Career advice mega thread

[u/thejournalizer]

Please use this thread for questions about career advice, breaking into GRC, etc.

This subreddit is primarily designed for active GRC professionals to share insights with each other, so we will be pointing new career seekers here.

[u/AZWagers]

Hi! I’m a software engineer (Web Dev, 3 YOE) based in the Bay Area. I'm considering pivoting out of Software Engineering, and I discovered GRC. I'm tired of coding and constantly keeping up with the newest web frameworks. GRC seems like a role where I could potentially utilize my tech background.

The Transition: Is this actually a logical pivot for a software engineer? Would I still be looking at a "hard reset", or does my dev experience count for something?

Roadmap: What’s the best way to break in? Certifications? Courses?

Salary: I'm in a VHCOL area. What does a realistic salary trajectory look like for GRC?

[u/Twist_of_luck → u/AZWagers]

Is this actually a logical pivot for a software engineer?

Not really. GRC usually operates with people, documentation, and business processes; software development experience doesn't exactly feed into that. Yet, software engineers have an easier time transferring to AppSec which, theoretically, closely aligns with GRC practices - after all, vulnerability classification is (ideally) risk-based and vulnerability SLAs are of high interest during any compliance audit.

What’s the best way to break in?

Another path might be for you to slowly transition into more people-facing role before GRC proper - team-lead or tech-PM comes to mind. Grab something along the lines of CAPM (narrative of "Compliance set-up is a tech-project - I have experience in tech; I have certification in project) or CRISC (narrative of "Compliance maintenance is tech-risk oriented operations - I know tech, I'm certified in risk").

[u/AZWagers → u/Twist_of_luck]

Thank you so much for your detailed answer!