GRC Engineer Skill Map

This is the reference card for the entire bootcamp. Each row is a skill a working GRC Engineer uses. The columns map each skill to the framework criteria it satisfies, the tools that implement it, and the phase where this bootcamp covers it.

Save this page. Come back to it after each phase to see how far you have moved.

Identity & Access Management

Skill                    SOC 2         ISO 27001       Tools                  Phase
─────────────────────────────────────────────────────────────────────────────────────
SSO/SAML/OIDC config     CC6.1         A.9.4.2         Okta, Entra ID         2
MFA enforcement          CC6.1         A.9.4.2         IdP + Conditional      2
IAM policy writing       CC6.1         A.9.2.3         AWS IAM, GCP IAM       2
RBAC/ABAC design         CC6.3         A.9.2.2         IdP Groups + Cloud     2
Access reviews           CC6.2         A.9.2.5         IGA platforms          2
Service account mgmt     CC6.1         A.9.4.4         Vault, workload ID     2
SCIM provisioning        CC6.2         A.9.2.1         Okta, Azure AD         2

Identity skills and where they live in frameworks

Endpoint & Device Security

Skill                    SOC 2         ISO 27001       Tools                  Phase
─────────────────────────────────────────────────────────────────────────────────────
MDM enrollment           CC6.7         A.8.1.1         Jamf, Intune           3
Disk encryption          CC6.7         A.10.1.1        FileVault, BitLocker   3
EDR deployment           CC6.8         A.12.6.1        CrowdStrike, S1        3
Patch compliance         CC7.1         A.12.6.1        MDM + SCCM             3
Conditional access       CC6.1         A.9.4.1         IdP + MDM signals      3

Endpoint skills mapped to frameworks

Data Protection

Skill                    SOC 2         ISO 27001       Tools                  Phase
─────────────────────────────────────────────────────────────────────────────────────
Encryption at rest       CC6.7         A.10.1.1        KMS, HSM               4
Encryption in transit    CC6.7         A.10.1.1        TLS, ACM               4
Key management           CC6.1         A.10.1.2        AWS KMS, Vault         4
Data classification      CC6.5         A.8.2.1         DLP policies           4
Backup + recovery        A1.2          A.12.3.1        RDS snapshots, Velero  4
DLP configuration        CC6.5         A.8.2.2         Google DLP, Macie      4

Data protection skills mapped to frameworks

Network & Infrastructure

Skill                    SOC 2         ISO 27001       Tools                  Phase
─────────────────────────────────────────────────────────────────────────────────────
VPC/network segmentation CC6.6         A.13.1.3        AWS VPC, GCP VPC       5
WAF configuration        CC6.6         A.13.1.1        CloudFront, Cloudflare 5
Security group review    CC6.1         A.13.1.1        AWS SGs, NSGs          5
DNS security             CC6.6         A.13.1.2        Route 53, DNSSEC       5
Zero-trust networking    CC6.1         A.13.2.1        Tailscale, Zscaler     5

Network skills mapped to frameworks

Compliance & Audit

Skill                    SOC 2         ISO 27001       Tools                  Phase
─────────────────────────────────────────────────────────────────────────────────────
Evidence collection      All CC        All Annex A     Vanta, Drata, Tugboat  8-9
Control mapping          All CC        All Annex A     Spreadsheets + GRC     8
Gap remediation          All CC        All Annex A     Jira + GRC platform    8
Policy writing           CC1.1         A.5.1.1         Markdown, policy mgmt  8
Audit readiness          CC4.1         A.18.2.1        Evidence binders       8
Risk register mgmt       CC3.1-3.4     A.8.2           GRC platforms          1
IaC compliance           CC8.1         A.14.2.2        OPA, Checkov, tfsec    9

Compliance automation skills

How to Read This Map

If you are coming from IT/sysadmin: You probably know the tools column. The bootcamp teaches you the framework column, so you can explain WHY you configure things a certain way.

If you are coming from audit/compliance: You probably know the framework column. The bootcamp teaches you the tools column, so you can verify controls are actually enforced, not just documented.

If you are starting from scratch: Go top to bottom, phase by phase. Each phase builds on the one before it.

This is your career map

A GRC Engineer who can do everything in this table commands $140-180K in 2026. You do not need all of it on day one. You need identity (Phase 2), one cloud platform (Phase 1), and the translation layer (Phase 8). Everything else is depth you build over the first year on the job.