The pathway
How you actually get there, here
How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.
- 1
Senior Information Governance Analyst (Internal Promotion)
3-5 years as a Senior AnalystSkills to master
- Leading complex governance projects, mentoring junior team members, drafting and implementing policies, and managing stakeholder relationships.
You're ready to move on when
- Successfully led 2-3 significant cross-functional governance initiatives from start to finish.
- Consistently provided high-quality technical guidance and mentorship to junior team members.
- Demonstrated ability to influence business units to adopt new governance practices.
- Proactively identified and proposed solutions for emerging information risks.
- 2
eDiscovery or Records Management Specialist (External Hire)
8-12 years in a specialist roleSkills to master
- Deep expertise in eDiscovery processes (EDRM), legal hold management, or comprehensive records retention scheduling, often gained in a legal firm or large corporation.
You're ready to move on when
- Managed end-to-end eDiscovery for multiple complex legal matters.
- Designed and implemented defensible records retention programmes.
- Strong technical skills with eDiscovery or records management platforms (e.g., Relativity, OpenText).
- Experience navigating legal and regulatory requirements for information handling.
- 3
IT Compliance or Security Architect (External Hire)
8-12 years in IT compliance or securitySkills to master
- Understanding of IT systems architecture, data security controls, and how technology supports compliance. You'd bring a strong technical lens to governance.
You're ready to move on when
- Designed and implemented security controls for sensitive data in enterprise systems.
- Experience with GRC platforms from an IT perspective (e.g., ServiceNow GRC).
- Deep understanding of data flows and storage within complex IT environments.
- Demonstrated ability to translate technical risks into business impact.