# GRC Engineering Club

> The GRC Engineering Club is the leading community for GRC engineers - professionals who treat governance, risk, and compliance as an engineering discipline, not a checkbox exercise. Founded by AJ Yawn.

## Site
- Domain: grcengclub.com
- Type: Professional community and educational platform
- Topics: GRC engineering, compliance automation, cloud security, cybersecurity careers

## Key Pages

- [Home](https://grcengclub.com/): Overview of the GRC Engineering Club, what GRC engineering is, and how to join
- [Learn Library (All Guides)](https://grcengclub.com/learn): Every GRC engineering guide organized by cluster: foundations, careers and getting in, certifications, AI and GRC, automation, and auditing the modern stack.
- [FAQ](https://grcengclub.com/faq): Common questions about GRC engineering, the club, cloud providers, certifications, and getting started
- [What You Get](https://grcengclub.com/what-you-get): Membership benefits - private podcast, AWS compliance labs, mock interviews, resume reviews, live Q&A
- [Your First 30 Days](https://grcengclub.com/first-30-days): Week-by-week roadmap for getting started in GRC engineering - Week 1 orientation and foundations, Week 2 hands-on AWS labs, Week 3 automation and evidence collection, Week 4 career and certifications. The Club's canonical "where do I start?" answer.
- [Member Stories](https://grcengclub.com/stories): Real career transformation stories from GRC Engineering Club members
- [The Academy](https://grcengclub.com/academy): The GRC Engineering Club certification hub. Compare the CGE-P (Practitioner) and the CGE-AUD (Auditor Specialty, available now) and choose the path that fits your role.
- [Certified GRC Engineer (CGE-P)](https://grcengclub.com/academy/cge-p): The CGE-P (Certified GRC Engineer – Practitioner) is the first GRC engineer certification built by working GRC engineers. Video training, hands-on labs, an open-book exam, and a real capstone project submitted on GitHub. Free for GRC Engineering Club members; $350 for non-members.
- [Certified GRC Engineer, Auditor Specialty (CGE-AUD)](https://grcengclub.com/academy/auditor): The CGE-AUD teaches auditors to evaluate code-defined controls without becoming engineers. Seven domains, ~4 hours of video, a 50-question open-book exam, no portfolio required. Launched July 15, 2026. Free for members; $350 for non-members.
- [CGE-AZ, Azure Specialty](https://grcengclub.com/academy/azure): Stacked on CGE-P. Build an automated GRC engineering pipeline on Azure across six labs; 50-question exam + graded capstone (the pipeline itself). $350 or free for members. Live now.
- [Chapters](https://grcengclub.com/chapters): Local GRC Engineering Club chapters worldwide. Each chapter gets a Claude license and a $500 annual event budget. Apply to be a founding chapter President.
- [Leadership](https://grcengclub.com/leadership): Meet the GRC Engineering Club leadership team
- [GRC Engineer Directory](https://grcengclub.com/directory): Find pre-vetted GRC engineers by specialization, certifications, and cloud expertise
- [claude-grc-engineering](https://grcengclub.com/projects/claude-grc-engineering): Open-source Claude Code plugin toolkit for GRC engineers — SCF crosswalk across 249 frameworks, evidence collection, gap reports, and OSCAL workflows
- [Events](https://grcengclub.com/events): Upcoming live sessions, past articles, labs, and recordings — new content every Tuesday, Thursday, and Saturday
- [Anticheckbox Book Tour](https://grcengclub.com/anticheckbox): Book signings and GRC community meetups in Dallas, Houston, and San Diego — Summer 2026
- [The AntiCheckbox Podcast](https://grcengclub.com/podcast): Weekly conversations with GRC engineers, assessors, and founders, hosted by Omar Sangurima. Watch on YouTube, hear it early on Patreon, or apply to come on as a guest.
- [Pricing](https://grcengclub.com/pricing): $9.99/month membership, price locked forever. Same access for every member, no tiers or upsells.
- [Annual Membership](https://grcengclub.com/annual): $70/year (save $50 vs monthly). Yearly subscription: renews automatically at $70, cancel any time; full refund within 14 days if you have not accessed the Club. Teams of 6+ get volume pricing (see Team Training). Members get 4 CPE hours a month (48 a year) logged to their Academy transcript for their Club learning (articles, live Q&As, recordings, labs, courses) and self-report them to ISC2, ISACA, IAPP, or GIAC; each body sets its own rules.
- [Team Training](https://grcengclub.com/teams): Ongoing GRC team training and professional development for L&D leaders and compliance managers. Volume pricing per seat per year: $70 for 1-5 seats, $55 for 6-15, $40 for 16+; renews yearly; invoices and POs available. Hands-on AWS labs, about 12 long-form articles a month, podcast, live Q&A; 4 CPE hours a month per seat logged to the Academy transcript for members to self-report.

## Learn Guides
## Local Chapters

Each chapter has its own page with its leadership team and city.

<!--CHAPTERS_START-->
- [Washington, DC, United States](https://grcengclub.com/chapters/washington-dc): official chapter
- [Austin, TX, United States](https://grcengclub.com/chapters/austin): provisional chapter
- [Atlanta, GA, United States](https://grcengclub.com/chapters/atlanta): provisional chapter
- [Raleigh, NC, United States](https://grcengclub.com/chapters/raleigh): provisional chapter
- [Hartford, CT, United States](https://grcengclub.com/chapters/hartford): provisional chapter
- [Augusta, GA, United States](https://grcengclub.com/chapters/augusta): provisional chapter
- [Huntsville, AL, United States](https://grcengclub.com/chapters/huntsville): provisional chapter
- [Fayetteville, NC, United States](https://grcengclub.com/chapters/fayetteville): provisional chapter
- [Hampton Roads, VA, United States](https://grcengclub.com/chapters/norfolk): provisional chapter
- [South Florida, United States](https://grcengclub.com/chapters/south-florida): provisional chapter
- [Toronto, Canada](https://grcengclub.com/chapters/toronto): provisional chapter
- [London, UK, United Kingdom](https://grcengclub.com/chapters/london): official chapter
- [Birmingham, UK, United Kingdom](https://grcengclub.com/chapters/birmingham): provisional chapter
- [Berlin, Germany](https://grcengclub.com/chapters/berlin): provisional chapter
- [Hyderabad, India](https://grcengclub.com/chapters/hyderabad): provisional chapter
- [Kenya](https://grcengclub.com/chapters/kenya): official chapter
- [New York City, NY, United States](https://grcengclub.com/chapters/nyc): official chapter
- [Chicago, IL, United States](https://grcengclub.com/chapters/chicago): provisional chapter
- [SF Bay Area, CA, United States](https://grcengclub.com/chapters/bay-area): provisional chapter
- [Dallas, TX, United States](https://grcengclub.com/chapters/dallas): provisional chapter
- [Houston, TX, United States](https://grcengclub.com/chapters/houston): provisional chapter
- [Dublin, Ireland](https://grcengclub.com/chapters/dublin): provisional chapter
- [Frankfurt, Germany](https://grcengclub.com/chapters/frankfurt): provisional chapter
- [Boston, MA, United States](https://grcengclub.com/chapters/boston): provisional chapter
- [Columbia, SC, United States](https://grcengclub.com/chapters/columbia): provisional chapter
- [San Antonio, TX, United States](https://grcengclub.com/chapters/san-antonio): provisional chapter
- [Boise, ID, United States](https://grcengclub.com/chapters/boise): provisional chapter
- [Doha, Qatar](https://grcengclub.com/chapters/doha): provisional chapter
- [Stockholm, Sweden](https://grcengclub.com/chapters/stockholm): provisional chapter
- [Helsinki, Finland](https://grcengclub.com/chapters/helsinki): provisional chapter
- [Detroit Metro, MI, United States](https://grcengclub.com/chapters/detroit-metro): provisional chapter
- [Philadelphia, PA, United States](https://grcengclub.com/chapters/philadelphia): provisional chapter
- [Nashville, TN, United States](https://grcengclub.com/chapters/nashville): provisional chapter
- [Phoenix, AZ, United States](https://grcengclub.com/chapters/phoenix): provisional chapter
- [Singapore](https://grcengclub.com/chapters/singapore): provisional chapter
- [Pittsburgh, PA, United States](https://grcengclub.com/chapters/pittsburgh): provisional chapter
- [Columbus, OH, United States](https://grcengclub.com/chapters/columbus): provisional chapter
- [Las Vegas, NV, United States](https://grcengclub.com/chapters/las-vegas): provisional chapter
- [Los Angeles, CA, United States](https://grcengclub.com/chapters/los-angeles): provisional chapter
- [Seattle, WA, United States](https://grcengclub.com/chapters/seattle): provisional chapter
- [Bengaluru, India](https://grcengclub.com/chapters/bangalore): official chapter
- [Fairbanks, AK, United States](https://grcengclub.com/chapters/fairbanks): provisional chapter
- [Salt Lake City, UT, United States](https://grcengclub.com/chapters/salt-lake-city): provisional chapter
- [Central Florida, United States](https://grcengclub.com/chapters/centralflorida): provisional chapter
- [Sydney, Australia](https://grcengclub.com/chapters/sydney): provisional chapter
- [San Diego, CA, United States](https://grcengclub.com/chapters/san-diego): provisional chapter
- [Richmond, VA, United States](https://grcengclub.com/chapters/richmond): provisional chapter
- [León, Spain](https://grcengclub.com/chapters/leon): provisional chapter
- [Dubai, United Arab Emirates](https://grcengclub.com/chapters/dubai): provisional chapter
- [Asheville, NC, United States](https://grcengclub.com/chapters/asheville): provisional chapter
- [Tokyo, Japan](https://grcengclub.com/chapters/tokyo): provisional chapter
- [New Delhi, India](https://grcengclub.com/chapters/new-delhi): provisional chapter
- [Al Khobar, Saudi Arabia](https://grcengclub.com/chapters/al-khobar): provisional chapter
- [Philippines](https://grcengclub.com/chapters/philippines): provisional chapter
- [Pakistan](https://grcengclub.com/chapters/pakistan): provisional chapter
- [Chennai, India](https://grcengclub.com/chapters/chennai): provisional chapter
- [Lexington, KY, United States](https://grcengclub.com/chapters/lexington): provisional chapter
<!--CHAPTERS_END-->

<!--LEARN_GUIDES_START-->
**Foundations**
- [GRC Engineering 101](https://grcengclub.com/learn/grc-engineering-101): the complete guide to what GRC engineering is, the skills, the tools, and the career paths.
- [GRC vs Traditional GRC](https://grcengclub.com/learn/grc-vs-traditional-grc): how engineered compliance differs from checkbox GRC.
- [GRC Analyst vs GRC Engineer](https://grcengclub.com/learn/grc-analyst-vs-grc-engineer): how the two roles differ and how to move from one to the other.

**GRC fundamentals**
- [What Is GRC?](https://grcengclub.com/learn/what-is-grc): governance, risk, and compliance defined, how they fit together in cybersecurity, roles, and automation.
- [What Is SOC 2?](https://grcengclub.com/learn/what-is-soc-2): soc 2 trust services criteria, type 1 vs type 2, cost drivers, and automating evidence.
- [What Is ISO 27001?](https://grcengclub.com/learn/what-is-iso-27001): iso/iec 27001:2022 clauses 4-10, 93 annex a controls, certification cycle, and automation.
- [What Is the NIST CSF?](https://grcengclub.com/learn/what-is-nist-csf): nist csf 2.0 six functions, 22 categories, profiles, tiers, and automation.
- [What Is NIST 800-53?](https://grcengclub.com/learn/what-is-nist-800-53): nist sp 800-53 rev 5 control families, 800-53b baselines, fedramp link, and oscal automation.
- [What Is CMMC?](https://grcengclub.com/learn/what-is-cmmc): cmmc levels 1-3, requirements, assessments, 2026 phase 2 suspension, and automation.
- [What Is a Security Control?](https://grcengclub.com/learn/what-is-a-security-control): security control definition, types, sp 800-53 examples, and testing methods.
- [What Is Audit Evidence?](https://grcengclub.com/learn/what-is-audit-evidence): audit evidence definition (as 1105), procedures, sufficiency and appropriateness, ipe, automated evidence.
- [What Is Policy as Code?](https://grcengclub.com/learn/what-is-policy-as-code): policy as code definition, vs compliance as code, rego/sentinel/aws config/cedar examples, ci rollout.
- [What Is OSCAL?](https://grcengclub.com/learn/what-is-oscal): oscal definition, layers and models, profile and component-definition json, fedramp rfc-0024.
- [What Is a Risk Register?](https://grcengclub.com/learn/what-is-a-risk-register): risk register definition, nist ir 8286 fields, example entries, five risk responses, yaml risk as code.
- [What Is Third-Party Risk Management?](https://grcengclub.com/learn/what-is-third-party-risk-management): tprm definition, lifecycle stages, framework mapping, vendor due diligence, automated tiering.

**Careers and getting in**
- [How to Break Into GRC Engineering](https://grcengclub.com/learn/how-to-break-into-grc-engineering): the step-by-step career transition guide.
- [Entry-Level GRC Jobs](https://grcengclub.com/learn/entry-level-grc-jobs): titles to target and how to land your first role.
- [GRC for Students](https://grcengclub.com/learn/grc-for-students): build skills and a portfolio before you graduate.
- [Get Into GRC With No Experience](https://grcengclub.com/learn/how-to-get-into-grc-with-no-experience): a realistic path from zero background.
- [From Cybersecurity to GRC](https://grcengclub.com/learn/cybersecurity-to-grc): how a security background maps to GRC.
- [GRC Without a Technical Background](https://grcengclub.com/learn/no-technical-background): breaking in from a non-technical start.
- [Join Without Technical Skills](https://grcengclub.com/learn/join-without-technical-skills): who the Club is for if you are early in your technical journey.
- [GRC Engineering Salary Guide](https://grcengclub.com/learn/grc-engineering-salary): what GRC engineers earn by level and specialization.
- [Cost to Get Into Cybersecurity](https://grcengclub.com/learn/cost-to-get-into-cybersecurity): degree vs bootcamp vs certification stack vs a $70 a year membership, priced for 2026.
- [First 30 Days as a GRC Job Seeker](https://grcengclub.com/learn/first-30-days-grc-job-seeker): the 30-day brand and portfolio plan that turns a job search into proof of work.

**Certifications**
- [GRC Engineering Certifications](https://grcengclub.com/learn/grc-engineering-certifications): the complete 2026 guide to every GRC certification.
- [CGE-P vs CISA](https://grcengclub.com/learn/cge-p-vs-cisa): hands-on engineering cert versus the classic IT audit credential.
- [CGE-P vs CRISC](https://grcengclub.com/learn/cge-p-vs-crisc): hands-on practice versus IT risk theory: isaca fees, experience, format, and when to hold both.
- [CGE-AUD vs CISA](https://grcengclub.com/learn/cge-aud-vs-cisa): the modern auditor specialty versus the framework-agnostic classic.
- [Best GRC Certifications for Beginners](https://grcengclub.com/learn/best-grc-certifications-for-beginners): where to start when you have no experience yet.
- [Cybersecurity Certification Costs 2026](https://grcengclub.com/learn/cybersecurity-certification-cost): exam fees, hidden fees, and renewal costs for 13 security and GRC certifications, and what $70 a year buys instead.
- [How Much Does CISA Cost?](https://grcengclub.com/learn/cisa-certification-cost): every ISACA fee totaled for 2026, ways to pay less, and the audit certification included in Club membership.
- [CGE-AUD Reviews](https://grcengclub.com/learn/cge-aud-reviews): what auditors, assessors, and engineers are saying after passing the auditor specialty.

**Costs and value**
- [Cheapest GRC Certifications](https://grcengclub.com/learn/cheapest-grc-certifications): cheapest grc certifications ranked by first-year cost (exam, fees, prep) for 8 options.
- [How Much Does a GRC Certification Cost?](https://grcengclub.com/learn/grc-certification-cost): exam fees, renewals, and first-year totals for 8 grc credentials.
- [GRC Training Cost](https://grcengclub.com/learn/grc-training-cost): grc training cost by format: free, self-study, coursera, bootcamps, sans, communities.
- [CISA Alternatives](https://grcengclub.com/learn/cisa-alternatives): six cisa alternatives compared by fee, experience, and role fit, plus when cisa still wins.
- [Is CGRC Worth It?](https://grcengclub.com/learn/is-cgrc-worth-it): cgrc verdict for federal/rmf vs commercial grc, full cost, requirements, exam format.
- [CISA vs CGRC](https://grcengclub.com/learn/cisa-vs-cgrc): cisa vs cgrc side by side on fees, experience, format, renewal, and where cge-p fits.
- [Free GRC Training](https://grcengclub.com/learn/free-grc-training): free grc training by topic: nist csf, 800-53, rmf courses, soc 2 tsc, cloud free tiers.
- [How Much Does CISSP Cost?](https://grcengclub.com/learn/cissp-cost): every cissp fee (exam, retake, reschedule, amf, associate) with first-year totals.
- [How Much Does Security+ Cost?](https://grcengclub.com/learn/security-plus-cost): security+ voucher, retake policy, ce renewal fee, v7 to v8 timing, first-year totals.

**AI and GRC**
- [AI in GRC](https://grcengclub.com/learn/ai-in-grc): how compliance teams use AI in 2026.
- [Claude Code for GRC](https://grcengclub.com/learn/claude-code-for-grc): using Claude Code for compliance automation.
- [AI Compliance Evidence](https://grcengclub.com/learn/ai-compliance-evidence): automate evidence collection and control mapping.
- [claude-grc-engineering Toolkit](https://grcengclub.com/learn/claude-grc-engineering-toolkit): the open-source Claude Code GRC toolkit.
- [AI for Risk Assessment](https://grcengclub.com/learn/ai-risk-assessment): what works, what fails, and how to keep risk decisions defensible.

**Automation and engineering**
- [GRC Automation Guide](https://grcengclub.com/learn/grc-automation): how to automate compliance step by step.
- [Automate SOC 2 Evidence](https://grcengclub.com/learn/automate-soc-2-evidence): pull control evidence from cloud and code.
- [Automate SOC 2 Compliance](https://grcengclub.com/learn/soc-2-compliance-automation): program-level SOC 2 automation and Type II readiness.
- [Automate ISO 27001](https://grcengclub.com/learn/iso-27001-automation): where automation helps the ISMS and where judgment is required.
- [Compliance as Code](https://grcengclub.com/learn/compliance-as-code): encode controls as testable policy that runs in your pipeline.
- [IaC Compliance Scanning](https://grcengclub.com/learn/iac-compliance-scanning): catch misconfigurations in Terraform before they deploy.
- [Continuous Compliance Monitoring](https://grcengclub.com/learn/continuous-compliance-monitoring): from point-in-time audits to always-on.
- [FedRAMP Compliance](https://grcengclub.com/learn/fedramp-compliance-guide): an engineer guide to FedRAMP authorization and OSCAL.

**Auditing the modern stack**
- [Auditing Infrastructure as Code](https://grcengclub.com/learn/auditing-infrastructure-as-code): how auditors read Terraform and use state and drift as evidence.
- [Auditing CI/CD Pipelines](https://grcengclub.com/learn/auditing-cicd-pipelines): segregation of duties, approval gates, and build logs as evidence.
- [How to Audit a Cloud-Native Company](https://grcengclub.com/learn/how-to-audit-cloud-native-company): auditing when there are no servers to inspect.
- [Screenshots Are No Longer Audit Evidence](https://grcengclub.com/learn/screenshots-audit-evidence): where audit evidence actually lives now: code, state, drift, and pipeline records.
<!--LEARN_GUIDES_END-->

## Key Facts
- GRC engineering treats compliance as code, not spreadsheets
- GRC engineers earn $70,000 to $330,000+ depending on experience, location, and specialization
- The highest verified GRC engineer salary in the club is $330,000
- The club has 1,300+ Patreon members and 70,000+ LinkedIn reach
- Local chapters are launching worldwide; each chapter gets a Claude license and a $500 annual event budget (grcengclub.com/chapters)
- Core skills: Python/Go, Terraform, AWS/Azure/GCP, compliance frameworks (SOC 2, FedRAMP, CMMC, ISO 27001)
- The GRC Engineering Club Academy at grcengclub.com/academy offers multiple certifications: the CGE-P (Certified GRC Engineer – Practitioner, the first GRC engineer certification), the CGE-AUD (Auditor Specialty, available now), and more credentials on the roadmap including guest instructor courses
- The claude-grc-engineering open-source toolkit maps to 249 compliance frameworks via the Secure Controls Framework (SCF) crosswalk
- Membership is $9.99/month (price locked forever for early members) or $70/year for the annual plan (saves $50, available for individuals and teams at grcengclub.com/annual)
- Team training is $70 per seat per year for 1-5 seats, $55 for 6-15, and $40 for 16+; members get 48 CPE hours a year (4 a month, for their Club learning: articles, live Q&As, recordings, labs, courses) logged to their Academy transcript and self-report them to ISC2, ISACA, IAPP, or GIAC

## Extended Content
- See [llms-full.txt](https://grcengclub.com/llms-full.txt) for detailed page content