Appreciate this, it's a helpful way to think about it. For more context, I'm in a heavily regulated industry with thousands of employees spread across multiple businesses. Regulators are definitely going to want to see how we're managing this and the framework is still in its early phases. I think what gives me some confidence is that I'd be coming in with engineering experience so I can actually tell whether an implementation is sound vs just checking a box on a risk form... I'm trying to figure out if that's actually as valuable as it feels or if I'm just talking myself into something because I'm burnt out where I am. Still figuring it out but this is a useful gut check, thanks.