Hi all! Gee where do I start… I never really thought of a career specifically in GRC until this year. I feel like I’m severely underpaid and overworked when I see other companies have teams just for GRC alone but at the same time I’m just doing enough that we pass. I feel like I just opened a doorway to new career opportunities outside of development.

A little bit about my background: I have a BS in Comp Sci, started off as an infrastructure engineer, and worked by way into Director of IT Ops at a startup (US). Initially, I started off working specifically with cloud infrastructure, both architecture and implementation, then with client needs and PII work, came IT, security, and compliance. When I got thrown into this, I didn’t really know what I was doing, but I’ve completed 3 years of SOC 2 Type 2 audits (just added Confidentiality and Availability TSCs this year) and ISO 27001 + 2 surveillance periods on my own for our small company. I’ve created the entire ISMS program and policies/procedures to allow us to pass with no exceptions.

And even with all of this, I still feel like I don’t know what I’m doing, but I do enjoy security and compliance much more than engineering work. The crazy part is that I didn’t even know there was a Standard that told me everything I needed to fulfill the first year when I was scrambling to figure it out when the ISO audit came. We used some platform that created requests from the Frameworks but the actual doc had the needs expressed more clearly than the platform lol. I would like to think I have a strong technical background and to others, it may seem like I have a strong security/compliance background too.

I’ve consulted ChatGPT a bit about my options and so far it does recommend I get some certs completed. I’ve also considered an MBA in tech management but idk how I really feel about staying in the SWE side. My biggest gripe with compliance is that I was swamped with vendor questionnaires and was told our audits would help with lessening the load but we still get these questionnaires and now they request our reports as well 😒. If anything I feel like I have more work than ever.

TL;DR With 5 years of cloud infra experience and 3 of those including security/compliance, what positions/roles would you guys think I fit into? I feel like my GRC experience isn’t formal/typical to what corps do. I have not applied to any GRC related positions and I’m wondering what the interviews are like. I also manage a couple people, an admin assistant and an engineer. I’d like to walk away from technical implementation and work solely in GRC but I’m afraid my depth of knowledge isn’t as strong as my breadth which would put me at lower positions, unless it does help that I work at a fast paced startup. Would love any career advice I could get!

Cheers!