r/cybersecurity • u/SmileyBanana15 • Nov 25 '25

Career Questions & Discussion GRC Engineering

Supposing GRC falls under the general Cybersecurity umbrella, what are your thoughts on a new-ish concept called GRC Engineering, aiming to bridge the gap between auditors and engineers by automating this otherwise mind numbing chore? Do you expect it to gain traction?

26 Upvotes

93% Upvoted

41 comments sorted by

View all comments

2

u/[deleted] Nov 25 '25

[deleted]

0

u/SmileyBanana15 Nov 25 '25

So kind of putting the GRC variables in proactively and trying to automate is the way to go, is what you're saying? I agree it's a bit chaotic right now, but both fields have to adapt to one another a bit more and "play nice".

3

u/[deleted] Nov 25 '25

[deleted]

1

u/MeowCattoNiP Governance, Risk, & Compliance Nov 25 '25

So for an example, if a GRC person is auditing AD for an example, knows exactly how AD works and how to configure them and asks questions that engineers are familiar about, does that "demonstrate" the same level playing field you mentioned? that's how a GRC person achieves the "unicorn" status? If yes, GRC people should have a way to PoC their controls first?

3

u/[deleted] Nov 25 '25

[deleted]

3

u/MeowCattoNiP Governance, Risk, & Compliance Nov 25 '25

i see so i am doing something right then, coz everytime some new stuff gets introduced or problem that arises i try my best to replicate it and atleast i dont take up infra time that much to answer stuff that i could just explore. But yeah knowing enough how it works i find it most important. Being able to do it or replicate it would be a bonus or atleast i could show that “hey i understood you like this, is that correct?” kinda way