how to be a grc analyst