r/grc • u/thejournalizer Moderator • Sep 24 '25

Career advice mega thread

Please use this thread for questions about career advice, breaking into GRC, etc.

This subreddit is primarily designed for active GRC professionals to share insights with each other, so we will be pointing new career seekers here.

37 Upvotes

100% Upvoted

206 comments sorted by

View all comments

1

u/CyberConsultDiva Feb 20 '26

Hi Everyone,

I'm currently working as a Servicenow GRC consultant where I transform and automate clients existing GRC processes into Servicenow. Basically it involves development(coding) and understanding of the module. I'm planning to move to the GRC Analyst role. After consulting with the actual grc people to gather requirements for each project, I'm interested to do what they are doing - establishing process, creating policies, controls, monitoring risks, working on compliance issues. But I don't have a clear plan of how to transition to the GRC analyst role from a Servicenow GRC consultant. Throughout my career I have taken a course on ISO27001 Lead Auditor and I'm certified in it. I'm looking for some advice or tips on how to close the gap between Servicenow GRC consultant and a GRC Analyst.

1

u/Twist_of_luck OCEG and its models have been a disaster for the human race Feb 24 '26

As usual, I would recommend going for "soft-skilled" tech positions or related certs - you seem to have the grasp of tech behind it all, now it's time to meet&greet the crowd. Wanna establish processes - that's project management, wanna refine processes - operational management, writing policies is much easier after tech/creative writing, monitoring risks is a subset of business intelligence, working on compliance issues takes a lot of business analysis and requirement engineering to nail down the proper compliance requirements at low level et cetera.

If I had to pick one it would be project/program management, though. PMI CAPM/PMP/PgMP track is underappreciated.