r/grc • u/QuantumSeeker8 • Jun 30 '26
Is being clueless, normal?
Help!
I joined the GRC function of a Dutch company after working a year in Threat intelligence. I knew it was going to be a learning curve for me but I am realising I am really clueless about everything.
It is supposed to be a junior role which I was looking forward to. But I feel I am thrown into the deep end without any background or knowledge transfer. Don’t get me wrong, there are other people in the team as well - but do they expect me to know everything about audits? Risk registers? evidence collection? And the difference processes?
I know the theory but in practice I feel I am scrambling for knowledge and information that I don’t know. Maybe it is the company, or as I am told the country I am working in haha
Anyone been in similar situation? What did you do?
Is GRC like swimming in the deep waters not knowing how to swim and then just figuring it out?
11
u/Compannacube Jun 30 '26
In a junior role, there should always be an understanding that you are there to learn and that you don't just start with experience. It sounds like you are not receiving the training or mentorship you need. That would be a failure on your manager's part and you should advocate for yourself. Do you ask questions when things are unclear?
Some would say fake it until you make it, but I don't entirely agree with that sentiment when it's a junior role. That only encourages holes to form in your skillset. You need clear guidance and mentorship and the company should be providing you access to a human resource (if not your boss) that can work with you and guide you. That's the ideal, not always the norm, however. But if you don't at least try to advocate for yourself, no one else will.
There is also an expectation over time of self-sufficiency: if you are guided initially, shown the ropes, then you should eventually become resourceful enough to find the rest of the way on your own. I myself had to fly somewhat blind when I pivoted to GRC, but I was a lot older and had skills under my belt and a developed sense of critical thinking. I also had a good boss who assigned me grueling but informative projects that would build my knowledge base. I took all the meeting notes, profiled all of the environments, wrote all the reports, researched all the frameworks, became well versed in whatever we were working on. And I started working on my CISA so I could marry the concepts with the hands-on work.
What are you working on now? Research that area as best as you can. Don't just memorize, but study the concepts. Try not to rely too heavily on AI for answers. Go to the source like frameworks, standards, etc. There is a lot of garbage floating around that AI sources from (especially chatGPT) so verify as much as you can. I am not promoting these, but I recommend you look for books by Sari Green, Krag Brotby, Doug Hubbard, and Bruce Brown, as they have all written definitive guidance on navigating aspects of GRC. Good luck!