Common CRISC Job Titles [updated 2021]

The Certified in Risk and Information Systems Control (CRISC) certification is a vendor-neutral credential provided by the Information Systems Audit and Control Association (ISACA). As the only certificate focused on enterprise IT risk management (ITRM), the "CRISC validates your experience in building a well-defined, agile risk-management program, based on best practices to identify, analyze, evaluate, assess, prioritize and respond to risks." ISACA's exam certifies knowledge and skills in organizational governance, continuous risk monitoring and reporting, information security and data privacy considerations.

Earn your CRISC certification, guaranteed!

Enroll in a CRISC Boot Camp and earn one of the highest paying industry certifications — guaranteed.

Get Pricing

What kind of jobs can I get with the CRISC certification?

ISACA certifications open doors to many career opportunities that address key controls and risks while optimizing enterprise resources and ensuring a proper ROI.  

According to ISACA, the experience-based CRISC certification is ideal for mid-career IT/IS audit, risk and security professionals and is often used to recruit and assess the value of candidates for the following occupational roles:

• Security directors, managers and consultants
• Compliance, risk, privacy directors and managers
• IT audit directors, managers and consultants
• Compliance, risk and control staff

What are the most common CRISC job titles and descriptions?

The CRISC credential is specifically designed for control and risk professionals, including IT risk management professionals, control professionals, project managers, business analysts and compliance professionals.

IT risk management professionals can anticipate risks and give the organization a better understanding of their potential impact and consequences and proactively offer solutions to help manage risk and implement appropriate controls before issues occur. Their role makes them highly valuable to an enterprise. They can ensure systems' resilience to threats, attacks and breaches while still allowing a company to meet its business goals effectively and comply with industry regulations.

Control professionals are well-versed in the design, implementation and maintenance of controls to mitigate IT risks for an enterprise. Controls (some security safeguard or countermeasure) are deployed to protect an information asset or system's confidentiality, integrity and availability; they are also often necessary to address regulatory and customers' expectations.

Project managers: they understand risks and establish information security related to the business resources, personal data etc. CRISC-certified project managers can mediate between the need to keep a project respecting its scope, cost and timeline while still controlling resources, risks and quality.

Business analysts: identify potential business risks and offer appropriate controls to eliminate or mitigate those risks. They monitor computer and information networks to look for security issues both internally and externally to ensure business operations continue to run efficiently.

Compliance professionals review laws and regulations for complete risk assessments and ensure that the enterprise's security policy ensures compliance. Professionals will have extensive experience with many frameworks (e.g., GDPR, CCPA, NIST, HIPAA etc.).

So, what do CRISC-certified professionals hold the most frequent job titles?

• More than 2,600 are CEO, CAE, CISO, CSO, CIO, CTO and CFO
• More than 4,100 are IT audit directors, directors, managers or consultants
• More than 3,400 are security director, chief compliance, risk or privacy officer
• More than 2,700 are compliance, risk or privacy directors or managers
• More than 1,300 are IT auditors or senior auditors
• More than 2,100 are security, IT, IT-IS compliance, risk, or control staff

As seen, CRISC-certified professionals are asked to assess existing business systems/processes and identify key control points and risks through data collection/reporting of any anomalies or events. They warrant formal incident response procedures in a fast, effective and consistent manner and make timely recommendations that will safeguard the company's information assets. This is why this credential also allows access to IT leadership roles such as CIO and CISO.

What kind of salary bump can I expect after getting certified?

The recent quarterly IT Skills and Certifications Pay Index (ITSCPI) from Foote Partners continues to rank CRISC among the most sought-after and highest-paying IT certifications. Per the Global Knowledge 2020 IT Skills and Salary Report, the average salary is $141,172 (North America) and $113,995 (worldwide). This shows how employers are investing in professionals with specific skill sets and that demonstrate the knowledge and expertise to identify and evaluate IT risk and devise plans and strategies to mitigate them while helping the organization achieve its business goals.

As the Foote Partners' report indicates, "the CRISC certification is earning some recipients premium pay amounting to the equivalent of between 8 and 13% percent of base salary, gaining 10% in market value in the last half of 2020." What's more, "risk management skills gained nearly 7% in market value in 2020 according to ITSCPI data." This shows that CRISCs are earning especially high wages after getting certified, as there is a growing demand for IT governance, risk management and cybersecurity skills expertise.

Earn your CRISC certification, guaranteed!

Enroll in a CRISC Boot Camp and earn one of the highest paying industry certifications — guaranteed.

Get Pricing

CRISC certification training

Given these professionals' increasing role within companies, employers will look for those who can demonstrate their commitment to the field. Certification is a great way to do so, and 30,000-plus professionals have earned the CRISC designation since inception.

A CRISC certification proves your expertise in these work-related domains:

• Domain 1: Governance (26%)
• Domain 2: IT Risk Assessment (20%)
• Domain 3: Risk Response and Reporting (32%)
• Domain 4: Information Technology and Security (22%)

The latest update to the CRISC exam content outline (August 1, 2021) is based on changes in the work practices of IT professionals and the new risks and challenges to be solved in today's fast-paced business and technology-driven world. The refreshed exam objectives focus more on pivotal current topics, including business continuity, resiliency, corporate governance and data privacy and protection.

So, are you ready to make a name for yourself and stand out from other employees or job applicants? To earn the CRISC certification, it is important to prepare for the exam thoroughly. Using official material (e.g., books, guidelines and other official publications) would be beneficial together with courses from online reputable training centers. These can help candidates understand each CRISC Job Practices Areas covered in the exam and increase their chances of passing it on the first attempt.

Sources

• CRISC, ISACA
• Get CRISC Certified, ISACA
• CRISC Exam Planning Guide, ISACA
• CRISC Job Practice Updates 2021, ISACA
• Infographic: ISACA Certifications Open Doors, ISACA
• 2021 IT Skills & Certifications Pay Index, Foote Partners
• How the Pandemic Has Boosted Some Tech Skills and Certifications, ISACA
• ISACA's CRISC Exam Updated to Reflect Latest Work Practices and Knowledge Used by Risk Practitioners, ISACA