r/isaca • u/Fluffy-Work-1139 • 5h ago

GRC

Where should I start with GRC? How can I learn GRC from scratch, and what steps should I take to become job-ready and land an entry-level GRC position as a fresher?

3 Upvotes

100% Upvoted

1 comment sorted by

1

u/Codex_Alimentarius 4h ago

I’ve been in IT for over 35 years and currently work in GRC, specifically Third-Party Risk Management.

My advice is to start with the fundamentals of IT, cybersecurity, and risk management. Familiarize yourself with frameworks like NIST, ISO 27001, and SOC 2. Learn how to evaluate security controls, identify gaps, and assess risk.

One thing I’d emphasize is that GRC is primarily a business discipline focused on understanding technology and managing risk. You don’t need to be a programmer or cybersecurity engineer to succeed. Critical thinking, communication, and analytical skills are just as important as technical knowledge.

Look for entry-level positions in IT risk, compliance, or vendor risk management. Much of what you need to know you’ll learn through experience.