:quality(80))
GRC analyst jobs UK: how to get into cyber governance and risk
What GRC analysts do, the skills UK employers want, what the 2026 data shows and how to move into cyber governance and risk.
By Julie Fixter, Client Partnership Consultant, Future Tech Jobs
Ever been the person who actually reads the policy? Cyber security has a job for you.
A GRC analyst works in cyber security governance, risk and compliance. They decide which risks matter, check that controls actually work, and make sure the organisation can prove it to auditors, regulators and customers.
It's one of the most realistic routes into cyber for people from audit, compliance, risk, legal or IT service management. The core skills are judgement, structure and communication. Not hacking.
And right now, it's busy. Here's what the latest government data shows, what employers are asking for in live adverts, and how to get in.
Why GRC skills are in demand in 2026
The short answer: regulation is growing, and businesses are short of people who can turn rules into controls that work.
The government's Cyber security skills in the UK labour market 2026 report came out on 29 September. Look at what it found:
66,964 cyber-related job postings in 2025, up 10% on the year before.
Auditing was asked for in 22% of core cyber job adverts, governance in 20%, ISO/IEC 27001 in 20% and risk management in 19%.
"Security Manager" was the most common job title, at 27% of core cyber postings.
Governance and risk management is the most common specialism among cyber security businesses, offered by 45% of them.
57% of UK businesses have a basic cyber skills gap, up from 49% the year before.
The report also estimates the UK will need around 10,200 more people in cyber roles during 2026, to cover growth and replace people who leave.
Then there's new law on the way. The Cyber Security and Resilience (Network and Information Systems) Bill is now in the House of Lords. As introduced, it brings medium and large managed service providers and larger data centres into the UK's cyber rules, with an initial incident report due within 24 hours and a fuller one within 72 hours, according to law firm TLT's explainer.
New duties need people to map them, build the controls and prove they work.
The message is clear: that's GRC work, and there's more of it coming.
What does a GRC analyst actually do?
Day to day, GRC work usually falls into three areas:
Governance: writing and maintaining security policies, standards and procedures, and making sure people know and follow them.
Risk: running risk assessments, keeping a risk register, and helping managers decide whether to fix, accept or transfer a risk.
Compliance and assurance: mapping controls to frameworks such as ISO 27001, Cyber Essentials or NIST, collecting evidence, running internal audits and supporting external ones.
You can see it in the live adverts on Cyber Security Jobs.
The Security Assurance Adviser contract advertised through Experis (London, Epsom, Birmingham or Manchester, £600 to £700 a day) involves maintaining accreditations and risk assessments, running compliance audits and reporting on assurance metrics.
The Principal Cyber Risk Management & Assurance Advisor role advertised through Adecco (London, Bristol or Manchester, £600 to £750 a day) is about leading risk and assurance work and explaining risk to technical and non-technical audiences.
Both are senior contracts that need security clearance. So think of them as where a GRC career can take you, not where it starts. They're worth reading anyway, because the skills they list are the ones to build.
Skills and frameworks employers ask for
Across the government data and the adverts on the board, the same things keep coming up:
ISO 27001. Named in a fifth of core cyber adverts in the DSIT data, and listed as desirable in the Experis role. Knowing how an information security management system is built and audited is the most transferable GRC skill there is.
Risk methodology. The Experis advert names IS1 and NIST SP 800-30. You don't need to know every method. You do need to show you can assess and score risk consistently.
UK frameworks. Cyber Essentials, NCSC guidance and, for public sector and defence work, government security policy.
Cloud awareness. The Adecco role asks for cloud security and AWS knowledge. GRC people increasingly need to understand the technology they're assessing.
Communication. Explaining risk to people who don't work in security comes up in both adverts above.
On certifications, CISM is listed as desirable in the Adecco advert. Desirable, not essential. If you can show the experience, don't let a missing certificate stop you applying.
How to become a GRC analyst
You don't need a cyber degree. The DSIT report found 65% of cyber firms that had recruited since January 2024 hired through non-degree routes.
Here's a practical path:
Start from what you already do. If you've worked in audit, compliance, risk, data protection, quality management or IT service management, you already have the core GRC habits: evidence, process and documentation. Put that front and centre on your CV.
Learn ISO 27001 properly. Read how the standard is structured, understand the Annex A controls and how a statement of applicability works. A foundation or lead implementer course is a common next step.
Get comfortable with the UK basics. Cyber Essentials and NCSC guidance are free to read and come up in many UK adverts.
Look for internal moves. Offer to help with an audit, a certification project or a supplier security review in your current job. It's a practical way to build GRC experience before you apply.
Search the right job titles. GRC analyst, information security analyst, risk analyst, compliance analyst, security assurance analyst and IT auditor. Entry-level roles are a smaller slice of the market (16% of core cyber postings in the DSIT data), so set up a job alert and see them the day they go live.
Changing career can feel like starting again, but it rarely is. The habits that made you good in audit or compliance, being thorough, asking the awkward question, writing things down properly, are the same ones GRC teams hire for. Lead with those.
Changing career later in life? Our guide to cyber security jobs for career switchers in their 30s, 40s and 50s is worth reading alongside this one. And for the EU rules driving compliance hiring, see our piece on DORA, NIS2 and Cyber Resilience Act jobs.
What GRC roles pay
The DSIT report puts the mean advertised salary for a core cyber role at £60,800, with a median of £58,050, and a London mean of £70,200. It doesn't break pay down by job title, so treat these as market-wide figures. At the senior contract end, the two GRC roles above are advertised at £600 to £750 a day.
One more number worth knowing: 76% of cyber postings gave no salary at all.
People rarely move for the reason on their CV. But pay is often what gets them to click apply. So if an advert is vague, it's perfectly reasonable to ask for the range early.
FAQ
Is GRC a good entry point into cyber security?
Yes, especially for people with audit, compliance or risk experience. It relies on structured thinking and communication more than deep technical skills, though cloud and technical awareness helps you progress.
Do I need to code to work in GRC?
Usually not. The GRC adverts above focus on frameworks, risk methods, reporting and stakeholder skills rather than programming.
Which certification should I get first for GRC?
ISO 27001 knowledge is the most widely requested, appearing in 20% of core cyber adverts in the 2026 DSIT report. At senior level, the Adecco advert above lists CISM as desirable.
Will the Cyber Security and Resilience Bill create more GRC jobs?
It is likely to increase demand for governance and compliance work, because it extends cyber duties to more organisations, including managed service providers and data centres, with tighter incident reporting. The Bill is still going through Parliament.
Do GRC jobs need security clearance?
Not all of them. Both senior roles mentioned above need clearance because they are public sector and defence work. Check each advert, as requirements vary by employer.
Find GRC and cyber risk jobs
In niche tech, the best candidates aren't scrolling general job ads. They're choosing between offers. So go where the specialist roles are: the right role, on the right board, in front of the right people.
Set up a job alert for GRC, risk, assurance and compliance roles
Upload your CV so employers and recruiters can find you
Create a free account to save jobs and apply faster
Any questions about moving into GRC, let me know. I'd love to hear from you.
About the author
Julie Fixter is a Client Partnership Consultant at Future Tech Jobs, helping employers and recruitment partners reach specialist talent across AI, quantum, robotics, semiconductors, space and the rest of the FTJ network. She spent seven years in sales at a UK software house before joining FTJ, and trained in psychodynamic counselling, which shapes how she thinks about what candidates actually want from a move. Based in Manchester. Connect with Julie on LinkedIn.
:quality(80))
:quality(80))
:quality(80))