Cyber Security Risk Manager — career path
StationX Advanced
The GRC career at its senior end: identify, measure and own the organisation's cyber risk. Security+ for the technical grounding, GRC and ISO 27001 for the method, then CRISC and CISM.
1 course · 8 sections · 28 lectures
Free to start: the free lessons and guides for this roadmap →
Try a free cloud security lab: Left open (~4 min) → A scripted simulation in your browser. No account needed.
The path
Start here →
Step 1 — Security foundation
You cannot rate a risk you do not understand technically.
follows the whole CompTIA Security+ (SY0-701) roadmap: 11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
Learn
- PathFollow the CompTIA Security+ (SY0-701) path — the technical baseline behind every risk decision
11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
9 steps — The industry-standard entry certification for a cyber security role.
Step 2 — Governance, risk and compliance
Risk registers, treatment plans, frameworks — the daily work.
1 course · 8 sections · 28 lectures
Learn
- CourseGRC Fundamentals - Learn Governance, Risk, and Compliance (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
8 sections · 28 lectures
- Course Overview 2
- Introduction 1
- Introducing GRC 5
- Risk Management 7
- Compliance 5
- Advancing GRC in an Organization 6
- Conclusion 1
- Audio Version of Training 1
Start here: this is the introductory GRC course; the CRISC step's GRC courses go deeper.
Step 3 — The management system
Build and audit an ISMS — the structure risk management lives in.
follows the whole ISO/IEC 27001:2022 — Lead Implementer and Internal Auditor roadmap: 5 courses · 34 sections · 290 lectures · 7 labs · ≈ 9 h of hands-on labs
Learn
- PathFollow the ISO/IEC 27001:2022 — Lead Implementer and Internal Auditor path — the standard most organisations manage risk against
5 courses · 34 sections · 290 lectures · 7 labs · ≈ 9 h of hands-on labs
3 steps — The international standard for information security management.
Open the full ISO/IEC 27001:2022 — Lead Implementer and Internal Auditor roadmap →
Step 4 — The risk certification
The credential written for this job. We have no CRISC course or practice test yet; our GRC and continuity courses cover each domain.
follows the whole CRISC — Certified in Risk and Information Systems Control roadmap: 4 courses · 30 sections · 141 lectures · 28 labs · ≈ 38 h of hands-on labs
Learn
- PathFollow the CRISC — Certified in Risk and Information Systems Control path — governance, risk assessment, risk response and reporting, and technology and security — the current CRISC domains — needs 3 years' experience to certify (you can pass the exam first)
4 courses · 30 sections · 141 lectures · 28 labs · ≈ 38 h of hands-on labs
4 steps — Enterprise IT risk management on the current outline (from 3 November 2025): governance, risk assessment, risk response and reporting, and technology and security.
Open the full CRISC — Certified in Risk and Information Systems Control roadmap →
Step 5 — The management certification
For the step up to running the whole programme.
follows the whole CISM — Certified Information Security Manager roadmap: 8 courses · 32 sections · 258 lectures · 3 labs · ≈ 5 h of hands-on labs
Learn
- PathFollow the CISM — Certified Information Security Manager path — the certification senior risk adverts pair with CRISC — needs 5 years' experience to certify, of which up to 2 can be waived (you can pass the exam first)
8 courses · 32 sections · 258 lectures · 3 labs · ≈ 5 h of hands-on labs
5 steps — The management-track certification: governance, risk management, the security programme and incident management.
Open the full CISM — Certified Information Security Manager roadmap →
Where this leads
Choose your next roadmap
Advanced · after the job
The AI-Driven Cyber Security Risk Manager
Senior roles are going to the people who can direct AI to build security solutions. When you're working in the role and ready for that step, the AI Master's Program is where it's taught — an advanced, application-only programme.
See the AI Master's Program →Application-only. A separate programme for when you're ready.