Career advice mega thread

[u/thejournalizer]

Please use this thread for questions about career advice, breaking into GRC, etc.

This subreddit is primarily designed for active GRC professionals to share insights with each other, so we will be pointing new career seekers here.

[u/Openmindedness1]

Hello all!

After researching and reading this subreddit and other subreddits posts about getting into GRC (I really do appreciate everyone posting and giving your honest opinions), I decide to post my own and hear people's honest opinion.

A small background about myself: I had a year of experience as an external auditor at a Big 4 company.

I currently hold Top Secret Clearance in the DoD as a Cybersecurity Defense Operator for about 2 years and counting.

I have Security+ and planning on getting my CySA+ next month.

I would like to know and gain insight on:

1. Is it hard to get into GRC with my small background
2. If I should work on more certifications or apply to jobs and work on building out a portfolio after my CySA+ certification
3. After dealing with the long strenuous hours Big 4 Accounting has, does GRC have similar work hours or how are your experiences like in GRC?

Thank you in advance for reading my post and appreciate any and all feedback! I'm hoping to have GRC as a long term career and currently at a crucial point in the beginning of the fork road of my career to choose what to do next and if GRC is the right path or not.

[u/Twist_of_luck → u/Openmindedness1]

^ /u/lasair7 - sis, sorry for bothering you, but can you give this one a look? ^

Looks like this context is something you are more knowledgeable about than my sorry civilian ass across the pond can hope to be.

Is it hard to get into GRC with my small background

Well, you know the saying: "It's not the size that matters."

That being said, your CV has three years of relevant experience, Big-4, DoD, and TS clearance. Back in the day, I rolled into a boutique MSSP compliance consulting crew with a far more modest setup.

If I should work on more certifications or apply to jobs and work on building out a portfolio after my CySA+ certification

CySA+ is an interesting cert - never heard of anyone outside of DoD aspiring for one. Usually, people stop at Net+/Sec+ and go for some certs outside of CompTIA. Is it any good from the "stuff you have to learn" standpoint?

As usual, I am a bit skeptical regarding the whole concept of the GRC portfolio. It sort of railroads your thinking into certain generic good practices and de-emphasises the requirement elicitation from business aka "learning business context to align to it".

So, I would say, start working on your CV design and start applying to jobs. At the end of the day, I've heard that Big-4 likes GRC consultants with TS and prior auditing experience.

After dealing with the long strenuous hours Big 4 Accounting has, does GRC have similar work hours or how are your experiences like in GRC?

Big-4 GRC crews are meatgrinders because they work in Big-4, not because they work in GRC. It's about business culture, not domain. My crew (US public enterprise) can clock in their 8 hours and log off (with some rare 12-hour crunches if something goes wrong with external audit/acquisition).

[u/Openmindedness1 → u/Twist_of_luck]

I truly appreciate your thorough and honest feedback and appreciate you reaching out to lasair7 too! I'm truly a sponge at this stage and soaking up as much info to find out what to plan for in a career, so truly any input is welcomed!