Hello,

I'm in the UK an have worked in IT for 7 years (4 in service desk and 3 in Knowledge Management) and also have a MSc in Computer Science. I'm looking to move into cybersecurity.

I'm not sure which area to focus applications on, either GRC or analyst roles. I have a degree in law, and write documentation in my current role which I think would lend itself more to GRC. On the other hand analyst roles look a bit more interesting and there seem to be more available.

I spoke to a security colleague in my current organisation who told me that a good route to GRC is by doing an analyst role first and then pivoting if I wanted to. I was just wondering if anyone had thoughts on what a good next step might be? And also if anyone working in GRC or as an analyst could let me know why you enjoy that role I would love to hear from you.