Live Risk Register Weekend ChallengeSeptember 26 and 27, 202610:00 a.m. to 12:30 p.m. ET

Risk Register Weekend Challenge

Build and Defend Your First Interview-Ready Piece of Cybersecurity Work in One Live Weekend

You are interested in non-coding cybersecurity roles and still working out where to start and whether the work fits you.

In one live weekend, you take on the role of a Governance, Risk, and Compliance (GRC) analyst for a realistic fictional company. You build a focused risk register with five scored and ranked risks, a short Risk Memo for leadership, and a Decision Brief explaining your most important decision.

You leave with a work sample you can walk a hiring manager through, and a clearer sense of whether you want this work.

September 26 and 27, 2026 | 10:00 a.m. to 12:30 p.m. ET

Join the Challenge | General $97 | VIP $297

Complete beginners are welcome.

VIP is limited to 10 participants because each VIP receives personal feedback from Dr. Shumba.

The problem

The Experience Loop

People trying to enter GRC get stuck in the same places:

You do not know where to start. Every source of advice points somewhere different, and the amount to learn feels overwhelming.

You are still working out what GRC work actually looks like and whether it would fit you.

You bring years of experience from another field, and you cannot yet see how it connects to GRC.

You keep hearing that employers want experience, and you have not had a chance to get any.

You have a program, a certification, or courses behind you, and still no finished work to show.

You have started applying, and the rejections or the silence make you wonder what is missing.

You have learned a lot, and you still cannot explain it in a way that convinces a hiring manager.

That is the loop: experience seems to require a job, and a job seems to require experience. More studying, on its own, does not break it.

These concerns also appeared in a survey of 53 people who registered for a recent live GRC masterclass. Almost half had not started because they did not know where to begin. When asked what would help most, seven in ten selected a clear step-by-step path, followed by hands-on practice and portfolio work they could show.

So you are left asking: where do I start, what does the work look like, and how do I turn what I have learned into work I can show?

Start by seeing the work clearly.

The work, in plain language

What a GRC Analyst Actually Does

A GRC analyst helps an organization understand what could go wrong, which requirements apply, and what to do about it. The day-to-day work includes:

Reviewing systems, information, and suppliers
Identifying and assessing risks
Comparing practices with laws, standards, and frameworks
Preparing registers, reports, and recommendations
Explaining findings to decision-makers

The work happens in documents, spreadsheets, meetings, and conversations. Government agencies, banks, hospitals, universities, technology companies, insurers, and consulting firms all hire for it.

Certifications help you learn the language. The next step is showing how you apply it.

What employers are listening for

Employers Want to Hear Your Thinking

I have spent more than 20 years preparing people for technology and cybersecurity careers. Candidates become stronger when they can point to completed work and explain the decisions behind it: why one risk ranked above another, why they recommended one response instead of another, and who should own the risk.

A certification can show what you studied. A realistic work sample gives an interviewer something concrete to examine and discuss.

It does not replace professional experience. It can show how you analyze information, make decisions, apply what you have learned, and explain your reasoning.

The next step is not always another certification. It may be applying what you already know to a realistic problem and learning to defend your decisions.

That is practical evidence you can begin building before receiving your first GRC job.

One realistic assignment

Why Begin With a Risk Register?

A risk register is a common GRC work product. It documents risks, scores them, assigns owners, and records what should be done about each one.

Building one lets you practice the core of the job:

Understanding a business and what needs protection
Connecting security events to business harm
Scoring, ranking, and recommending
Explaining the reasoning behind each decision

A blank template is not enough. You need a company, evidence, decisions to make, and practice explaining them.

One method for the whole weekend

The GRC Build-and-Defend Method™

Every step follows the same three-part process:

Learn It

Learn the GRC concepts, understand the TechFlow situation, and know what the assignment requires.

Build and Defend It

Use the TechFlow evidence and workbook to create your portfolio piece. Explain your decisions, receive feedback, and prepare to answer questions about your work.

Use It to Get Hired

Turn the completed assignment into one or two resume bullets and an interview story.

The short version is:

Learn it. Build and defend it. Use it to get hired.

Your fictional company assignment

Meet TechFlow and Take the Assignment

TechFlow Solutions is a fictional technology company. Its leaders have approved an information security risk assessment, and you are the new GRC analyst assigned to it.

You review TechFlow's services, systems, information, people, and suppliers, then decide which risks matter most and what the company should do next.

The company is fictional. The decisions are realistic, and there is not always one perfect answer.

Learn the work and begin building

What You Will Do on Saturday

Saturday begins the first two parts of the method.

Step 1: Learn It

Meet the Profession:

what GRC analysts do and who hires them

Understand the Assignment:

what you will build and how the documents connect

Set Up Your Portfolio:

a folder structure that keeps your work organized

Learn Five Risk Terms:

risk, likelihood, impact, risk owner, and risk response

Get to Know TechFlow:

what matters most and what could be harmed

Step 2: Build and Defend It. Begin Your Risk Case

Create your Company Snapshot and Risk Scoring Guide, then write your first risk entries.

You leave Saturday with the foundation of your risk case in place.

Complete, explain, and use the work

What You Will Do on Sunday

Sunday completes Build and Defend It and moves into Use It to Get Hired.

Step 2: Build and Defend It. Complete Your Risk Case

Finish all five entries, rank the risks, and prepare a short Risk Memo for leadership. Write your Decision Brief, practice a two-minute explanation, and answer one difficult question. Every decision is yours, with coaching from Dr. Shumba when you need it. VIP participants receive an additional one-hour session with Dr. Shumba after the Challenge to ask questions.

Step 3: Use It to Get Hired

Create one or two resume bullets and an interview story from your completed work.

Join the Challenge | General $97 | VIP $297

What you will leave with

One Complete TechFlow Risk Case

By the end of the weekend, you will have:

A TechFlow Company Snapshot

A Risk Scoring Guide

A focused risk register with five scored and ranked risks

A short Risk Memo for leadership

A one-page Decision Brief explaining your top decision

A practiced two-minute explanation of your work

One or two resume bullets and an interview story

Your risk register will be complete for the five risks assessed during the Challenge. Like a risk register used by an organization, it can be updated as the company and its risks change.

These are simulated work samples based on a fictional company. When presenting them to an employer, identify them as fictional case-study work.

The document is only the beginning

Practice the Questions an Employer May Ask

Why did you rank this risk first?
What evidence supported your score?
Why reduce this risk instead of accepting it?
How did the business needs influence your decision?
What new information could change your assessment?

During the Challenge, you practice answering these using the work you completed.

The weekend at a glance

How the Weekend Works

When:

Saturday and Sunday, September 26 and 27, 2026

Time:

10:00 a.m. to 12:30 p.m. ET each day

Length:

Five live hours in total

Where:

Live online from anywhere

Who it is for:

Career changers, recent graduates, certificate holders, and professionals new to GRC or exploring non-coding cybersecurity roles

Experience:

Beginner friendly. Basic computer, document, and spreadsheet skills are enough.

Challenge begins: Saturday, September 26, 2026, at 10:00 a.m. ET

00Days

00Hours

00Minutes

00Seconds

Choose General or VIP admission

Choose Your Ticket

In the survey, people named what would help most. The weekend contains each answer: a step-by-step method, practical work on a realistic company case, a portfolio piece you can show, interview and resume material, and a group working alongside you.

Both tickets include the two live sessions, the TechFlow company case, and all Challenge templates. Choose VIP if you also want replay access and personal feedback from Dr. Shumba.

Your full ticket price can be credited toward the $997 founding price of the GRC Portfolio Studio when you enroll by Friday, October 9, 2026.

Live admission

General Admission | $97

General Admission includes:

Both live Challenge sessions
Time to complete the work during the sessions
The TechFlow Solutions company case
All Challenge templates

Join General Admission | $97

Additional access and feedback

VIP Admission | $297

VIP Admission includes everything in General Admission, plus additional access and feedback after the Challenge.

One additional one-hour VIP session with Dr. Shumba after the Challenge to ask questions
Access to the private Challenge discussion group
Seven-day replay access
One review of your completed risk case
Feedback on one or two resume bullets

Choose VIP if you want more time to ask questions, access to the recordings, and personal feedback on your completed work.

Join VIP Admission | $297

Only 10 VIP seats are available.

Your decisions must remain yours

Where AI Can Help

You may use AI to organize ideas, improve wording, check structure, or begin a draft.

The final thinking must be yours. You choose the scores, make the recommendation, and explain your reasoning. Submit only work you understand and can defend.

Use only the fictional TechFlow materials. Do not enter private information from a real employer, customer, supplier, or client into an AI tool.

Continue if you want a complete portfolio

Continue From One Risk Case to a Complete GRC Portfolio

The Challenge gives you one TechFlow risk case. In the GRC Portfolio Studio, you continue with the same company and the same method through additional assignments: governance and program approval, scope and assets, gap assessment, risk identification, risk evaluation, risk treatment and control selection, control design and policies, implementation and access reviews, third-party risk, audit readiness and customer assurance, and control assessment with leadership review and remediation.

Your full Challenge ticket price is credited toward the $997 founding price when you enroll by Friday, October 9, 2026.

General participants will have $900 remaining.
VIP participants will have $700 remaining.

Joining the Studio is optional. You can participate fully in the Challenge without enrolling.

See the Complete Studio Path

Live guidance from Dr. Rose Shumba

Meet Your Coach

Dr. Rose Shumba has more than 20 years of experience helping students and professionals prepare for technology and cybersecurity careers.

She is a cybersecurity educator, computing professor, and former director of a Center of Academic Excellence in Cyber Defense designated by the National Security Agency and the Department of Homeland Security.

Dr. Shumba holds the PECB ISO/IEC 27001 Foundation credential. She created the TechFlow Solutions case and teaches both Challenge sessions live.

Learn More About Dr. Shumba

Questions

Frequently Asked Questions

What will I complete during the Challenge?

A TechFlow Company Snapshot, Risk Scoring Guide, focused risk register with five scored and ranked risks, Risk Memo, Decision Brief, two-minute explanation, resume bullets, and an interview story.

What if I miss a live session?

General Admission is live only. VIP participants receive seven-day replay access. Plan to attend live whenever possible so you can ask questions while you work.

Do I need GRC or cybersecurity experience?

No. The Challenge is designed for beginners. You learn the essential risk concepts as you complete the assignment.

Do I need a technical background?

No. Basic computer, document, and spreadsheet skills are enough.

What does VIP add?

Everything in General Admission, plus one additional one-hour VIP session with Dr. Shumba after the Challenge, access to the private Challenge discussion group, seven-day replay access, one review of your completed risk case, and feedback on one or two resume bullets.

Can I use AI during the Challenge?

Yes, to organize ideas and improve your writing. You must choose the final scores and recommendations and be able to explain your work.

Do I decide what TechFlow will do about the risks?

You make recommendations. TechFlow's leaders would make the final decision to accept, reduce, transfer, or avoid each risk. Knowing that difference is part of GRC work.

How is this different from downloading a template?

A template gives you an empty document. The Challenge gives you a realistic company, a specific assignment, evidence to evaluate, guided working time, and practice explaining your decisions.

Is fictional case-study work the same as professional experience?

No. It does not replace employment. It gives you practice completing a realistic assignment and a simulated work sample that shows how you apply concepts and explain decisions. Always identify it as fictional case-study work.

Does the Challenge provide a certification?

No. It is a practical educational event.

Does the Challenge guarantee a job?

No. It helps you build a work sample and practice explaining it. Employers make all hiring decisions.

What is the refund policy?

You may cancel and request a refund until 10:00 a.m. ET on Thursday, September 24, 2026. After that time and once the Challenge begins, all sales are final.

One live weekend

Build One Risk Case You Can Explain and Defend

Spend one live weekend experiencing what GRC work involves and completing a realistic company assignment.

Leave with a risk case you can walk a hiring manager through: what you found, what you considered, what you recommended, and why.