Learn It
Learn the GRC concepts, understand the TechFlow situation, and know what the assignment requires.
Founding Price: $997 for the full six-month program | Enrollment closes Friday, October 9, 2026
GRC Portfolio Studio
Build an Interview-Ready GRC Portfolio You Can Explain and Defend in Six Months
You want a non-coding cybersecurity role, but you are still trying to understand what the work involves, where to begin, and what you could show an employer.
In the Studio, you take on the role of the newly hired GRC analyst at TechFlow Solutions, a realistic fictional company with no Governance, Risk, and Compliance program yet. Across 11 steps, you help build one, producing 11 finished pieces of work with live coaching from Dr. Rose Shumba.
Join the GRC Portfolio Studio | $997
Beginners welcome. Founding enrollment closes Friday, October 9, 2026.
The problem
Where People Get Stuck on the Way Into GRC
After more than 20 years preparing students and professionals for technology and cybersecurity careers, I continue to hear the same concerns:
- “I do not know where to start.”
- “I have experience from another field, but I do not know how it connects.”
- “I have completed training, but I have no finished work to show.”
- “I can complete a template, but I cannot explain my decisions.”
- “I keep applying and getting rejected or ignored.”
- “I freeze when an interviewer asks me to explain what I did.”
A survey of 53 people who registered for a recent live GRC masterclass said the same. Almost half had not started because they did not know where to begin. Seven in ten wanted a clear step-by-step path.
Building a portfolio alone means guessing what to build, in what order, and what good work looks like. Guessing is why the certificates pile up while the portfolio stays empty.
How people actually get in
You Learn GRC by Doing GRC for One Company
Many people try to enter this field through memorization. Frameworks first, another certificate first. The knowledge arrives. The work samples do not.
Reverse it. Take one company, build its program in the order the company needs it, and let each concept arrive when you need it to make a decision. A concept you use is a concept you keep.
In GRC there is often more than one reasonable answer. The skill is making a supportable decision and explaining why it fits the company. AI can draft a policy; the judgment behind it is yours, and an interviewer will test it.
The next step is not always another certification. It may be applying what you already know to one company, making decisions in context, and practicing how you explain them.
One method, applied 11 times
The GRC Build-and-Defend Method™
Every step follows the same three-part process:
Build and Defend It
Use the TechFlow evidence and workbook to create your portfolio piece. Explain your decisions, receive feedback, and prepare to answer questions about your work.
Use It to Get Hired
Turn the completed assignment into one or two resume bullets and an interview story.
The short version is:
Learn it. Build and defend it. Use it to get hired.
One company, 11 steps
Step Into the Role of TechFlow's GRC Analyst
TechFlow needs to establish its security program, understand its risks, review suppliers, choose controls, write policies, collect evidence, answer customer questions, and report to leadership. You are the analyst assigned to all of it.
Because you follow one company from beginning to end, each piece connects to the one before it. Your portfolio tells a single professional story instead of showing separate exercises.
That is why it is called a Studio. A studio is a working room: you come in, you build, and you leave with finished pieces.
By the end you have more than knowledge. You have 11 connected examples of GRC work that show how you think, what you can build, and how you communicate your recommendations.
11 steps, 11 pieces
Your 11-Step Path and the Work You Will Produce
Each step builds on the work completed before it. By the end of the Studio, you will have 11 connected portfolio pieces based on the TechFlow company case.
Step 01TechFlow Information Security Program Charter
Establish the security program’s authority, leadership roles, responsibilities, requirements, and escalation process.
Step 02TechFlow Security Program Scope and Asset Profile
Define what the security program covers and identify the systems, information, people, and suppliers that matter most.
Step 03TechFlow Current-State Gap Assessment
Compare TechFlow’s current practices with applicable expectations and prioritize the most important gaps.
Step 04TechFlow Information Security Risk Identification Package
Set the rules for assessing risk and identify the information security risks that could affect TechFlow’s operations and objectives.
Step 05TechFlow Evaluated and Prioritized Information Security Risk Register
Analyze and score the identified risks, compare them with TechFlow’s risk criteria, and rank them for action.
Step 06TechFlow Risk Treatment and Control Selection Package
Decide how each risk should be treated, select appropriate controls, and document why the controls apply.
Step 07TechFlow Control Design and Policy Package
Design how the selected controls will work and prepare the policies and procedures needed to support them.
Step 08TechFlow Control Implementation and Access Review Package
Plan how the controls will be implemented, conduct a simulated access review, address identified issues, and organize recurring security activities.
Step 09TechFlow Third-Party Risk Assessment and Supplier Review Package
Assess two suppliers, identify their security gaps, and recommend whether TechFlow should accept the risks, require corrective action, or reconsider the supplier relationship.
Step 10TechFlow Audit Readiness and Customer Assurance Package
Organize control evidence, identify audit-readiness gaps, and prepare accurate responses to customer security questions.
Step 11TechFlow Internal Assessment, Management Review, and Remediation Package
Assess whether the controls are working, report the findings, present the results to leadership, and track corrective actions.
Each step includes supporting workbooks and a numbered Decision Brief.
These are simulated work samples from a fictional company. Label them as fictional case-study work when you show them to an employer.
After six months
What You Will Have After Six Months
You will also carry the fluency that comes from doing the work: reading a company and spotting what matters, connecting risks to requirements, controls, and evidence, deciding with incomplete information, and explaining any of it in plain business language.
The portfolio is what you show. The fluency is what you carry.
- 11 connected portfolio pieces from one company case
- 11 Decision Briefs showing how you think
- Resume and LinkedIn language from work you completed yourself
- Interview stories drawn from your own decisions
- A plan for finding and applying for suitable roles
Everything supports one goal
What Is Included
Six months of access to the 11-step video guidance and TechFlow case materials
Templates, workbooks, checklists, decision guides, and audit-readiness tools
12 live group coaching calls with Dr. Shumba, two each month
You may submit one portfolio piece at least two days before a coaching call to be considered for focused feedback
The private Studio community for six months, so you are not working alone
Recordings of the coaching calls
Resume bullets and an interview story at every step
A live Job Search Support Workshop: resume, LinkedIn language, and an application plan
Four distinctions
What Makes the Studio Different
One company from start to finish.
Your portfolio tells one professional story.
You practice explaining your choices.
Decision Briefs and coaching calls cover what you did, why, and what would change your mind.
Your career materials come from your own work.
Your examples already exist when the interview comes.
Work that draws on NIST guidance and reflects common GRC responsibilities.
A Path Toward the ISO/IEC 27001 Foundation Exam
Your TechFlow work runs on the core ideas the Foundation exam covers: scope, risk, controls, policies, evidence, and audit. If you choose to sit for and pass the exam afterward, you can show an employer both completed work and a recognized credential. The exam is offered separately by certification bodies, with its own requirements and fee.
Recognition You Can Earn
Complete all 11 steps, submit your final portfolio, participate professionally, and meet the payment requirements, and you may earn the Studio digital badge for LinkedIn and be considered for a signed reference letter from Dr. Shumba. Both are earned through completed work.
Is the Studio right for you
Is the Studio Right for You?
It fits if you want a non-coding cybersecurity role, need professional work samples rather than more theory, and can set aside regular time over six months. Members come from teaching, healthcare, finance, project management, compliance, auditing, IT, and other fields.
The Studio asks you to do the work, make the decisions, and explain them. That is where the value is.
If you attended the Weekend Challenge
How the Weekend Challenge Connects
The Risk Register Weekend Challenge gives you one TechFlow risk case, covering the ground of Steps 04 and 05, which are separate steps here.
The Challenge takes place Saturday and Sunday, September 26 and 27, 2026, running 10:00 a.m. to 12:30 p.m. ET each day.
After you complete your own register in Step 05, you receive a 15-entry reference register with notes on the scores, rankings, and recommendations. It arrives after your work, as a comparison rather than an answer key.
Your full Challenge ticket price counts toward the $997 price when you enroll by Friday, October 9, 2026. General participants have $900 remaining; VIP participants have $700 remaining.
Live guidance from Dr. Rose Shumba
Meet Your Coach
Dr. Rose Shumba is a cybersecurity educator and computing professor with more than 20 years of experience preparing people for technology and cybersecurity careers. She is a former director of a Center of Academic Excellence in Cyber Defense, designated by the National Security Agency and the Department of Homeland Security, and holds the PECB ISO/IEC 27001 Foundation credential.
She designed the 11 steps, created the TechFlow case, and leads every coaching call.
Learn More About Dr. ShumbaBuild with direct guidance from the program's creator.
Your investment
Founding Price: $997
The Studio replaces guessing with 11 defined steps, coaching while you build, and finished pieces you can explain and defend.
The founding price is $997 paid in full for six months of access. This is equivalent to approximately $166 per month. Founding enrollment closes Friday, October 9, 2026.
Join the GRC Portfolio Studio | $997Questions
Frequently Asked Questions
Can I join if I am completely new to cybersecurity?
Yes. The guidance, case materials, templates, and coaching introduce the ideas you need at each step.
Is the Studio self-paced?
The video guidance and the 11 steps are yours to complete on your own schedule during six months of access. Coaching calls and the Job Search Support Workshop are live, and call recordings go into the community.
Will Dr. Shumba review every portfolio piece?
No. You may submit one piece at least two days before a coaching call to be considered for focused feedback, and you learn from the corrections shared with the whole group.
What is a Decision Brief?
A one-page explanation of your thinking: what you found, what you considered, what you recommended, and what new information could change it.
Are the pieces based on a real company?
TechFlow is a realistic fictional company, which keeps real employer and client information out of your work. Label it as a fictional case study when sharing it.
Can I take the ISO/IEC 27001 Foundation exam after the Studio?
Yes. The Studio gives you practical experience behind the concepts the exam covers. Registration and fees are handled by the certification bodies.
Does the Studio provide a certification or guarantee a job?
No to both. It is an educational and coaching program. It helps you build work samples, explain your decisions, and prepare for a job search. Employers make all hiring decisions.
What happens when my six months end?
Access to the guidance, community, calls, and recordings ends. Download your completed portfolio before then. The TechFlow materials, templates, and recordings may not be shared or redistributed.
How does the Challenge ticket credit work?
Your full ticket price is credited toward the $997 price when you enroll by Friday, October 9, 2026. General participants have $900 remaining; VIP participants have $700 remaining.
One company, 11 pieces, six months
Build Work That Shows How You Think
Step into the role of a GRC analyst. Help a realistic fictional company build its GRC program from the ground up. Leave with the work samples, the fluency, and the interview stories to speak about your abilities with confidence.
Founding Price: $997 | Enrollment closes Friday, October 9, 2026
Join the GRC Portfolio Studio | $997