Governance, Risk & Compliance (GRC)
Learn how to align information security goals with organizational strategy, evaluate information risk, and demonstrate strict compliance with international standards. We train you to develop security policies, map security control frameworks, and conduct audit readiness workflows.
What you will be able to do
The skills employers screen for in GRC roles, practised through live case work rather than slides.
Curriculum
Delivered across live sessions. The depth of each module scales with the plan you choose.
1Foundations of governance, risk and compliance
- How GRC teams are organised and who they work with
- The three lines model and where analysts sit
- What a typical GRC week looks like
2Security frameworks and control mapping
- NIST CSF functions and categories
- COBIT governance objectives
- Mapping one control to many frameworks
3Policy writing and exception management
- Policy, standard and procedure hierarchy
- Writing policy language people can follow
- Exception requests and compensating controls
4Risk assessment and the risk register
- Identifying, scoring and treating risk
- Register fields, owners and review cycles
- Reporting risk to leadership
5Audit readiness and evidence
- SOC 2 Type II trust services criteria
- Evidence requests and walkthroughs
- Testing control design and operating effectiveness
6Regulatory mapping
- SOX IT general controls
- HIPAA Security Rule and PCI DSS at analyst depth
- Turning requirements into testable controls
7GRC tooling in practice
- How ServiceNow GRC and RSAM model policies, risks and issues
- Workflows, attestations and dashboards
8Capstone and interview preparation
- Assemble your policy suite, control map and risk register
- Practise the questions GRC analyst interviews actually ask
Frameworks and tools you will use
The standards and platforms named in real job descriptions for this field.
Your portfolio deliverable
Draft a formal Information Security Policy suite, design a custom control-mapping spreadsheet framework, and build a master GRC Risk Register template from scratch.
Where this track leads
Roles our GRC learners prepare for, with median salaries in the US and UK.
Junior GRC Analyst
Most common first role from this track
$85,000 / £55,000
Compliance Advisory Officer
Also within reach
$110,000 / £75,000
Internal Controls Specialist
Also within reach
$105,000 / £70,000
Salary figures are indicative US and UK medians and vary by city, employer and experience.
Who this track is for
Questions about the GRC track
Do I need a technical background for the GRC track?
No. The GRC track starts from first principles and is designed for people coming from non-technical backgrounds as well as IT. Comfort with reading documents and working in spreadsheets is enough.
Is the training live or recorded?
Live. Every session is taught online by a practitioner in real time, with time for questions and case work. There are no pre-recorded lectures.
How many hours of training do I get?
That depends on the plan you choose: Node is 10 hours, Lattice is 20 hours and Nexus is 35 hours. Nexus also includes all six tracks.
What will I have built by the end?
Draft a formal Information Security Policy suite, design a custom control-mapping spreadsheet framework, and build a master GRC Risk Register template from scratch.
Do you help with finding a job?
Yes. Lattice and Nexus include ATS-friendly resume rebuilding, LinkedIn profile updates, a mock interview and ongoing career mentorship. Nexus adds 1-on-1 executive coaching and priority placement support.
Is a certification exam included?
You receive an OMNyra certificate of completion. External certification exams and their fees are not included. If you plan to sit CGRC, CISA or CRISC, ask on your free call how this track maps to it.
Is there a discount for groups?
Yes. Friends or colleagues enrolling together as a group of 3 or more get group pricing, and organisations can book a dedicated cohort with custom scheduling.
Pair it with another track
Not sure GRC is the right fit?
Book a free 1-on-1 call. We will look at your background and target market, then recommend a track and plan.