Security+
CySA+
PenTest+
SecAI+
Network+
A+
Cloud+
Linux+GRC Career 2026: 5 Skills Job Ads Now Ask For (+ Salaries)
If you're thinking about a GRC career, or you're already in one and wondering where it goes next, the job ads have changed under our feet. I've been through hundreds of them, and the same request keeps coming up: hand the evidence work to AI, then prove whether the AI got it right. Vercel's GRC Analyst ad puts it in one line. It wants someone "who wants to build GRC with AI, and you do not need to be an engineer to do it."
That's the opportunity, because most of us in GRC haven't been asked to do this before. In this guide we'll go through the five skills these ads ask for, what each rung pays using the salary ranges printed in live ads, and a practical way to show an employer you can do it. First, the question most people start with.
TL;DR: if you've only got 30 seconds
AI is already in the job. 9 of the 11 live security GRC analyst ads in our November sample name AI or automation in the job's duties, and 7 name AI itself. Only 1 doesn't mention AI anywhere.
Five skills keep coming up. Automate evidence collection, prove the AI got it right, govern the AI itself, code enough to build small tools, and write controls as tests.
The pay is real. Published ranges ran from $134,000 to $202,000 for a GRC Analyst at Vercel, up to $270,000 to $345,000 for a Controls Specialist at Anthropic.
Not yet a filter, already a differentiator. 4 of the 11 ads don't name AI in the duties at all. The ones that do are where you'll stand out.
Prove it with one project. Write your own answers, let an AI agent assess the same controls, grade it, and put the result on your resume.
Is GRC a Good Career?
Yes, and I think the changes make it a better career, not a worse one. GRC stands for governance, risk and compliance: the work of proving a company follows its own security rules and the standards it's audited against, such as SOC 2 or ISO 27001. A lot of that work has always been collecting proof. Screenshots of who has admin access, exports showing multi-factor login is switched on, a spreadsheet of which suppliers were checked.
That collecting is exactly what AI and automation are taking over. I don't think that shrinks the career. It moves the valuable part of it. On 12 November we pulled every live job from 66 company job boards on Greenhouse, a hiring system many tech firms use, which came to 10,380 jobs. We then read every security GRC analyst role in that set by hand. There were 11.
9 of 11 name AI or automation in the duties or requirements of the job, and 7 name AI itself.
5 of 11 expect the analyst to build something with AI: an automation, an AI workflow or an agent (Cloudflare, Vercel, Anthropic, Okta and Lyft).
1 of 11 doesn't mention AI anywhere. That was Stripe's Security GRC Analyst role for its Bridge team.
11 analyst roles, 10 GRC engineer roles. In the same set, companies were hiring people to build compliance automation almost as often as people to run the programme.
Read this as a direction, not a law
Eleven is a small number. It's small because that's how many analyst-level security GRC roles were open on those boards that week, not because we stopped looking. Greenhouse is mostly US tech companies, so a bank or a government agency may look different. The method is at the end.
What exactly are those ads asking for?
The 5 Skills GRC Job Ads Now Ask For
When you line the ads up, AI in GRC comes down to five skills. Some are in the November ads; some come from ads we captured in September that have since closed, and I've marked those.
1 Automate Evidence Collection
Think of the folder you build before every audit. Somebody exports the admin list, screenshots the login settings and saves it all with the right date. The ads now want that folder filled by a script or an AI agent instead. Vercel's GRC Analyst will "use AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses." Lyft's Senior Security Assurance Analyst will "design, implement, and monitor automated evidence collection, continuous control testing, and remediation tracking." In September, Gusto's Senior GRC Analyst ad (now closed) asked the analyst to "lead the implementation of AI agents" for controls and evidence collection.
2 Prove the AI Got It Right
This is the skill I'd bet a career on. Compliance is classically a tick in a box, and I've seen what that hides in real assessments. Have you got a firewall? Yes, tick. Then you look at the rule and it's any-any, which means it lets anything in from anywhere. Have you got endpoint protection? Yes, tick. Then you check it and it isn't effective. Weak compliance stops at whether something exists.
An AI agent can make the same mistake, only faster. When we tested this for our video, a scanner reported a pass on a password control when there was no password policy in the files at all, and a smaller AI model accepted that pass as proof. The ads want people who catch that. Anthropic's Controls Specialist will "verify machine-drafted control language before it becomes the record" and "evaluate evidence reliability, including the completeness and accuracy of system-generated reports and AI-generated evidence." Cloudflare pairs its AI drafts with "your own expert human-in-the-loop validation to ensure high accuracy." Vanta, in September, asked candidates to "define gold-standard evaluation sets," which is a hiring manager's name for an answer key you write yourself.
3 Govern the AI Itself
The AI is now one of the things being audited. Vercel's analyst will "assess AI tools and vendors against security, privacy, and compliance requirements." Abnormal AI's Compliance Trust Analyst runs the company's AI governance committee. Anthropic wants people who "have defined or assessed controls for AI systems or agents operating in production." Two frameworks come up by name: the NIST AI Risk Management Framework and ISO/IEC 42001, the standard for managing AI in a company. If you already know how to audit against ISO 27001, this is the same muscle on a new subject. Our guide to AI governance frameworks covers both.
4 Code Enough to Build Small Tools
Notice the wording here, because it's the most reassuring line in the whole sample. None of these ads asks a GRC analyst to become a software engineer. Affirm's Security Risk Management Lead ad says "you don't need to be a software engineer, but you should be fluent enough to read, modify, and run scripts, build automations, and ship small tools end-to-end." Cloudflare asks for "basic scripting (e.g., Python, SQL, or shell)." In practice that means asking an AI coding tool for a script, reading what it wrote, changing it when it's wrong, and running it, until you can put a small tool together end to end. If coding worries you, read you don't need to code for cyber security.
5 Write Controls as Tests, Not Documents
A policy that says "passwords must be at least 14 characters" is a sentence. A check that returns pass or fail for every system is a test. The ads want controls that work as tests too. Anthropic's Controls Specialist will "define the metrics and automated tests that show operating effectiveness." Plaid's GRC engineer ad wants "controls, policies, and framework mappings captured as structured, version-controlled data." Once a control is a test, a machine can run it every day. You decide whether the test is any good.
Some employers go further and spell out what they don't want.
The One Line Employers Keep Writing
Rokt's GRC Automation and Assurance Lead ad, captured in September, said it outright: "This is not a 'use ChatGPT to summarise a policy' role." Other employers write the same idea in their own words.
Cloudflare (live): experience "configuring AI workflows (e.g., prompt engineering, retrieval-augmented generation concepts, API-based automations, or internal agent configurations) rather than relying solely on packaged third-party software."
LaunchDarkly (live): "We expect you to bring a sharp point of view on where AI can take work off the team's plate and make our coverage deeper."
OKX (captured September): "AI tooling is not optional; it is how you work."
These employers are asking for the step after a chatbot: show them a thing you built, and a number that says how well it worked. That's where I see the opportunity. "I measured where an AI agent got my controls wrong" is a very different line on a CV from "ChatGPT".
The one thing to take from the ads
These ads ask for more than using AI. They want to see what you built with it and how you checked it.
So what does an employer pay for that?
Senior GRC Analyst Salaries, and Every Other Rung
These are the US base salary ranges printed in live ads on 12 November, all for analyst-level security GRC roles. Each bar is drawn to scale.
| Company and role | US base pay in the ad | AI in the job? |
|---|---|---|
| Vercel, GRC Analyst | $134,000 to $202,000 | Builds automations with AI tooling |
| Lyft, Senior Security Assurance Analyst | $148,000 to $185,000 | Uses LLM workflows to automate assurance |
| LaunchDarkly, Security Analyst, GRC | $152,900 to $210,210 (highest pay zone) | A view on where AI takes work off the team |
| Roblox, Senior GRC Analyst | $180,570 to $224,310 | Designs tools and automations |
| Okta, Staff Security Risk Analyst | $174,000 to $239,800 (San Francisco) | Engineers custom AI agents |
| Anthropic, Controls Specialist, Security GRC | $270,000 to $345,000 | Builds with Claude, verifies its output |
| Roblox, Principal Security GRC Analyst | $288,020 to $335,580 | Designs tools and automations |
Two honest caveats. First, these are tech companies, mostly hiring in big US cities, so smaller firms and other countries often pay less. Second, a range in an ad isn't what anyone was actually paid. Still, the pattern is clear: the senior and staff analyst roles here mostly sit between about $150,000 and $240,000, and the top of the analyst ladder clears $300,000.
But the jump from one band to the next doesn't come from years served alone.
The GRC Career Path, From Analyst to Principal
The classic GRC analyst career path goes analyst, senior analyst, staff or principal, then lead or manager. Titles vary a lot between companies. Anthropic's "Specialist" is advertised at about the same pay as Roblox's "Principal", so read the duties, not the title. In these ads, what changes as you climb is mostly how much of the process you own.
Analyst: runs the evidence and the audits. In the November ads, even this rung is asked to use AI, as at Vercel.
Senior: designs the process. Roblox's senior and principal analysts are "designing tools and automations along the way to drive security and compliance by design."
Staff and principal: owns how it's measured and automated. Okta's staff risk analyst will be "engineering custom AI agents, capabilities, and workflows."
GRC engineer: a branch, not a detour. Ten GRC engineer roles sat beside the eleven analyst roles, with GitLab's Staff Security Governance Engineer at $168,000 to $238,000.
From the analyst at Vercel to the specialist at Anthropic, checking or building the automation is part of the job.
The Future of GRC: Will GRC Be Replaced by AI?
Not on the evidence in these ads. What they automate is mostly the collecting and the first drafts. The judging is what they're hiring for. Anthropic's ad describes the split better than I could: "Building with Claude is a normal part of the job: drafting and mapping controls, testing evidence, and monitoring control health, with you deciding where human judgment stays in the loop."
So the future of GRC looks like this to me. Machines gather and monitor. People decide what the evidence proves, where AI can be trusted, and how the AI itself is controlled. Right now that's a differentiator, not a filter: 4 of the 11 ads don't name AI in the job's duties at all. I think "show me how you checked an AI's work" becomes a normal GRC interview question within a couple of years, and the people who can answer it now get the better roles first. For the wider picture, see will AI replace cyber security jobs.
That leaves the practical part: how do you show you can do it?
How to Become a GRC Analyst, or Move Up, Now
If you're starting a career in GRC, learn one framework properly first, so you know what a control is and what evidence would prove it. Our GRC training covers the foundations. If you're already in the job, skip straight to building something. Either way, the clearest proof I know of is one project:
Pick 20 controls from a framework you know, and gather evidence from free practice files, not your employer's systems.
Write your own answer for each control first. Met, not met, or not enough evidence. Check each one against the framework's own guidance. This is your answer key.
Let an AI agent assess the same controls from the same evidence.
Grade it against your answers and note every place it accepted something that proved nothing.
Write one resume line with a number in it, built from your own results.
I walk through exactly this project in the video at the top of this page, including the moment the AI got it wrong and the moment we did too. The full written steps, with every command, are in our GRC projects guide.
You can track who's hiring for these roles, with the employer's exact wording and pay, on our AI-driven cyber security jobs page. And if you want a structured path through all five skills, with people doing the same thing beside you, that's what our AI Master's Program is for. The ads have told us what they want. The good news is that every one of these skills can be learned.
How We Read the Ads
| Step | What we did |
|---|---|
| Source | The Greenhouse public job board API, which returns live jobs only |
| Frame | 114 general tech company boards, not chosen for AI, of which 66 were live: 10,380 jobs on 12 November |
| Filter | Titles mentioning GRC, governance, compliance, risk, audit or assurance (244 roles), then security roles only |
| Coding | Every sentence mentioning AI, agents, LLMs, machine learning, automation or scripting read by hand, and counted only when it was part of the job's duties or requirements, not company boilerplate |
| Coded set | 11 security GRC analyst-level roles (analyst and specialist titles) and 10 GRC engineer roles |
| September quotes | Rokt, Vanta, Gusto and OKX quotes come from ads we captured in September 2026. The Rokt, Vanta and Gusto ads have since closed |
The limits: Greenhouse only, mostly US tech, and a small analyst set. "Hundreds of ads" is my own reading across our job research; every job count and salary figure comes from the November sample, apart from the September quotes marked as such.
FAQ
Is GRC a good career?
Yes. In our November sample of 10,380 live jobs, 9 of the 11 security GRC analyst roles named AI or automation in the job's duties, and the published pay ran from $134,000 at the low end of an analyst role to $345,000 at the top of a specialist role at an AI company. The work is changing, which is exactly why there is room to move up.
Will GRC be replaced by AI?
Not on the evidence in today's job ads. The ads we read automate mostly the collecting: gathering evidence, monitoring controls and drafting questionnaire answers. They hire people to decide whether that evidence proves anything, and to check the AI's work before it becomes the record.
Do I need to code for a GRC career?
Not as a software engineer. Several ads say so in writing. Affirm asks for someone fluent enough to read, modify and run scripts and build small tools, and Vercel says you do not need to be an engineer to build GRC with AI.
How much does a senior GRC analyst earn?
In live US job ads we read on 12 November, a Senior GRC Analyst at Roblox was advertised at $180,570 to $224,310 base, and a Senior Security Assurance Analyst at Lyft at $148,000 to $185,000. Smaller companies and other locations often pay less.
How do I become a GRC analyst with no experience?
Learn one framework well, such as SOC 2 or ISO 27001, so you understand what a control is and what evidence proves it. Then build one small project that shows you can check an AI's work against your own answers, and put the result on your resume with a number.
What is the future of GRC?
Machines do more of the collecting and monitoring, and people own the judgment: whether evidence proves a control, where AI can be trusted to run, and how the AI itself is governed. Companies are also hiring GRC engineers to build the automation, at nearly the same rate as analysts in our sample.
About the Author
Nathan House, Founder & CEO of StationX
Nathan House has 30 years of hands-on cybersecurity experience and is Cambridge-educated, holding CISSP, CISA, CISM, OSCP, CEH, and SABSA. He founded StationX in 1999 — one of the UK’s first cybersecurity companies — and has secured £71 billion in UK mobile banking transactions and the London 2012 Olympics, advising clients including Microsoft, Cisco, BP, Vodafone, and VISA. He authored the world’s most popular cybersecurity course — a #1 Udemy bestseller taken by over 500,000 students — and was named Cyber Security Educator of the Year 2020, AI Security Educator of the Year, and a UK Top 25 Security Influencer 2025. A DEF CON speaker and featured expert on CNN, Fox News, NBC, and the BBC, Nathan leads StationX’s training of more than half a million students worldwide.
