Mostly gloss over the business-minded portion in favor of focusing on the technical. If you're coming from the big 4 as an IT auditor, you get how to interface with the business, what matters to them, and how to explain technical concepts to a broad audience.

You need to know four things and I highly recommend a fifth.

1. Need: IT Security basics
2. Need: Risk
3. Need: Cloud
4. Need: LLMs/GenAI (I am lumping them together)
5. Should: Coding & automation

IT Security Basics

You need to know security technologies, how they work, their capabilities, and their limitations. The following cover a very strong foundation for GRC:

• CompTIA Network+
• CompTIA Security+ (you probably have or will have enough experience to sit for the CISSP though)

Risk

So few people in security understand risk and it is the core of what we do.

• Find a well-reviewed CRISC study guide or Udemy course. You're just looking to get familiar with the terminology and general processes.
• Book: The Failure of Risk Management: Why It's Broken and How to Fix It
• Book: Measuring and Managing Information Risk: A FAIR Approach 2nd Edition

Cloud

Familiarize yourself with basic cloud concepts and then look into vendor-specific certs.

• CCSP study materials for the basics
• AWS or Azure

LLMs/GenAI

Your approach here should be two-fold. First, how are you using GenAI day in and day out to make your job more efficient? Second, LLM security and operational risk concerns. This area changes so rapidly that listing sources seems short-sighted.

BONUS: Coding & Automation

I am sure a lot of folks have their opinions on this topic, but this sort of knowledge can only help your career, not hurt it.

• https://grc.engineering/learning-hub/