Start Your Quiz

20 questions across the five areas GRC hiring managers look for. About 5 minutes. It's built to be hard without training, so answer honestly rather than guessing. You'll see your scores at the end and get your full GRC Readiness Report by email.

DOMAIN 1 OF 5

Frameworks and standards: Which framework fits which organisation, and why.

An Irish fintech wants a certification it can show clients in Europe, the US and Africa, covering how it manages information security. Which should it pursue? *

SOC 2 Type II

ISO 27002

ISO 27001

NIST CSF 2.0

A client wants proof that your controls actually worked over the last twelve months, not just that they were designed well. What are they asking for? *

A SOC 2 Type I report

A SOC 2 Type II report

Your ISO 27001 statement of Applicability

A copy of your ISO 27001 Stage 1 audit

Which statement about NIS2 is accurate? *

Medium and large entities in listed sectors are generally in scope, and management can be held liable

It applies only to operators each member state has formally designated as essential

It mainly covers banks, insurers and the ICT providers that support them

It replaced GDPR as the EU's main rule for securing personal data

In an ISO 27001 programme, which document lists every Annex A control, whether it applies, and why? *

The risk treatment plan

The information security policy

The risk register

The statement of Applicability

DOMAIN 2 OF 5

Risk and controls: Spotting risk, judging controls, deciding what happens next.

Every quarter, managers review who has access to the finance system and remove anyone who shouldn't be there. What type of control is the review? *

Preventive

Detective

Compensating

Directive

A risk is rated High before controls and Medium after them. The board's appetite for this kind of risk is Low. What should happen next? *

Accept it, because the controls have already brought it down a level

Transfer it by adding the scenario to the company's cyber insurance

Treat it further, or have someone with the authority formally accept it

Reassess the inherent rating, since the starting score was probably too high

Your company is about to give a new supplier access to customer data. What's the best first step? *

Send the supplier your standard security questionnaire and sign once it's returned

Ask for their ISO 27001 certificate and treat it as enough evidence

Have IT run a vulnerability scan against the supplier's public website

Tier the supplier by the data and access involved, then set the assessment depth

You test 25 access requests for approval. Two have no approval recorded. What do you do? *

Log both as exceptions, find the cause and report to the control owner

Conclude the control is effective, since 92% of the sample passed

Ask the requesters to get approval now, then record the items as passed

Expand the sample to 50 before recording anything at all

DOMAIN 3 OF 5

Tooling and evidence: What counts as proof, and how controls get tested.

An auditor asks for proof that last quarter's access review happened. Which evidence is strongest? *

A signed attestation from each manager confirming the review was done

A system export showing reviewers, timestamps and every action taken

Screenshots of the review screen taken by one of the reviewers

The access policy requiring reviews every quarter

You have 400 changes from the year and will test 25 to reach a conclusion about all of them. What matters most about how you pick the 25? *

They're the highest-risk changes in the year

They're the most recent, so the evidence is easy to find

They're spread randomly across the whole year

The change team picks ones they can document fully

An auditor asks for one document showing each control, the risk it addresses, its owner and how it's tested. What is it? *

A risk and control matrix

A risk register

A Statement of Applicability

An information security policy

What's the main thing a GRC platform like Vanta or Drata does for a company? *

Issues the certification once every automated test passes

Collects evidence from connected systems and flags failing controls

Replaces the need for an external auditor on smaller audits

Scans the company's code and cloud for vulnerabilities

DOMAIN 4 OF 5

Business and communication: Explaining risk so a manager can decide

Staff read work email on personal phones with no controls. How do you raise it with a non-technical manager? *

Explain that it breaches ISO 27001 and needs fixing before the next audit

Explain what could happen, the business impact and options with rough cost

Recommend rolling out device management to all staff this quarter

Send them the full technical findings so they have all the detail

An interviewer says "Tell me about yourself." What would you actually do? *

Summarise my career in order, from my first role to now

Lead with my new certifications to show my commitment

Explain why I'm leaving my field and what drew me to GRC

Pick two things from my past work that match this role and link them

Which of these could you describe in an interview today, with a real example? *

A time I spotted a weak process, got it fixed and can say what changed

A time I followed a strict process carefully under pressure

A time I trained colleagues on a new system or procedure

None of these yet

An interviewer asks "Why GRC?" Which is closest to your honest answer? *

Because it's the area of security that doesn't need coding

Because demand for security people keeps growing

Because I enjoy structure, frameworks and regulation

Because I've done audit, policy or compliance-type work and want to apply it to security

DOMAIN 5 OF 5

Positioning and proof: Aiming at the right roles and getting seen.

Which roles are you actively applying for? *

Anything with cybersecurity in the title

SOC analyst and GRC analyst, to widen my chances

GRC, IT risk and compliance analyst roles

Senior GRC roles, because I've managed teams before

Which best describes your CV right now? *

My past work rewritten to show risks, controls and outcomes

My existing CV with a new certifications section added

A new CV that lists every framework I've studied

I haven't changed it yet

If a hiring manager asked what proves you can do GRC work, what would you show? *

My certificates and course completion badges

My LinkedIn posts about GRC topics

A piece of work like a risk assessment I can walk through

Nothing yet

How do you mainly look for roles? *

Easy Apply to as many relevant roles as I can

Registering with recruiters and letting them find roles

Job boards with a strong, well-formatted CV

Tailored applications plus a message to someone on the team

Please fill in your information below and click Next.

Full Name *

Email *

Also send me GRC Sage updates, including founding cohort news. Unsubscribe any time.

We'll email your report from GRC Sage. Your scores are never shared with potential employers or anyone else. privacy policy