Why the question comes up now
The honest answer is yes — but the reason it is yes is more specific than "cybersecurity is a growing field." Hiring has cooled across most entry-level security operations postings through 2025 and into 2026, and the IT-ops-adjacent roles that have traditionally fed GRC pipelines have tightened their filters. GRC has held up better than the SOC queue because the work is anchored to a regulatory clock that does not slow down: audit windows, vendor renewals, board-cycle surveillance, and the OCR inquiry cadence all keep producing hiring demand even when the broader security market softens. The signal to watch is not whether companies are hiring security people — it is whether they are still filing the same SOC 2 Type II, renewing the same ISO 27001 certificate, and answering the same HIPAA Risk Analysis mandate. They are.
The role has a lower ceiling on the upside swings than a detection engineering career pursued aggressively, and the work is more writing-heavy than most candidates expect. The upside is durability — the audit clock keeps running through hiring slowdowns, the regulatory burden keeps expanding into adjacent functions (AI governance, third-party concentration, supply-chain attestations), and the language the hiring manager is screening for is increasingly a published taxonomy rather than a vibe check. NIST CSF 2.0 explicitly added a Govern function in 2024, and SOC 2 Common Criterion CC1.1 — the control environment around policies, roles, and oversight — is the first criterion a SOC 2 Type II auditor opens on every engagement. Hiring now expects you to be able to name those terms the way a tax accountant is expected to be able to name a 1099.
Demand and salary signals
- SOC 2 Type II is still the gating artifact for most B2B SaaS sales cycles, and CC1.1 (the control environment around policies, oversight, and roles) is the criterion a SOC 2 Type II auditor opens with on every engagement. The pipeline of SOC 2 readiness work has not slowed even when engineering hiring has.
- ISO 27001:2022 continues to be the framework auditors cite first when the customer is European or federal-adjacent. The Annex A controls named on the Statement of Applicability — particularly A.5.1 (policies for information security) and A.5.2 (information security roles and responsibilities) — are the ones a Stage 2 auditor opens with during a recertification audit, so an analyst who speaks that language from day one is materially more hirable than one who has to learn it on the job.
- HIPAA-adjacent postings are running hot because the Risk Analysis mandate at §164.308(a)(1)(ii)(A) is the most-cited deficiency in OCR resolution agreements. Every covered entity and business associate in active enforcement carries a fresh obligation to produce the analysis on a regulator-requested clock, and that obligation does not pause when the broader security market cools.
- The DoD 8570 / 8140 mapping still lists Security+ as the baseline credential for federal and federal-adjacent postings, which means the entry-level credential pipeline for GRC has not been replaced by graduate degrees or proprietary bootcamps. The floor remains a credit-passable exam plus the language to pass a behavioral round.
- Hiring signals have visibly shifted between 2024 and 2026 — entry-level SOC analyst postings tightened while GRC analyst postings held or grew. The candidates who planned for GRC as the destination rather than a fallback have had a meaningfully easier time getting offers.
- Salary data tracks the same curve: GRC analyst mid-band in US metros has held or grown in the same window where generic security-operations postings slipped. The roles that did best combine one regulated framework (SOC 2, ISO 27001, or HIPAA) with one or two cross-functional skills (vendor review, privacy, audit-readiness).
Why the role is durable
- An auditor-ready finding is observation plus criteria plus recommendation plus cited evidence, and the writing voice that survives a senior auditor review is the voice that earns the next cycle. Current AI tools can draft a finding that reads well in isolation, but they cannot carry the disconfirming evidence or the negotiation with the control owner that produces the version the org accepts. The writing muscle that compounds is the muscle a manager reads, not the muscle a model reads.
- GRC sits in the meeting structure the regulation explicitly mandates — risk council, vendor readouts, evidence-collection stand-ups, audit kickoff, and readouts. The cross-functional routing work that produces a defensible program is work a model cannot replace end-to-end, because the function is to translate between legal language and engineering language without losing either side. ISO 27001:2022 calls this out directly: the supplier-relationship cluster of controls — A.5.19 (information security in supplier relationships), A.5.20 (addressing information security within supplier agreements), and A.5.21 (managing information security in the ICT supply chain) — is the cluster of three an ISO 27001 auditor opens with when scoping a third-party program. That cluster cannot be operated by a model; the relationships remain owned by a person.
- An auditor relationship is owned by a person who has been on the call before. The accountability cycles — SOC 2 annual, ISO 27001 triennial, HIPAA Security Rule ongoing — are calibrated to a human cadence, and the conversation when a finding is escalated is the conversation the auditor has with whoever has signed the management response. Models can produce drafts; they cannot sign the management response and they cannot steward the auditor through a contested finding.
- The work lives in the meeting structure the regulation mandates. GRC is to enterprise risk what payroll is to finance: the function is small relative to the org, the regulatory clock is non-negotiable, and the artifacts the regulator expects are the artifacts the org produces. It is hard to AI-displace a function whose deliverable is a wet-signed management response.
Who tends to do well
The profile that does well in GRC is structured-writing first, cross-functional-routing first, and second-career-equipped first. Candidates from IT support, audit, legal, project management, and paralegal backgrounds tend to onboard faster than candidates from pure engineering — the writing-routing-adjudication muscle is the same muscle their last role paid them to develop, which means the first ninety days of the analyst job are mostly language acquisition (the framework, the rules, the in-house vocabulary) rather than skill acquisition. The candidate from engineering who adapts is the one who treats themselves as a translator between legal and engineering rather than an engineer wearing a compliance hat; the candidate who cannot make that switch tends to drift back toward the SOC queue.
Less obviously, the candidates who do best share one trait: they can hold "compliance is not the same as security" at the front of their thinking for an entire cycle. The analyst who can defend a clean SOC 2 opinion while also naming the controls that are decorative — the ones mapped to satisfy CC6.1 but not actually mapped to the access path an attacker would use — is the analyst the function needs. A passing opinion is a single number on a customer-facing trust page; the under-the-surface reality — which controls map to the threat, which controls are mapped because the framework requires them, and which controls are unmapped and unowned — is the work an entry-level analyst can start contributing to in the first quarter. The candidates who do that early are the ones who get the promotion review on the original timeline rather than the delayed one.
Next steps
- Open the ISO 27001 walkthrough at /courses/iso-27001 — ISO 27001:2022 is the framework most GRC analysts cite first, and the Annex A control numbering is the one auditors use during a Stage 2 audit.
- Run the NIST CSF 2.0 primer at /courses/nist-csf-2-quickstart — the Govern, Identify, Protect, Detect, Respond, and Recover functions are the simplest way to talk about both tracks in shared language across the org.
- Pick one entry-level credential from /certifications — Security+ is the right first one for most US federal-adjacent postings; CISA follows once the first audit cycle is behind you.
- Use the GRC analyst prep track on the /roadmap — Stages 1 through 4 cover the curriculum most entry-level postings screen against, with the certification stages layered in once the first artifact review is in your portfolio.
- If you have decided the answer is yes, the next concrete read is /blog/how-to-start-a-career-in-grc — that post walks the first 90 days and the artifact set hiring managers most often screen for.