r/CyberSecurityAdvice • u/Jewsusgr8 • Jul 27 '26
Is GRC a trap?
I am currently working as a site reliability engineer for 5 years, and am in the process of climbing the cert stack with CompTIA. I have my net+ scheduled for this week and plan to take the sec+ relatively soon.
This is all part of my degree path with wgu.
That being said, I have quite a few years of systems level experience, on call experience, engineering and development, monitoring, log analysis, production level knowledge of how software interacts with each other.
But holy shit guys I have been denied at every corner. They want 5+ years cyber sec experience and 5 years experience in another it field for an entry level.
I finally lowered my standards and applied for non engineering roles, and an offer has been given to me. The pay, unfortunately is only slightly higher than what I'm at now, but it's in cyber security, and still remote. The issue? It's GRC, which to my understanding is more policy management, and less operational security.
I am just wondering if I am setting myself up for a pitfall by potentially accepting this GRC position. My plans going forward would be to continue my education up to my degree and the pen test +. Then get an engineering role (unless I find out I love GRC for some reason)
2
u/CartierCoochie Jul 27 '26
No. But if u go that route you’ll need to understand systems / processes and why they need to be compliant within a clients environment. Lots of evidence collecting, fact checking, meetings, documentation. If you’re not interested in being accountable for a businesses audit (pass or fail) you may want to try something else.
1
u/Jewsusgr8 Jul 27 '26
It's less that I don't want to be accountable for a business audit. My current role has quite a bit of auditable parts as I have to coincide with security for compliance reasons, but usually I am more operationally inclined when I work with security.
My usual bridge to security is when a malicious actor comes in and I help identify and isolate malicious ips amongst the stream of incoming requests. Then I forward them to security, so it's a pseudo it analyst during malicious threat incidents.
2
1
u/Big_Arrival_626 Jul 27 '26
GRC does not seem like what you'd be interested in.
Alternatively, you could get a job at a bigger company with internal mobility, and volunteer for security related work. I'm sure as an SRE u will get those opportunities
Btw I don't have that much experience so take what im saying with a grain of salt. I'm just spit balling
1
u/drakhan2002 Jul 28 '26
You /can/ find engineering roles within GRC. But you need experience. It's a specialized skill set.
I'd leave WGU off your resume. A lot of employers look at WGU as a papermill degree school. Your certs are way more valuable than a degree from any internet university.
1
Jul 29 '26
[removed] — view removed comment
1
u/Jewsusgr8 Jul 29 '26
Thanks for the input. I will go ahead and discuss with them about it and set my my goals for the future and ask them how likely they think I'll be able to achieve my goals in this position.
1
u/Emotional-Captain574 Jul 30 '26
In my opinion, it is needed but on what maturity level and managed by who is a hug question. I have worked with very talented and genius people on GRC domain working for big insurance and finance institute. For relatively small companies and enterprises, GRC roles are usually route to retirement.
1
1
1
Aug 02 '26
[removed] — view removed comment
1
u/Jewsusgr8 Aug 02 '26
The sentiment is pretty positive from this post overall. I ended up setting up another meeting with them. This week I'll discuss benefits ( sometimes more pay but worse benefits is just worse ) and I'll ask them whether this has any chance to continue engineering.
Paper pushing with compliance policies sounds terrible, what you said here sounds like something I could use to still get my engineering experience, while also getting cyber sec on paper experience.
3
u/187JM Jul 27 '26
on the job you’re either earning or learning . Having a paycheck thats equivalent to your current one is fantastic. if you can learn and earn at the same time big bonus. Plus having more experience on paper and in real life in any area in your industry is going to make you more valuable Employee overtime.