The Harsh Reality of Working in GRC In Cybersecurity That No One tells You

[@stevecochrane9531]

Thanks, Nicole! Years ago, our cybersecurity team updated GRC rules and changes that disrupted many systems. As many more people in our large organization have better "cyber hygiene" practices today, most clients understand the importance of GRC (and the technical applications of it). My guess is that after several years of being "in the trenches", working in GRC would be a positive change for many cybersecurity professionals. I'm glad to hear you are enjoying it!

[@nicoleenesse]

Thanks for sharing!!

[@laramecodes3520]

As an extremely technical person I needed to see this. Better pay and hours is a good trade off in my opinion.

[@goodsamwise]

This simple honest explanation of what it's like for you working in grc vs tech roles is really helpful to hear for those of us trying to figure out what direction to go.

[@NotMe-hs7jk]

I just want to work, I don't care what the role is. I am about to become a a homeless man with two degrees. So much for all that effort I put into getting a 4.0 GPA.

[@hottroddinn]

What are your 2 degrees in?

[@Discover-Hidden]

How you doing bro? What degrees you have?

[@Kingpin909]

If you're under 40, then go sogn up for the military. With 2 degrees you'll be in the 6 bracket asap and could have all the certs within 2 years.

[@johnleejones1457]

After 20 years of being in IT and troubleshooting, I am so ready to be bored. I completed UnixGuy's GRC course in March. I am now in a NIST CSF course. Been a bit frustrating looking for a job. I see so many "entry-level" GRC Analyst\IT Audit jobs asking for 3 years of experience. I would not even apply, but that changes today. I will apply anyway. As the saying goes, "You miss 100% of the shots you do not take."

[@nicoleenesse]

GRc is a huge field. I would narrow it down to a specific industry/skill set that is similiar to the one you work in

[@jimmyjamesiv]

I took Unix guys course too, what NIST course are you taking? Could you drop the link?

[@Helen_Boayue]

Plse share the class your are currently taking, I also just completed the Unix guy course and having a hard time navigating getting a GRC job.

[@RellDefinition]

@@nicoleenesse I'd be interested in hearing what terms you suggest for job hunting purposes

[@osaedo4698]

@@jimmyjamesivI’m about to sign up for Unixguy GRC mastery,Did you get a job yet?

[@artccie]

Awesome content....good to see other folks working in the same field having similar challenges. One good perk of working in GRC is that you don't called at 12:00am at night to perform emergency audits or assessments.

[@nicoleenesse]

Yeah, there are no emergency audits and assessments LOL

[@morisn]

My dilemma is that I like the technical side, and a lot. Since I started a deep-dive transition into cybersecurity, I have tried a couple of CTF challenges, and I can't say that I didn't enjoy the experience. So... What's the problem? It's too involving, and I've been the type of individual who does not 'go to bed' until a problem gets fixed. And that can be a problem. Mainly, at my age. I am over 50 and I know it's harder to keep up with the technical stuff. Besides, I have been in leadership roles for most of my career until I was laid off. So now that I want to re-enter the workforce but in a cybersecurity-related role, I know that GRC is the way to go. But... I love the technical aspect, too. I wish I was 30 to dive deep into it, but I don't feel I can keep up. And that's my dilemma. Thanks for the Video!

[@Thiccolo]

Maybe a SOC manager? you could definitely develop skills to be a leader in a SOC. You still get to do technical work but you can also flex your leadership ability.

[@CoffeeNinjaJinxy]

I'm in that boat. Just over 50 and changing careers once I get some certs under my belt, and I also can't walk away from an existing problem unless I know it will take days of work to fix and can see the map to fixing it in my head.

[@ryu411]

At least GRC isn’t an “on call” position like a SOC analyst is. You worked your scheduled hours and then you fuck off home. No qualms about it. The negative stigma of a “dull” career certainly outweighs that of a stressful and entropy-riddled workload. 🙃

[@nicoleenesse]

Yes!!!

[@RohitMishra-vl1vp]

Absolutely agree to the information. As a GRC professional, you have to regularly chat with your company management. I love the fact that it is very broad and one can learn about every domain is connected to each other.

[@rl6741]

I've been working in the IT field as a Helpdesk analyst for around 4-5 years and I'm ready to transition from IT to GRC in a heartbeat. The stress working in IT is killing me. I don't want to do Helpdesk anymore. Just my honest opinion.

[@OiVinn-eq1ml]

What about SOC or security engineer?

[@billclancy4913]

I began a technical career in 1979, and grew with the IT industry. I pivoted to Cyber in 2005, and retired in 2022. I found it had it's own form of stress, in the DOD community, GRC is heavily involved in the "Authority to Opperate", which is detailed, and on a tight time schedule.

[@dieglhix]

I've been doing this job, very well treated and everything goes well, but I am now trying my best to do the transition to cloud architecture. GRC is drying my brain!!

[@johnczech7074]

Thanks Nicole. I love the flowers on your porch!

[@nicoleenesse]

Thank you! 😊

[@danimat4682]

How did you transition from 'High tech' to 'low tech(GRC)' ? Can you post or DM some pointers or advice?

[@RespectfullyCurious]

I went from being a SysAdmin to GRC fairly early in my career. I didn't want the stress + having to be on call. I have worked for bleeding edge tech companies, so I still needed to stay up to date with technical stuff, even if I wasn't going to master said technologies or tools etc. It works for me, at least for now.

[@nicoleenesse]

Yeah, it is a lot of stress

[@patrickchan2503]

howcome a less stressful job gets paid more? is it because GRC people are business minded and so they know how to negotiate better? Or maybe the business doesn't value cyber security so they don't want to pay much to technical people? Thanks

[@nicoleenesse]

I would say in general, th emost stressful jobs get paid the least. Fast food, service work, etc. Yeah, if the company isn't in compliance with certain rules/regs they could get fined millions of dollars or lose their accreditation meaning they lose their customer base and $$. It's easy to link this role to an actual dollar amount meaning you can make a case for more salary easier

[@patrickchan2503]

@@nicoleenesse yeah I see what you mean. Firefighters and nurses don't get paid much but their work is tough. It's like the best communicators get promoted and the quiet nerds get forgotten lol.. hm.. 😕 I wonder how things can be more equitable... because without one cog, the whole machine isn't optimal. Thank you.

[@TheBangkokMinute]

Nicole, I have a Master's in Cyber Security from USD (san diego), Network+, Security+, and I have just about given up on getting a job in cyber. I have a renewed interest in GRC. I am planning on studying/passing the CISA then move forward to CISM and hopefully land a job sometime on that pathway as I will be applying as I pass study for these exams. Any suggestions? FYI, I have been an ICU nurse for the past 14 years so my ears perked up when you mentioned nurse in the video.

[@TheITCornerbyJR]

I like both GRC and Technical. I am an IT Manager, but sometimes I go out and do Tech stuff to help my guys. ✊🏼😎

[@nicoleenesse]

Nice! I would hate to be a manager lol

[@TheITCornerbyJR]

@nicoleenesse It's not that Bad. I get to dabble in everything if i want to. (Networking, Cyber, GRC, Desktop Support, LCM, etc..) IT Manager is not my official title but, i like it. It sounds more simple. ✌🏽😎

[@dieglhix]

I want a job like yours, I'm doing purely paperwork now but I have a really strong technical background, I hate not to do technical stuff

[@OiVinn-eq1ml]

I wanna get into cybersecurity & the technical side seems fun. However, it seems it’s a long learning curve & I’ll probably wanna learning everything burning myself out

[@chrislee2119]

Hi Nicole. Overall, is a GRC Analyst pretty much the same or similar to an ISSO role?

[@jsmith85151]

The gold rush for non-technical cyber security ended about two years ago in my opinion. There's no shortage of people who can do this job, and it usually pays pretty well. My experiences with the market thus far are forcing me to add the ability to code on top of penetration testing so that I can differentiate myself from the competition.

[@Glenningway]

You're just like me, though I'm much older. Tired of troubleshooting, tired of being on call, and the threat of a breach means I'll never see the outside of the office thanks to some 9-5'er clicking on a fake email link some foreign actor sent. My boss would panic call me every five minutes while I'm driving to a site. Also some of our catty end users I can also do away with. I go home stressed on a bad day, and even the Sunday morning dread starts to creep in. It takes a full weekend for me to destress from the week. We're focusing more on HIPAA and I've done a lionshare of documentation and reports via email and Excel. Just need to get better memorize NIST standards and other words. Have IT experience and Sec+, though more places are demanding CISSP (overkill, but ok).

[@thefrub]

The CISSP is easier than most people make it out to be. That $750 exam fee will come back to you manyfold in career gains, and anyone working IT has definitely fulfilled more than 2 domains. Hell, a tollbooth operator fulfills Access Control and Identity Management. Take the plunge

[@michaelechevers2414]

I need feedback? I saw somewhere that for GRC roles only Security+ CompTIA is required? Should I still go for Network+ too? How do I start my path on GRC? Are there any small projects in GRC I can work on as a newly graudated student to add to my e-portfolio?

[@dieglhix]

yes get the Network+ because a GRC person without knowledge of how networks work is not very respectable in my honest opinion, (I already have a paperwork role)

[@beamerb8152]

I have sales operations/deal desk ops experience and all we do it evaluate risk and compliance for deals and what states we can serve in. I wanna do GRC because I’m tired of the “everything is an emergency” atmosphere of sales. 😂

[@tushargupta5122]

Hi Nicole, Good Day! Thank you for sharing your experience working in GRC. I have 5+ years of experience working as System Administrator. As you mentioned in the video if someone already has a technical background, it'll be easier to get a job in GRC. I would like to know how easy/difficult it would be for me to pivot from System Administrator to GRC field? How can I tackle the question on my past experience since I don't have any prior experience working in GRC? Should I apply for entry level jobs? Kindly please guide Thank you!

[@nicoleenesse]

I am going to make a video on this question. It is so much! ahah

[@tushargupta5122]

@@nicoleenesse Thank you so much! Nicole

[@infojunkie5329]

Can you recommend courses or bootcamp to get into IT Audit or Compliance? I have experience as a Product Owner and Business Analyst and I'm tired of writing tech requirements and would like to transition into something more "boring and predictable".

[@rl6741]

Even if some people see it as a boring job, they don't know that how important GRC is in the field of the Cybersecurity and IT. It's all about following regulations and procedures (and more to it) and without it, everything would just start crumbling down.

[@GloryNationWarriors]

So what exactly they need to have on your resume to get a GRC position or posture yourself for it and also what is the day in a life foe someone who does GRC

[@TheITCornerbyJR]

It would be something with Cyber Compliance. So anything related to NIST RMF or Policies. Hope this helps. ✊🏼😎

[@GloryNationWarriors]

@@TheITCornerbyJR thanks I appreciate any help I can get, I'm currently in a 10 months boot camp at San Diego Sate University. I want to do GRC.

[@TheITCornerbyJR]

@GloryNationWarriors of Course. That sounds like Fun! Definitely, look up NIST RMF and get familiar with it. Understanding all framework relating to Cyber Compliance will help you. I work in the Health IT Industry as an IT manager. When we were hiring for a ISSM we looked at what experience they had with Cyber Policies as well as credentials like CASP and CISSP. For GRC you dont need to be an Tech Expert. Just need to understand how IT works. Hope that makes sense. ✌🏽😎

[@nicoleenesse]

GRC is super dependent on industry and very large. The right question is What role are you aiming for? And then reach out to people in that industry to see what skills they have and what their LinkedIn looks like

[@jasonsmart3141]

Can I do GRC 💯 remote from outside the USA? Yes, I’m American.

[@abdulrahmananka5798]

Thank you Nicole and I have one question, how can I get job in cybersecurity from home?

[@michaelechevers2414]

I just finished my cyber security career and I am on my way to complete Security+ & Network+ but I have no experience as I have not started any job yet... I had been induced under the idea of pursuing DevSecOps... but how do I get started in GRC? I live in Ontario, Canada.

[@InclusiveCyber]

GRC is the most important aspect of security, full stop! Thanks for your insight @nicoleenesse

[@FeckOffTeaCup]

GRC is never fun. Been doing the technical side for years and while yes things can break (looking at you MSSQL and your TLS 1.0/1.1 dependencies for install), it's more fun.

[@DallasFort1857]

Hello I'm in the process of obtaining the following for 3 certifications from SANS ... SEC275 Foundations & GFACT Certification... The second course you will take is SEC401 Security Essentials & GSEC Certification.... The third and final course you will take is SEC504 Incident Handling & GCIH Certification ... I have zero IT experience and just wanted to know upon completion of these certifications what type of job can I get?

[@alexmalooley7037]

I just landed my first technical role as a SOC analyst. How should I go about transitioning into GRC from this role in let’s say 1 year?

[@thefrub]

I was a long haul trucker for 10 years before going back to college for cybersecurity. I'm looking for a GRC role because I don't mind boring lol

[@michaelechevers2414]

What would be the average starting acceptable wage for a GRC position

[@TalhaSiraj]

Kindly make a video on the prefect CV for GRC role

[@nicoleenesse]

Good idea

[@cyberaddict1010]

hey great video! What technical experience is valuable before getting into grc? I heard cloud and/or security exp would be valuable.

[@dieglhix]

you might study for the following but not do their certs comptia network+ cissp cism crisc ccsp also quick courses for ISO 27001 and NIST CSF (also RMF for US)

[@tonyaustin1070]

I'd love more information on how to break into GRC. Also, if you don't mind, I'd like to get a copy of my resume to you.

[@yellowxj1]

Thank you for this. I am trying to move from a cybersecurity engineer to a GRC role.

[@OiVinn-eq1ml]

How come?

[@yellowxj1]

I am tired of managing technology. If that makes sense.

[@OiVinn-eq1ml]

@@yellowxj1 Perfect sense 👍

[@derricksmalls2293]

Technical positions have more roles per company. Learn how to script to check your configs.

[@etoilefushigi]

Hey GRC isn't bor- oh yea there is something wrong with me..... That checks out. I have experience on the technical (15 years) and the GRC side (5 years) and think that I enjoy GRC so much now because I have that technical background so I understand how things work day to day and how frustrated the technical team can become without proper consideration and communication. I really like my role in GRC and love that I get to experience new frameworks and constantly need to stay updated and read in.

[@nicoleenesse]

Thanks for your perspective.

[@seapeajones]

Oof. GRC is unsexy, but hardly boring. Technical background is a huge +, but critical thinking & people skills are the prereq. You're solving security probs for people/the biz, as opposed to trouble shooting or patching.

[@dieglhix]

even with really good people skills, too many meetings and paperwork can get too boring

[@jabedhasan7980]

Hi nichole,i am doing graduate degree in electrical and computer Engineering.my interest is cybersecurity, i am new in this field.for us rules as a international student i will not permit for grc because its has more security.after geting citizen i will get access probably. Right now for technical side cybersecurity job what courses do i need to do.please suggest me mam.Thank you for your time❤

[@shirleydavis5060]

Literally clicked into video after hearing being over thirty and an old woman! 😂 you’re funny. But here I am watching.🎉

[@germainkone9029]

Thanks for sharing. Do you test some controls to see if they were well designed and operating effectively as GRC analyst ? »

[@nicoleenesse]

Some roles test, I don't

[@germainkone9029]

Thanks 🙏

[@johnvardy9559]

Which one is better? Have more opportunities ?

[@nicoleenesse]

It depends on where you are in life. Both have a lot of opportunities

[@Vince_86]

Bro I swear every time someone tries to help the world community someone has to combat that. Each person is different what sticks for some won't for others. We don't have to have a video that combats everything lol. This is getting a little wild. The titles are always like you're getting ready to watch a horror movie as well. On God.

[@tedlessor3887]

Grc is clearly the better one for most people.

[@QompleteFreedom]

Thanks for this insight

[@nicoleenesse]

My pleasure!

[@Ki7oba]

GRC isn't stressful until you have to lead your org through a HITRUST Assessment.

[@dricoirving3236]

GRC is awesome! 😂😂

[@ion_q]

The horrible bad agony that no one is telling you because they dont want you to know the truth, click here now that i have you hooked with the title!

[@nicoleenesse]

I mean... did it work?

[@carsonjamesiv2512]

😃👍

[@s.joseph4838]

Nicole is web development and front end development top of the cybersecurity job line hiring

[@nicoleenesse]

I have no idea

[@Katsumato0]

My company treats the SOC analysts like the trash of the earth.

[@dieglhix]

soc analyst is literally the worst cybersecurity job

[@JayByrd2011]

I love GR.....wait. I see what you did there.😁

[@imhotep1613]

If you knew how much I like you ,Enesse. You are beautiful. I am in cybersecurity as well, by the way.

[@oculusisnevesis5079]

Women, not made for innovation, just know how to follow! and they call it entrepreneurship

[@TheNguyenben85]

hellloooooooooooooo

[@nicoleenesse]

Hi

[@oculusisnevesis5079]

All women, move to GRC please. Gonna make Companies way safer

[@Aquilasdev]

GTFO of here with your sexism

[@xi5lv]

Hi Nicole. I’ve message you on LinkedIn regarding your program. I’m looking forward to hearing from you soon.

[@emmanuellaasare5695]

Hi Nichole, can I reach out via email for some tips and advice?

[@nicoleenesse]

Sure

[@NeoKurow]

GRC is for bla bla bla women and Technical for real men! (Grabs flame shield)

[@lycan2494]

?????