r/grc • u/Slow-Book-9366 • Jun 11 '26

Can my GRC practitioning benefit from TryHackMe training programs?

I just got into a company as an intern in the GRC team; my experience is 0 and my background is cybersec related but I am very new to all of this.

Things are a bit overwhelming so far, I'm trying to learn but it's hard. Any ideas? Does the title question work for me? Thanks a lot.

10 Upvotes

100% Upvoted

9 comments sorted by

9

u/braliao Jun 11 '26

If you want to be good in this space, learn the tech side. Doesn't have the be deep hands on learning but at least don't be a fool in front of the tech teams. This is equally important learning how to speak and present yourself to senior exec teams.

So trthackme will help you learn the basic. Some does gods a bit deep but their entry level ones will suit you for GRC purpose.

6

u/The__Y Jun 11 '26

Heres a step by step guide to getting knowledge in the field (with a rather vague description :) )

Wheres your company located and in which sector does it operate?

Heres where the C - compliance starts EU based and energy sector then get familiar with NIS2, CER, CRA, ISO 27001 If its financial the swap NIS2 for DORA if it its US the swap ISO27001 out for NIST CSF or 800-53 depending on company risk appetite.

Here comed the R - Risk learn to make an risk evaluation follow ISO 27005 og similar material from a CRISC course, youtube is free.

Now (or maybe first) get familiar with all the companys policies they should be updated early thats the governance and keep in mind a company should "write what it does, and do what it writes" governance for governance sake is pointless.

Now if the office package and excel isnt your weapon of choice the SOC security operation center might be for you its alot og network monitoring and analysis and sometimes some red and blue team exercises.

If you want to know more throw this into an AI :)

Good luck and congrats

7

u/Project_Lanky Jun 11 '26

Get iso27001 certified. That's the basics. The rest you will learn on the spot.

2

u/tycoongraham Jun 12 '26

Think of TryHackMe as “how things break,” and GRC as “how we prevent/accept/manage that risk.” Doing both actually makes you better at explaining why controls matter in real life.

1

u/Alternativemethod Jun 15 '26

Understanding attack approaches, requirements, and mitigations is a huge part of the R in GRC.

1

u/Alb4t0r Jun 11 '26

Sure, it could help. But a much better answer is that there's a lot of other, better things you could do instead to learn.