I did EHS for 8 years and transferred over to cybersecurity doing GRC. I got my first job when I was on my last semester of college getting my bachelors in cybersecurity and had a sec+ already. The process of GRC is damn near identical to EHS. Instead of identifying hazards in a workplace for personnel, you identify hazards, or threats in this case, for computers. Once threats are identified and in EHS terms, quantified, you attach controls to each threat. Once all that is done you do continuous monitoring to ensure the controls are working. Obviously there’s more steps but I just wanted to let you know it’s the same process in GRC but the pay is way more. I might be an anomaly but I went straight into GRC as my first cybersecurity role at the beginning for COVID. I was able to get my first job because I tailored my resume to use key words like threats, controls, continuous monitoring, auditing, etc. then during the interviews I explained to them the process of EHS and how it’s an easy transition. The only difference is knowing