GRC, IT audit or third-party risk: choose by the work

Choose a target role by examining its work, not by deciding which acronym sounds most accessible. A GRC analyst might coordinate evidence and risk reporting. An IT auditor might test a control and document a supported conclusion. A third-party risk analyst might investigate a supplier and track unresolved conditions. Employers can combine these responsibilities in one position.

Your first useful output is a one-page role brief: the decisions you would support, the documents you would produce and the experience you can honestly bring.

Compare the deliverables

Preparation path	A useful practice assignment	What your explanation should show
GRC	Maintain a small risk register and prepare an exception update	Specific scenarios, clear owners and useful reporting
IT audit	Write a control-testing worksheet for a fictional process	Criteria, scope, evidence, procedure and a limited conclusion
Third-party risk	Review a fictional vendor package and request missing evidence	Service context, relevant gaps and a defensible next step

These are educational examples, not universal job descriptions. A real position may require technical testing, specialized systems, regulated-sector knowledge or prior experience that a short project cannot replace.

What three employer examples illustrate

A public MBTA GRC analyst posting combines risk assessment, policy work, supplier review and audit support. It illustrates how broad a GRC remit can be. It does not establish that every junior candidate is expected to have led all those activities.

Sikich's staff federal IT auditor posting emphasizes control testing and documented work products. It also describes clearance requirements and contract contingency. Those conditions matter to application fit; a general audit-preparation resource should not hide them.

True Anomaly's third-party and supply-chain risk posting describes a role supporting vendor-risk work across business functions. That is a different context from a position focused only on collecting annual questionnaires. Read the whole posting and confirm that it remains open before applying.

A fictional candidate comparison

Suppose Maya works in procurement operations. She coordinates renewals, follows up with suppliers and maintains a record of unresolved commercial conditions. Those are relevant starting points for supplier-risk coordination. They do not establish that she has assessed security architecture or made an authorized risk-acceptance decision.

Her preparation should keep both sides visible. She can explain how she manages follow-up, records ownership and escalates a delay. Separately, she can build a fictional vendor-security case to practice identifying evidence limitations. On her resume, the employer work belongs under experience; the exercise belongs under projects.

Now consider Leo, who has supported financial audit fieldwork. He may have experience tracing a conclusion to a document and responding to review notes. His next task is to learn the particular technology process being examined. Renaming financial-audit work as IT-control testing would overstate his background.

Build your role brief

Choose three current postings in the same geography and seniority range. Record:

The most important work verbs: assess, test, coordinate, maintain, report or advise.
The output attached to each verb: assessment, workpaper, evidence register, dashboard or memo.
Requirements that constrain eligibility, including location, authorization, clearance and experience.
One supported example from your background for each major task.
One unresolved skill gap and a bounded way to investigate it.

Do not treat three postings as a market census. They are enough to make your first learning plan more specific. If they point in very different directions, narrow your target before buying more courses or rewriting your whole resume.

Sources and next step

Employer examples read September 24, 2026: MBTA GRC analyst, Sikich staff IT auditor, and True Anomaly third-party and supply-chain risk analyst. Listings can close or change.

Use the job-description worksheet method to turn your comparison into an application brief.

A relevant next step

Once you have a direction, the Career Transition Guide provides a working sequence from role brief to application. Read the actual preview to judge whether it fits your preparation.

For a more specific starting point, read the transitions from audit, IT operations or procurement, or the guide to preparing without a security job.