About
Learn GRC engineering by doing it
GRC Engineering Academy is a hands-on training ground for governance, risk and compliance. It takes you from your first security concept to building automated controls and evidence pipelines, one scored room at a time.
- tracks
- 8
- tracks
- rooms
- 82
- rooms
- labs
- 166
- labs
- badges
- 106
- badges
What is GRC engineering?
Traditional compliance runs on spreadsheets, screenshots and once-a-year audits. Evidence is collected by hand, goes stale the day after it is taken, and the work grows with every new framework. GRC engineering treats compliance as a software problem instead. Controls are written as code, evidence is pulled straight from the systems that produce it, and checks run continuously, so you know the state of a control today, not last quarter.
The field is young, and people at every level are learning it at the same time. Most material is either framework text or vendor marketing. This academy gives you a place to practise the actual skills.
Who it is for
- Career changers moving into cybersecurity or GRC, starting with the prerequisite paths.
- GRC analysts and auditors who want to automate the repetitive parts of their work.
- Security and cloud engineers who are handed compliance work and want to understand what auditors actually need.
- Team leads building a modern program and looking for a shared language with their team.
The learning path
Optional
Prerequisites
Four vendor-neutral on-ramps for people new to tech: IT, Networking (down to subnetting and route summarisation), Cloud building blocks, and Applications. Skip any you already know.
Step 1
GRC Fundamentals
Cybersecurity essentials, the shared vocabulary, governance, risk assessment, legal and contractual obligations, security operations, resilience, people and third parties, frameworks, policies, control testing, evidence and the audit lifecycle. Ends in the Foundations Capstone.
Step 2
Automation & Code
Why spreadsheets fail, your first automated control, policy as code, OSCAL, GRC APIs and a step-by-step build of a real evidence pipeline with working code.
Step 3
Data & Evidence
Evidence that proves itself: populations, sampling, integrity, continuous control monitoring, vendor risk automation and fourth-party visibility.
Step 4
AI & Advanced
AI governance, incident response as code, turning tabletop exercises into pipelines, and designing a full program. Each engineering track ends in a capstone.
How you learn
Rooms
Short, self-contained lessons with diagrams, then scenario questions written like real incident briefs. The wrong answers are tempting on purpose, and every question ends with a debrief explaining why.
Labs
Hands-on work checked by an evaluator: write a policy rule, fix a config, review a broken evidence run, or triage findings. Each lab lists its objectives, hints and rules before you start.
Capstones
Larger projects that open once you finish every other room in a track. Passing one earns a certificate with a public verification link.
Progress you can show
Every solved question and lab earns XP. XP moves you up six ranks, and badges mark finished rooms, tracks, streaks and lab milestones. Daily quests add bonus XP, and you can download a PDF progress report at any time.
What we believe
- Practice over reading
- You learn a control by testing it, not by reading the framework text about it.
- Vendor-neutral
- The ideas carry across clouds, tools and frameworks, so your skills move with you.
- Honest scoring
- Answers are graded on our servers, hints cost XP, and the leaderboard only shows people who opt in.
- Real-world scenarios
- Tasks are built around the messy cases auditors and engineers actually meet: missing populations, stale evidence, expired exceptions.
Start where you are
New to tech? Begin with the prerequisite paths. New to GRC? Start with GRC Fundamentals. Already working in the field? Jump into Automation & Code.