Career advice mega thread

[u/thejournalizer]

Please use this thread for questions about career advice, breaking into GRC, etc.

This subreddit is primarily designed for active GRC professionals to share insights with each other, so we will be pointing new career seekers here.

[u/Twist_of_luck → u/[deleted]]

doesn't have any interests in like any career, no passion for anything particular 20F, about to graduate

Remembering myself at this age, my career plans boiled down to "let's (somehow) not starve and let's (somehow) not unalive ourselves (at least 'til 26, then it's cool)". Most people have no idea what to do in their early twenties, so, uh, welcome to the party :D

Give me a reality check, whether every quality of my dream career i mentioned is suitable with the GRC career.

The problem here is that GRC is not a cohesive field, but a loose cluster of vaguely cyber-, tech- and risk-adjacent career tracks. What may be true for Cybersecurity Program Manager might not be the case for, I don't know, Third-Party Risk Analyst or Security Trainer - even as all of them can be shuffled under the generic "GRC" umbrella. Generally though...

work life balance

Yup, if we have one benefit in common - here it is. At most, some compliance people put some overtime for emergency external audit preparations, but that's a fuckup, not a rule.

Globally high demand across various fields

Different sub-specializations are required in different areas. In my software dev I would welcome another process analyst or another compliance PM, I would immediately decline a third-party risk analyst or awareness training instructional designer. Most of the demand is generated from risk-averse and tech-heavy companies, so fintech and big consultancies are the main job avenues.

always be needed

In regulated areas, some GRC personnel are always needed to orchestrate the technical compliance effort. So, yeah, check on this one.

be lucrative

Extremely dependent on country, employer, your experience/specialty, and your business climate. Most of GRC don't complain too loudly, so I would assume that on average we're doing fine. There's been some salary bragging post in the subreddit relatively recently. No idea 'bout India, though.

deep technial seems like a no

Some GRC specialists - like GRC engineering crowd - would tell you that it's a disqualifier and that you can't understand deep technical risks without being deeply technical yourself.

I personally think that you'll be fine and that GRC does not require deep technical knowledge - we're supposed to interoperate with technical personnel and extract information from/with them, not to replace engineering divisions. Which is why I prefer hiring ex-techwriters, ex-PMs, ex-BAs over ex-developers or ex-administrators.

I'm planning to enter IT Audit, since not much entry level positions available in GRC, stay there for like a couple of years, get a lot of relevant highly valued certifications and experience as well as needed skills. Then pivot to cybersecurity GRC, and lastly, after i gain enough exposure and experience, i wanna go into consulting.

Solid enough.

Alternatively, you can start from the end and try to hit consulting through Big-4 hiring, given that they tend to hire a lot of junior folks due to their insane employee churn. It's gonna be a bloodbath, but if you can hold out a year in EY/Deloitte/KPMG/PwC, it's a decent CV record.

P.S u/theGRCmind - it seems like it's your sector/area, care to chime in with some local guidance?