GRC Certification Roadmap v1.0: Recommended Training and Certs #cybersecurity #grc

// MAIN POINTS //
🎓 Education is only 10% of a Career Development Plan, but the bottom line is that certs have value because hiring managers prefer certified candidates
📚 The beginner level (year 1) focuses on foundational knowledge
💼 The intermediate level (years 2-3) is about becoming an independent consultant and leader
🪡 The roadmap is an illustrative example and can be tailored to individual needs and goals

Feedback on the roadmap is welcome. Views expressed are my own.

// REFERENCES //

#cybersecurity #career #grc #CareerAdvice #CareerGoals #ProfessionalDevelopment #JobSearch #CareerGrowth

[Fencelete]

Great roadmap! Security+ was my first cert and changed the trajectory of my career. In years 2-3, I recommend getting one or both of the Cloud Security Alliance certifications, Certificate of Cloud Security Knowledge (CCSK) or Certificate of Cloud Auditing Knowledge (CCAK). Most of the auditing and GRC work is oriented toward cloud-hosted environments, so understanding the cloud, specifically the shared responsibility models, and how to audit the cloud is important.

[cpatocybersecurity]

I look forward to crowdsourcing answers to these questions at GRC Study Hall tonight, with Chris Whitlock from the Simply Cyber community. Here's another one I received: "I want to pursue my career in GRC Auditing. But I am confused about the certifications in Auditing. I have knowledge of cybersecurity and penetration testing and also have experience in that. For Auditing we have iso27001 LA but if I go with PECB or BSI, then the certification is costly. But there is one more provider SKILLFRONT, which is cheaper. Can you tell me if I can go with skillfront certification or not."

[JustAGrl]

This was a really good roadmap breakdown. Thank you!

[MK-obzy]

Valuable info, what do you think about CRISC certification ?

[JuanMartinez-nhni]

My concern is gaining an experience actual work in the field as a being inner so far, I’ve done the simply cyber grc master class and currently taking a Google cert on grc .

[gritred]

Ok, so the job postings will name Isaca certs but job postings seem to always say “or other equivalent” so I decided I should (and I did) get the CCSK certification and open book or not it was difficult do pass. Note the questions where written (maybe Europeans communicate differently than US and therefore it adds a language disconnect?).

Also, i took two udemy classes for cloud and got through the AWS practitioner certification previous to the CCSK and this was great because the CCSK material is in there and CCSK reaffirmed (shared responsibility model etc). The cloud knowledge was key in helping me get straight all the tech involved such as monitoring, backing up, least privilege, siem, edr…

HINT: You missed software as a possible route such as becoming an admin for something such as Service now or Archer??

I feel that after the AWS cloud Practitioner and CCSK I was ready to see the practical workaday stuff and took the GRC masterclass which his stream of consciousness way of instructing was perfect to let me see how a seasoned GRC professional completes audits and risk assessment etc.

[Cybera]

Thank you for this wealth of information, I will be using it. I completed my Security+ training in February and afterwards completed a GRC mastery course by Unixguy on youtube. I was looking to take the IT Risk Fundamentals exam by ISACA as it seemed like a cert I qualified for as someone with no IT experience. Do you think it will be worthwhile to pursue?

[mauricecioccato]

Nice video, thanks for the video, after sec and Net+ Comptia and GRC certification, which roadmap Do you suggest for becoming Data loss prevention analyst?

[AdelSnow]

what do you think about the grc mastery by unixguy compared to the simply cyber master class in terms of getting knowledge directly transferable 1:1 to the job and interview success

[bryan]

I know it's not security, but would having the CCNA cert and a little experience in networking be a not too difficult of a transition to GRC, instead of the networking career path? Sorry if the question is too vague.

[DallasFort]

just curious to know why did you not just transfer over into data analytics with your professional background and credentials

[cyberaddict]

is experience in cloud security important?

[Fayobi]

hi, thank you for your video. I am based in the UK, I have no experience in cyber security and/or IT, but I want to change careers and I believe i have transferable skills for GRC roles. Is this roadmap suitable for UK residents? if not, could you please advise on a road map for uK residents, thank you.

[SymonsChasel-fw]

Jones William Young Kevin Lewis Anthony