GRC Careers

If you've been in a vendor security review, an RFP response, or a board risk conversation about AI in the last two years, there's a decent chance someone has said the words "NIST AI RMF" without explaining what it actually is. This post is that explanation.

It's been a little over three months since my last post. The silence wasn't intentional. I've simply been focused on doing the work. Over the past few months, I've been investing heavily in strengthening my cybersecurity governance, risk, and compliance capabilities—not just through study, but through practical application. On the certification front, I successfully earned the CompTIA CySA+ and ISACA CISM, while also completing training in PCI DSS v4.0. Each of these has deep

The GRC crossroads New year, new goals. If you’re trying to break into Governance, Risk and Compliance (GRC), your feed is probably full of “bootcamps,” “mentorship programs,” and “job-guarantee” offers right now. Some are genuinely helpful.Too many are not. I learned that the hard way. My GRC Training Mistake: Paying for Promises Sometime ago, I paid for a GRC “program” that I was told would: Teach me everything I needed to know Connect me to hiring managers Provide mentorsh

When people hear “GRC”, it often sounds like something only big banks and giant tech companies care about. The full phrase, Governance, Risk and Compliance, can feel heavy and academic. But in real life, GRC is simply:“How we decide, what we worry about, and how we follow the rules.” In this post, I’ll break down what GRC really means in practical terms and share a simple, step-by-step way to start doing GRC in any organization, even if you’re just one person.

If you had met me a few years ago, you probably wouldn’t have guessed I’d end up in cybersecurity and governance, risk and compliance (GRC). I started my career in sales, not in tech. I was more familiar with targets, territories and trade promotions than with risk registers and ISO standards. But looking back, every step in my journey quietly pushed me toward GRC and cybersecurity—even when I didn’t realize it.

Plain-Language GRC Glossary v1