◢ Career Paths
A career path sequences the right certifications, in the right order, with a capstone — so you finish ready for a named, in-demand role. One enrollment, one focus: career readiness.
A guided journey, not a pile of courses.
How a path works. 1 · Sequenced certifications The exact programs to take, in the order that builds real competence — no guesswork.
2 · A capstone Finish by building an end-to-end portfolio piece employers and recruiters can actually see.
3 · A named role Every path points at a specific, in-demand job title — and the skills to land it.
Choose your path
Eight routes to a cyber career. Each bundles its certifications below the price of buying them separately.
Outcome → GRC Analyst GRC Analyst Path Career-changers entering cybersecurity through governance, risk & compliance — no technical background needed.
Build and maintain a risk register and run qualitative risk assessments Map controls across ISO 27001, NIST and SOC 2 Write policies and support internal & external audits The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 GRC Analyst Certification
Governance, risk & compliance core
3 ISO 27001 Internal Auditor
Audit against Annex A
4 SOC 2 Readiness
Gap to audit-ready
★ Capstone: full GRC package
Policies, risk register, control matrix, audit-prep report
Outcome → SOC Analyst SOC Analyst Path People who want to work in a Security Operations Center — monitoring, triaging alerts, and responding to incidents. A hands-on route into blue-team cybersecurity, no prior experience needed.
Triage security alerts and investigate events with a structured workflow Run the detection-to-reporting incident response lifecycle Map monitoring and response to the NIST Cybersecurity Framework The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 CompTIA Security+ Prep
Baseline security knowledge
3 CompTIA CySA+ Prep
The Cybersecurity Analyst cert — detection & analysis
4 Incident Response & Reporting
Detection-to-reporting workflows
★ Capstone: triage & IR runbook
Investigate events and document the response end-to-end
Outcome → TPRM Analyst Third-Party Risk Path Analysts, IT and audit staff who want to specialize in vendor and third-party risk management.
Run end-to-end vendor due diligence with SIG & CAIQ Analyze SOC 2 reports and score vendor risk Build a vendor risk register and continuous-monitoring process The journey
1 GRC Analyst Certification
Your GRC foundation
2 TPRM Specialist
The third-party risk lifecycle
3 Vendor Questionnaire Mastery
SIG · CAIQ analysis
★ Capstone: third-party assessment
A full vendor risk assessment report
Outcome → ISO 27001 Implementer / Auditor ISO 27001 Path Those who want to build and audit an ISO 27001 ISMS — a globally recognized route into GRC and information-security management.
Define an ISMS scope, run an ISO risk assessment and build the risk treatment plan Write a defensible Statement of Applicability across the ISO 27002 controls Plan and run internal audits to ISO 19011 — findings, nonconformities and CAPA The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 GRC Analyst Certification
Governance, risk & compliance core
3 ISO 27001 Internal Auditor
Audit against Annex A
★ Capstone: ISMS package
Scope, risk assessment, SoA and an internal audit report
Outcome → ISSO / Security Control Assessor ISSO & Security Assessor Path Those targeting federal information-system security roles — running the NIST RMF and assessing controls toward an authorization.
Run the NIST Risk Management Framework end to end (SP 800-37) Author SSP control implementation statements and a Security Assessment Report Perform ISSO duties — categorization, POA&Ms and continuous monitoring The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 NIST RMF Implementation
Categorize → authorize → monitor
3 ISSO Training
The day-to-day ISSO role
★ Capstone: RMF authorization package
Categorization memo, SSP sections, SAR finding and POA&M
Outcome → IT Auditor IT Auditor Path Analysts and audit staff who want to plan and run IT audits across NIST, ISO, SOX and COBIT.
Plan a risk-based IT audit — objectives, scope and test plans Test ITGCs (access, change, operations) and gather defensible evidence Write findings with root cause and present them to leadership The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 IT Audit & Controls Fundamentals
Control design & testing
3 ISO 27001 Internal Auditor
Audit against a framework
4 SOC 2 Readiness
Trust Services controls
★ Capstone: audit portfolio
Audit plan, test scripts, findings memo and report
Outcome → ISSO / RMF Analyst Federal & Defense Path Those targeting U.S. government and defense-contractor roles handling controlled information.
Protect CUI and prepare for CMMC L1 & L2 against NIST 800-171 Run the NIST RMF end to end (SP 800-37) Perform ISSO duties — SSPs, POA&Ms, continuous monitoring The journey
1 Cybersecurity Foundations
The core concepts & landscape
2 CMMC Level 1 & 2 Practitioner
CUI & NIST 800-171
3 ISSO Training
The day-to-day ISSO role
4 NIST RMF Implementation
Categorize → authorize → monitor
★ Capstone: RMF authorization package
SSP, POA&M and authorization artifacts
Outcome → AI Governance Analyst AI Governance Path GRC professionals future-proofing into the fast-growing field of AI governance and risk.
Apply GRC fundamentals to AI systems and data Handle privacy & data protection (GDPR / UK GDPR) Govern AI risk, regulation and controls responsibly The journey
1 GRC Analyst Certification
Your GRC foundation
2 Privacy & Data Protection
GDPR / UK GDPR
3 AI GRC Practitioner
Govern AI risk & compliance
★ Capstone: AI governance framework
A working AI risk & governance program
Every path is backed by
Hands-on labs. A capstone. A real role. Add 1:1 coaching and resume support to any path, and finish ready to apply with confidence.
Fourth Tech is a 501(c)(3) nonprofit workforce development organization advancing cybersecurity, GRC, and Artificial Intelligence education.
© 2026 Fourth Tech. All rights reserved. Practitioner-designed certificates · aligned to NIST, ISO 27001, CMMC & SOC 2
