Intake open · 3-month track

GRC Internship (Governance, Risk and Compliance)

This GRC internship covers the side of security that audits check: map controls to ISO 27001, run a risk assessment, and write policies people can actually follow.

Apply now See the 12-week plan
3Months
HybridFormat
Lab-basedTraining
PKR 5,000Total fee
Risk register. Lab company
# every risk has an owner
risk = “Shared admin password”
owner = assign(risk)
Controls mapped37
week 1week 12
Ends as
An audit-ready pack
Mentor review
Weekly, 1-to-1
  • ISO 27001
  • Risk register
  • Policies
  • Audit prep
  • Control mapping
  • Evidence
  • ISO 27001
  • Risk register
  • Policies
  • Audit prep
  • Control mapping
  • Evidence
  • ISO 27001
  • Risk register
  • Policies
  • Audit prep
  • Control mapping
  • Evidence
  • ISO 27001
  • Risk register
  • Policies
  • Audit prep
  • Control mapping
  • Evidence
  • ISO 27001
  • Risk register
  • Policies
  • Audit prep
  • Control mapping
  • Evidence
  • ISO 27001
  • Risk register
  • Policies
  • Audit prep
  • Control mapping
  • Evidence
  • ISO 27001
  • Risk register
  • Policies
  • Audit prep
  • Control mapping
  • Evidence
  • ISO 27001
  • Risk register
  • Policies
  • Audit prep
  • Control mapping
  • Evidence
12Weeks
25 hrsPer week
4Graded deliverables
1Audit-ready pack
The work

Security has to be written down before it can be checked

Auditors, clients and regulators ask the same questions: what are your risks, which controls cover them, and where is the evidence. Answering those clearly is what the twelve weeks train.

  • 1You get a lab company with real-looking gaps
  • 2You map its controls against ISO 27001
  • 3Your mentor reviews your risk ratings and policies
  • 4You assemble the evidence an audit would ask for

No technical background is required beyond basic IT. Security concepts are covered in weeks 1 to 3.

risk-register.csv
# Week 6: risks, owners and controls in one place
id, risk,                     rating, control
R-01, shared admin password,    high,   access control
R-02, no backup testing,        medium, backup policy
R-03, laptops not encrypted,    high,   encryption
R-04, no supplier review,       low,    supplier policy
# each row: owner, due date, evidence link
Skills

What you will be able to do after this GRC internship

01

ISO 27001 basics

Understanding the standard and its controls.

02

Control mapping

Mapping what a company does to the controls it needs.

03

Risk assessment

Identifying, rating and prioritising risks.

04

Risk register

Keeping risks, owners and actions in one clear place.

05

Policy writing

Writing policies that are short, clear and followed.

06

Evidence collection

Gathering the proof an auditor will ask for.

07

Audit preparation

Getting a company ready for an internal or external audit.

08

Reporting to management

Explaining risk in business terms.

Curriculum

The 12-week GRC internship plan

Four phases. Each one ends in a deliverable that is reviewed and graded before the next opens.

Foundations

What GRC is and why it matters.

  • Governance, risk and compliance explained
  • Security basics for non-engineers
  • Overview of ISO 27001
  • How audits work
Deliverable

A one-page summary of the lab company’s security posture.

The capstone

Every intern prepares a company for an audit

You take a lab company from scattered practices to an organised, audit-ready set of risks, controls, policies and evidence.

  • A risk register with owners and treatments
  • A control mapping against ISO 27001
  • Policies and evidence an audit can check
Start your application
Ezitech seminar session with students at a university auditorium
Ezitech stall at a university open house and job fair
Ezitech receiving a shield at a university project presentation
Ezitech team and interns group photo outside the institute
Ezitech speaker presenting at a talent award ceremony
Ezitech mentors reviewing intern project documents
Ezitech team discussing an intern project brief in the office
01 / 07
Duration12 weeks
Commitment25 hrs / week
FormatOnsite + remote
LocationRawalpindi, PK
LevelJunior / fresher
ReviewsWeekly, 1-to-1
The Ezitech model

What the GRC internship includes

Three things that make this different from a course you watch on a screen.

Live client briefs

You work on real Ezitech projects with real deadlines and real revision rounds, not recycled practice exercises.

A mentor, not a playlist

Weekly reviews with someone who does this work for a living, plus a team of interns around you to build with.

Portfolio and experience letter

You finish with shipped work you are allowed to show and a letter that says exactly what you delivered.

And you leave with

  • Verified certificate

    Issued by Ezitech Institute and verifiable by employers.

  • Experience letter

    On company letterhead, stating exactly what you delivered.

  • An audit-ready pack

    Risk register, control mapping, policies and evidence for a lab company.

  • Interview preparation

    CV rewrite, portfolio case study and a technical mock interview.

  • A route into the team

    Top performers are considered first for paid junior roles.

  • Confidence in review

    Twelve weeks of defending your own work to a senior practitioner.

Built for you if

  • You are an undergraduate or fresh graduate in IT, CS, cyber security or business
  • You write clearly and enjoy organising information
  • You want a security career that is not purely technical
  • You need a substantial final-year project

Not a fit if

  • You want a certificate without doing the work
  • You cannot give 25 hours a week for 12 weeks
  • You only want hands-on technical work
  • You want to skip review and work alone
FAQ

GRC internship: questions people ask

Everything applicants email us about, answered before you apply.

Still not sure?

Talk to the admissions team before you commit twelve weeks.

Contact Ezitech

What does a GRC intern do?
You help a company understand its security risks, map what it does to a standard such as ISO 27001, write policies and collect the evidence auditors ask for. It is security work done mostly through documents, meetings and reviews.

Do I need a technical background?
Basic IT knowledge is enough. Security concepts are covered in weeks 1 to 3. Clear writing matters more than coding in this track.

Is it remote or onsite?
Hybrid. Onsite days run at the Ezitech office in Rawalpindi for reviews and labs; the rest of the week is remote. Candidates outside Rawalpindi and Islamabad can complete it fully remotely if they attend the weekly review calls.

Is there a fee?
Yes, a one-time fee of PKR 5,000 for three months. There is no stipend. The refund rules are on the internship fee and refund policy page.

Can final-year students apply?
Yes. The capstone can be scoped as a final-year project. Agree the scope with your mentor in week one if your university has a set submission format.

How do I apply?
Register on the Ezitech intern portal, choose the Cyber Security track, and complete the three-step form with your education details and CV. Shortlisted candidates get a short screening call before the intake starts.
Other tracks

Not sure GRC is the one?

Every cyber security internship runs three months, hybrid, with the same mentor model. Or take the six-month All-in-One Cyber Security flagship. Still choosing a field? Read which cyber security roles hire in Pakistan, or browse cyber security FYP ideas.

Blue team

SOC Analyst

Triage alerts in a SIEM and write reports a team acts on.

View track
Cloud

Cloud Security

Lock down cloud accounts, permissions and logging.

View track
Incident response

Digital Forensics

Collect evidence and rebuild what happened in an incident.

View track
DevSecOps

Application Security

Review code and add security checks to the CI pipeline.

View track
Applications open

Learn the side of security that audits check

Three months, one shipped piece of real work, a mentor who reviews you every week. Registration takes five minutes.

Apply for this internship Talk to us first
Ezitech Institute · Rawalpindi, Pakistan · info@ezitech.org · +92 345 5555396
Chat on WhatsApp