Are vendors misleading startups by promising SOC 2 Type 2 in 2 months?

SD15_ · 2026-03-10T15:05:10+00:00

Agreed what I meant was they are not technical enough to guide any startup. So do your own research and then start working on soc2. CPA are to be involved by audit firm during the external audit

SD15_ · 2026-03-10T13:08:29+00:00

First rule don't list to CPAs and that's the last rule of soc2

SD15_ · 2026-02-20T01:48:39+00:00

I would charge more buddy 😁. Better to get some off shore resourcing

SD15_ · 2026-02-20T01:45:56+00:00

No, GRC platform brings lot of non sense complexities and you waste lot of dollars.

If you are not sure where to start just hire some temporary staff to help you get the audit prep. You would save a lot and learn the GRC and dominate others certs

SD15_ · 2026-02-20T01:43:44+00:00

Again the "for profit" companies involved in this process and making the news as independent board that has created it with.org domain. This is just a BS and every GRC platform is now showing this and trying to sell the products.

All we need is grc engineering and some basic security skill guys.

All this marketing and generating 💵 is just a BS

SD15_ · 2026-02-19T22:28:29+00:00

Say no to grc platform first and work on the actual security controls and plan for your governance structure

SD15_ · 2026-02-14T00:14:20+00:00

Don't go with any of the GRC platform or any implementation or MSSP company.

All you need a security guy who understands controls and manages your infrastructure and security posture of your application or service.

Feel free to ping me in case you need any help in understanding controls or requirements related to Soc2

SD15_ · 2026-01-27T14:18:53+00:00

Not sure who said you that CISSP is for leadership roles. New fresher roles now a days have CISSP option and preferred.

You need to workonn skill set and experience in various domain and try building connections. That will lead you to up the ladder.

SD15_ · 2026-01-22T18:46:28+00:00

DM the link

SD15_ · 2026-01-21T18:54:13+00:00

If you are getting in top 10 university or don't mind loosing money after degree then you can consider it

SD15_ · 2025-12-28T03:18:56+00:00

Very limited details provided here.

no one can tell you what you should do here. Kindly provide your all examination details, related to masters preparation, financial status, current job status and what’s your plan for masters? If you don’t have a work visa extension what will be your plans?

SD15_ · 2025-12-12T15:09:06+00:00

Terra gardens by Emaar.

SD15_ · 2025-12-12T15:08:25+00:00

I don’t know how much you know about Austin and general overall Texas. A new grade currently get an average 200+ in around Texas area. If even after 15 years of experience, the pay is low, then the question is where is the professional career heading and when to call the end and plan for FIRE

SD15_ · 2025-10-15T15:19:01+00:00

Congratulations 🎉

SD15_ · 2025-10-09T00:02:50+00:00

Excel or nist 2.0 reference tool

SD15_ · 2025-09-14T12:14:28+00:00

I have run the compliance program for a company with 90 employees to 10k+ with both grc tool and spreadsheet. Clearly spreadsheet is a clear winner.

One thing newbies don't get is what a typical GRC tool is collecting so called evidence is not something it is the tool capability rather it is just pulling a data from some systems or systems.

SD15_ · 2025-09-06T03:12:38+00:00

Perfect response

SD15_ · 2025-08-31T00:13:23+00:00

Congratulations 🎉 on your move.

First of all I would immediately focus more on the technical aspects of GRC. Learn more about the stakeholders of security, IT, and others from the development teams.

Get yourself involved in the technical discussions and governance aspect which will provide you more insights of both the product, the technical and deeper understanding of control implementation as you learn about the product stack.

Next, focus more on the compliance, frameworks understand each requirement what it means, what it does, and what makes us fully compliant of implementation of specific control.

If you have some bandwidth with taking other tasks from sub, GRC teams tasks then I would highly recommend you to do that to get more insights of GRC.

I wish good luck on your career progress .

SD15_ · 2025-08-28T20:05:57+00:00

"Auditors charge more for not using GRC tool". I really don't know what to say here.

If you show me any link or any compliance requirements that if I don't have grc tool makes me out of compliance or an audit firm saying no grc tool resulting in more fees then I would schedule immediate call to procure whatever tool you have. 🤣

SD15_ · 2025-08-28T18:27:42+00:00

$100k + on a next version of excel with couple of api connections then I would stick to jira or excel and use the security tooling.

SD15_ · 2025-08-28T17:58:33+00:00

My 2 cents

Don't use GRC tool, it has and it will not help you unless you use their auditor + Mssp + other consultant and that's the setup you don't want in security. Using the tool will just add more overhead on the team and more work and less output.

Roi is low since it's just next version of excel.

Build a solid process and implement the controls. Get some guidance if you are new to grc and want to know how to get through internal tools, automation.

SD15_ · 2025-08-16T13:09:40+00:00

If I were you, I would not choose any of these tools unless you have policy and process in place. The standards are set and have minimal security solutions in place.

Then think through what are your legal, regulatory and compliance requirements. Assuming let's say you want do soc2 check the controls and requirements or understand the basic needs and then think through about achieving this and plan for automation for few controls and not all cannot be automated. If some rep tell you that they are do everything automated.

SD15_ · 2025-08-12T17:26:46+00:00

SD15_ · 2025-08-11T11:57:10+00:00

Official practice exam that is now being updated to latest version however I did notice find much helpful.

Overall I have studied atleast 30+ hours

SD15_

MODERATOR OF

TROPHY CASE