In the field of cybersecurity, there are many career pathways available for individuals with different backgrounds and interests. One of the most underrated and hidden career pathways is Governance, Risk, and Compliance (GRC). This pathway offers many opportunities for those interested in cybersecurity but do not necessarily want to become a security analyst, penetration tester, or ethical hacker. In this article, we will explore GRC in cybersecurity and discuss its daily duties, skills required, common job titles, and education and certification requirements.
What is GRC in Cybersecurity?
GRC in cybersecurity stands for Governance, Risk, and Compliance. It involves the framework that supports the security goals of an organization set and expressed by senior management and then communicated through all levels of the organization. It also includes assessing and responding to risks, knowing exactly what assets an organization has, and meeting various controls that are enacted by industry or regulatory laws to protect the confidentiality, integrity, and availability of the business.
Daily Duties of GRC Professionals
GRC professionals have different daily duties depending on their job titles, but generally, they work with the security team, IT, and business units to ensure that an organization meets regulatory requirements and is protected from security risks. Some of their daily duties include:
- Identifying, assessing, and managing security risks
- Developing and implementing policies and procedures to ensure compliance with laws and regulations
- Conducting audits and assessments to evaluate the effectiveness of controls and procedures
- Collaborating with various teams to ensure that controls are implemented correctly and effectively
- Providing guidance and training to employees on security policies and procedures
Skills Required for a Career in GRC
To start a career in GRC, you will need to have a foundational knowledge of information technology, operating systems, and computers. You will also need to have a deep understanding of cyber security foundation skills, such as knowledge of rules and regulations. The specific rules and regulations that you need to know in-depth depend on the industry you work in. For example, if you work in healthcare, you need to know HIPAA regulations and ensure that all security controls and policies are in place to comply with HIPAA laws. Other skills needed include:
- Understanding of NIST documentation, such as NIST 800-53 and NIST 800-37
- Knowledge of risk management frameworks, such as Risk Management Framework (RMF)
- Understanding of security controls and how to implement them
- Analytical and problem-solving skills
- Communication and interpersonal skills
Common GRC Job Titles and Salaries
There are different job titles available in the GRC field, and the salaries vary depending on the job title and the organization. Below are some common job titles and their average salaries according to Glassdoor:
- Chief Information Security Officer (CISO) – $250,000 per year
- Compliance Manager – $81,000 per year
- Risk Analyst – $69,000 per year
The salaries listed above are just averages, and they can vary depending on the organization’s size, industry, and location.
GRC Education and Certification Requirements
While many GRC professionals have a degree in computer science, cybersecurity, or a related field, it is possible to enter the field with an unrelated degree, provided you have the necessary skills and certifications. Some of the most popular GRC certifications include Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), and Certified Information Security Manager (CISM). GRC professionals may also seek out advanced degrees, such as a Master of Business Administration (MBA) with a cybersecurity concentration or a Master of Science in Information Technology with a cybersecurity concentration.
Conclusion
In conclusion, GRC or governance risk and compliance is a crucial and often overlooked career pathway in the field of cybersecurity. It involves the development and implementation of policies and procedures to protect enterprise communication systems and assets, as well as meeting various controls enacted by industry or regulatory law. To excel in GRC, one needs to have a strong foundation in information technology and cybersecurity, knowledge of rules and regulations, and familiarity with NIST documentation. GRC roles and responsibilities vary from Chief Information Security Officer to Risk Management Analyst and Compliance Manager, and the salaries can range from $60,000 to over a million dollars a year. By following the steps outlined in the video, individuals can increase their chances of landing a job in GRC and excel in this important career pathway in the field of cybersecurity.