees, such as ISO/IEC 27001 Lead Implementer or Lead Auditor, BCS CISMP, CISM or CRISC.
• Copies of the ISO standards themselves, which ISO sells – the classes teach them, and show you where to read them.
• Your own computer, Microsoft Excel and Word (or a free equivalent) and an internet connection.

Certification

To earn the MCW Certified GRC Specialist badge you attend at least 80% of classes and pass every assignment and the capstone, each handed in by the final class. Everyone who completes the classes also receives a Certificate of Course Completion, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not an ISO, ISACA, ISC2 or BCS certification.

Roles it prepares you for

Senior GRC Analyst · GRC Consultant · ISO 27001 Implementer or Lead Auditor · Security Risk Manager · GRC Engineer or Security Compliance Engineer · Third-Party Risk Lead.

Paying

The price here is the full programme fee, paid at checkout (Option A in your enrolment agreement). Prefer to pay half now (£500) and the balance by class 8, or spread it over an instalment plan? Book a call and we will send you the enrolment agreement with those options instead. The per-class rate is the same whichever way you pay, and the total of £1,000 never changes.

What happens after you buy

1. You get an order confirmation by email Straight away.
2. We agree your start date and schedule Classes run twice a week, arranged around your job.
3. Your learning portal opens Sign in with your MyCyberWay account. Once you are in your batch, your classes, Teams links, recordings, labs and quizzes are all in the learning portal.
4. Your tutor sends the primer and your files A short primer and the working files for module one reach you before your first class.