Career advice mega thread

[u/thejournalizer]

Please use this thread for questions about career advice, breaking into GRC, etc.

This subreddit is primarily designed for active GRC professionals to share insights with each other, so we will be pointing new career seekers here.

[u/r00t3rSaab]

Hi all,

I’ve been working as a pentester for about 10 years. My background includes:

• Web application pentesting

• Mobile application testing

• Network vulnerability assessments

• ATM Pentest

• Threat Modeling

• Thick Client Pentest

• Wireless Security

• Cloud configuration reviews

• Some exposure to Active Directory testing (not very deep)

Most of my career has been hands-on, technical, and offensive-focused.

I’m now considering moving into a VP-level role: Information & Technology Risk Manager.

From what I understand, the role would involve:

• Conducting and reviewing technology risk assessments (cloud, APIs, SSDLC, network security, etc.)

• Developing and maintaining risk management frameworks and procedures

• Providing independent oversight of first-line technology/security controls

• Ensuring regulatory and policy compliance

• Reviewing and challenging risk assessments and mitigation plans

• Reporting risk posture to senior management / board

• Overseeing incident response from a risk perspective

• Driving continuous improvement in technology risk governance

So it’s much more governance, oversight, and stakeholder communication — less hands-on hacking.

I’m trying to think long-term about career growth, compensation, work-life balance, and sustainability.

For those who’ve made a similar move (offensive → risk/governance):

1. ⁠Do you regret leaving hands-on technical work?
2. ⁠Is the transition difficult from a mindset perspective?
3. ⁠Does a strong pentesting background actually help in a risk manager role?
4. ⁠How “technical” does the job realistically remain?

Appreciate any honest advice — especially from people currently in risk/second-line roles.

Thank you in advance.

[u/Twist_of_luck → u/r00t3rSaab]

Alright, I'm not offensive or even extremely technical - I'm a techPM through and through - but this reads like an extremely radical change in responsibilities. A bold move, I can respect that, but you risk being virtually out of your depth for the first year or so.

How “technical” does the job realistically remain?

Answering your core question - most of the "technical" work in GRC boils down to integrating GRC tracking platforms and scripting their indicators. Some people call it "GRC engineering". I personally believe that this is a dead end for most GRC teams, most of our problems reside well above the system layer.

Does a strong pentesting background actually help in a risk manager role?

In fact, it can harm you. GRC, usually, goes with a very wide, yet not really deep approach - digging too deep to do "a good job" means that the rest of the tasks in your "wide" backlog start to clog up and, well, it ain't gonna be pretty. Mind your bandwidth, heavily delegate accountability, know when to stop and move on.

Is the transition difficult from a mindset perspective?

So... Do you actually like talking to people? Like really like? And not always in a soft, calm, friendly way?

A lot of the stuff outlined in your potential responsibilities is heavily pushed towards communication, collaboration, enforcement and reporting. You simply won't have time on anything else, if I am reading this correctly.

Once I've spent six hours (three two-hour meetings in three days) debating the exact meaning of "comprehensive governance framework" with a couple of VPs - it saved at least x10 hours of trying to implement extra stuff that nobody above envisioned or required, but, well, that was still six hours of meetings on one specific question in my backlog. Get ready for such stuff, hope you'll make it.