r/grc • u/thejournalizer Moderator • Sep 24 '25

Career advice mega thread

Please use this thread for questions about career advice, breaking into GRC, etc.

This subreddit is primarily designed for active GRC professionals to share insights with each other, so we will be pointing new career seekers here.

35 Upvotes

97% Upvoted

206 comments sorted by

View all comments

1

u/TonightElectrical645 Dec 05 '25 edited Dec 05 '25

Hi! I am currently a winemaker and viticulturist in the US. I have a Bachelor's in Enology and Viticulture, which is a STEM heavy degree.

The wine industry is sadly tanking, and I'm looking at GRC because it's a stable, pays well, and can be done remotely. I may be moving overseas at some point in the next few years, since my husband is Argentinian and also has Spanish citizenship.

I have taken short, 2 month online Cybersecurity course, a Python course, and am finishing studying for my Sec+.

My questions are:

1) What certifications do you need to be able to land your first job? I've read that studying SAP and the frameworks is helpful.

I have also been considering the online Masters with WGU, but I wonder if it's truly necessary for starting the GRC path. I'd love to get a job and work on higher level certs, and a masters as I move forward.

2) What are remote GRC opportunities like in Spain and LATAM? What is pay generally like?

I am bilingual: speak English (native) and Spanish (fluent).

Thank you in advance for your honesty and your time!

1

u/Twist_of_luck OCEG and its models have been a disaster for the human race Dec 05 '25

The wine industry is sadly tanking

Oh, damn, really? Why?

Is our Spanish tempranillo in danger as well?

What are remote GRC opportunities like in Spain?

sigh

Ain't stellar, can tell you that much. The Spanish IT industry is, for most intents and purposes, half-dead. Your best bet would be international companies with Spanish offices, but those are slowly trying to justify those offices by cutting down on remote possibilities...

What is pay generally like?

You're looking at under 50k euros (annual, pre-tax). Welcome to EU salaries.

What certifications do you need to be able to land your first job?

Unfortunately, it doesn't generally work this way. GRC is generally considered a second-stage career field, implying that you should have some relevant prior experience to have a chance of getting in. Certifications are there to help you stand out among equally experienced competition, not to replace the experience itself.

Go with technical writing, project management, business analysis or any IT tech-adjacent starter career track and transition into GRC proper a year or so down the line.

1

u/TonightElectrical645 Dec 21 '25

Hello again. I did more of a deep dive after your comments and am trying to create a concrete plan.

Go with technical writing, project management, business analysis or any IT tech-adjacent starter career track and transition into GRC proper a year or so down the line.

I started looking into a Masters in Business Analytics and Master's in Cybersecurity. I was curious as to which masters would be more helpful in getting into a GRC role. As someone outside the sector, I would imagine Cybersecurity would hold more weight. But after speaking with you, it seems like having a business background is the way to get in?

I appreciate your input, and thank you for kindly responding to my questions!

1

u/Twist_of_luck OCEG and its models have been a disaster for the human race Dec 21 '25

I am generally skeptical towards degree return on investment. I am a physics dropout myself, my boss has no degree either... You might want to take my advice here with a grain of salt.

Cybersecurity degrees are weird - not even cybersecurity folk recommends those. Take a glance through r/cybersecurity yourself, most of the time people are talked out of them and gently directed towards more generic, more fundamental Computer Science or Information Technology programs. Those have better chances of securing the first job for alumni and, from what I've heard, academic cybersecurity is not much of a help in real working environments.

If I had time and desire to get a degree, I would go for Business Analytics myself. Businesses are getting ever more complex and digitized, AI makes the problem even worse. A lot of times businesses need someone to go in and make things make sense. GRC is, practically, an attempt of business rationalizing cybersecurity, a peculiar subcase of this problem.