The GRC Engineering Club's AntiCheckBox Podcast

Dr. Omar Sangurima
  • 5.0 (1)
  • Management

Compliance became a documentation ritual somewhere along the way. Screenshots, spreadsheets, a scramble every quarter, and a piece of paper at the end that tells you almost nothing about whether the control actually works. That job is getting automated out from under the people doing it, and good riddance. The AntiCheckbox Podcast is about the other version of this work. Controls as a data and engineering problem. Evidence that generates itself. Governance you can defend to a regulator, a board, or a plaintiff's attorney because the system produces the proof, not because somebody filled in a cell. Every week we sit down with the practitioners actually building this way. Auditors who got tired of asking for screenshots and learned to write code. Engineers who got handed a framework and refused to accept that it had to be miserable. The people writing the standards, the people running programs at scale, and the ones who lived through the audit that changed how they think. No vendor pitches. No certification worship. No pretending the current model is fine. If you work in GRC, security, risk, audit, privacy, or you are trying to get into any of it and cannot get a straight answer from anybody, this is for you. The show is the front door to the GRC Engineering Club, a community of practitioners doing this work in the open. Early episodes, the Slack, and The Convergence newsletter live at patreon.com/c/GRCEngineeringClub.

  1. 1d ago

    The Revenge of the Generalist, Breaking Silos, & Data-First AI Governance | Guest: Fred Descloux

    Fred Descloux has spent almost two decades moving across audit, compliance, security, and privacy, and he would not have it any other way. In this episode of the Anti-Checkbox Podcast, we sit down with Fred - security and privacy leader at Nu Skin, CISSP, and proud generalist - to talk about the revenge of the generalist: why versatility is career insurance when deep expertise gets automated, how generalists break the silos between legal and engineering, and why the translator is often the most valuable person in the room. We also get into what starting at Deloitte and spending ten years at EY teaches you about curiosity, and why every AI governance program still stands on unglamorous data governance: data flows, an inventory of use cases, and clear rules for use. The GRC Engineering Club is where we leave the corporate stiffness at the door and have real, unfiltered conversations about building resilient systems. We believe in lifting as we climb. Subscribe for more tactical insights, open-source discussions, and career advice.

  2. Oct 25

    Compliance Drives Revenue. Here's What to Count | Guest: Laura Sawka

    Compliance can drive revenue. Laura Sawka, founder and GRC executive of Sawka Advisory Group, says it is possible in the first two minutes, then lays out how to measure it. Laura led GRC globally at a Fortune 500 company and started her career at a Big Four firm. Today she helps companies transform their GRC programs so they scale and strategically support the business. Her case runs on two paths. The direct one: a certification or regulatory requirement is your ticket into a market, and once you have it, every customer in that market can buy. The indirect one: customers renew because they trust you, and a lot of that trust is built from your SOC report, your ISO report, your trust center and the questionnaires you answer. She is upfront that some of this is a straight line to revenue and some of it is "we enabled" or "we influenced." From there Omar asks where the checkbox reputation comes from. Laura ties it to GRC being treated as a cost center, and argues that requirements exist to reduce risk, so the work is integrating them into policy, controls and monitoring instead of proving compliance at a single point in time. We also get into AI and the wave of overnight GRC experts, why telemetry has to come before any AI answer, and why the breadth of GRC across the business is a strength. KEY TAKEAWAYS Compliance opens markets. A certification or regulatory requirement can be the only thing standing between real demand and a closed deal. Renewals are revenue. Your reports, trust center and questionnaire answers build the trust customers keep paying for. Track it: report downloads, questionnaires tied to deals, meetings that support new business or renewals, and contractual commitments. The checkbox reputation comes from being treated as a cost center with unclear business value. Policies reviewed once a year and risk assessments left on the shelf are the checkbox approach. Policies as code, monitored controls and risk assessments that drive investment are the alternative. If you know a system's availability, you should know the same about your controls. AI does not replace your GRC person. It should augment GRC so practitioners can be better advisors to the business. Without telemetry and continuous monitoring, an AI answer is not an answer. That is where hallucinations come from. Durable skills come first: communicating in business terms and influencing action. Pair them with an engineering mindset. Stakeholders who stall usually have competing priorities, not indifference. Find where their priorities and yours meet. GRC sees the whole organization. Use that data to influence architecture: streamline, share services and cut duplicate controls. FIND LAURA SAWKA Sawka Advisory Group: https://www.sawkaadvisorygroup.com LinkedIn: https://www.linkedin.com/in/laura-sawka/

  3. Oct 18

    Why GRC Communities Win In Person | Mashup w/ Abdie Mohamed

    Abdie Mohamed, president of the GRC Engineering Club, joins Dr. Omar Sangurima for the monthly mashup. His case is simple: a community is stronger when its members actually meet in person, and the last two months are the receipts. Two new partnerships, the club's biggest event turnout yet, a new Academy certification, and the plan for FedRAMP Month and AI Governance Month. It starts with the partnerships. After SCF founder Tom Cornelius came on the show, the Secure Controls Framework invited the club to contribute to its framework update, and club members did. SCF also extended a member discount on its certifications. Then a new collaboration with the Third Party Risk Association, and Abdie flips the script and puts Omar in the guest chair to explain why. After a decade in third party risk, Omar makes the case for pairing traditional risk management with active third party threat hunting. Then San Diego. Around the ISACA GRC Conference in August, the club ran its first Run GRC 5K, a networking mixer, and the AntiCheckbox Museum in the Gaslamp Quarter. Abdie and Omar get into why the experiments keep working: chapters that stood up fast with branding and materials from day one, a 5K that sounded like a strange fit for a GRC community until it caught on, and a Slack where nobody has had to be policed for language. Abdie is also direct about what the club does not promise. No one is promised a job. The promise is a place to learn, grow, and build real skills. CHAPTERS 0:00 Two months of GRC Engineering Club news 0:35 How the Secure Controls Framework partnership happened 2:32 Club members contribute to the SCF framework update 4:46 Cracking 9,000 members 5:14 San Diego and the first ever Run GRC 5K 7:11 The networking mixer and the AntiCheckbox Museum 9:14 Why the club keeps running experiments 10:21 How a chapter stands up fast 12:36 The Third Party Risk Association collaboration 14:00 Omar on third party threat hunting 16:00 What a club membership actually gets you 17:13 CGE-AZ, the first specialty certification 18:40 Nobody is above learning, and the DC trip 21:49 Why it is still $9.99 a month 22:50 FedRAMP Month, Paramify, and AI Governance Month 25:01 Run GRC heads to DC and New York 26:36 Learning from the smartest people in the room 28:41 What the club does not promise 29:53 Chapter leadership and the New York meeting 31:50 The access that comes from showing up KEY TAKEAWAYS CGE-AZ, the Azure Specialty, is live in the Academy. It requires the CGE-P. Every Academy certification is included with club membership at $9.99 a month. The Academy roadmap includes AWS and GCP specialty tracks, an Associate level, and a Pro level. October is FedRAMP Month, focused on FedRAMP 20x. November is AI Governance Month. Meeting in person changes how people treat each other online. The club Slack has never had to police anyone's language. Nobody is above learning. Twelve years into cyber, Omar is still picking up new tricks from club members. MENTIONED IN THIS EPISODE Secure Controls Framework: https://securecontrolsframework.com Third Party Risk Association: https://www.tprassociation.org Paramify: https://www.paramify.com FIND ABDIE MOHAMED LinkedIn: https://www.linkedin.com/in/abdie-mohamed-3a8684140/

  4. Oct 18

    GRC Is Broken. The Buyer Is The Bigger Problem | Guest: Jake Bernardes

    Jake Bernardes has said publicly that GRC is broken, and he still stands by it. What changed is who he blames. Jake started as a pen tester at KPMG, was CISO at Anecdotes, where his team took the company through FedRAMP 20x Moderate, and now works on cyber resilience at Gambit Security. After time on both sides of the table, he thinks the bigger problem is the buyer. Most vendors can't produce real evidence of their compliance posture, and the ones who can usually won't, because an honest SBOM shows which packages nobody is patching. But hand most buyers a live JSON file of that posture and they don't know what to do with it. They want the questionnaire, the dropdowns and the re-attached policies. Jake's explanation: a yes or no answer keeps the liability on the vendor. Real evidence forces the buyer to make a risk based call, and then they own it. From there we get into third party risk. Jake rebuilds a TPRM program from the outcome backwards and ends up leaving 80 percent of his vendors off the list entirely. We pushed on the obvious problem: what happens when one of the 80 is the one that burns you, and the board wants to know why nobody looked? His answer is in the episode. KEY TAKEAWAYS A yes or no questionnaire keeps the onus on the vendor. Real evidence moves the risk decision, and the ownership of it, to the buyer. Many vendors won't share live compliance evidence for fear of what it shows and how it could be used against them later. Anecdotes treated compliance as an engineering problem: APIs, integrations and automations until a single pull returned the company's full compliance posture as one JSON file. Three things have to change: regulators holding CISOs to a stricter standard than marketing, sales or HR, market signals from FedRAMP 20x and Fortune 100 buyers demanding live data, and CISOs who are more technical about how evidence is produced and braver about showing it. Build TPRM from two questions: can this vendor get my data into trouble, and what happens to me when they go down? Map your minimum viable business. Vendors inside it that consume personal data are critical. Vendors that only keep it running are high. Jake leaves everyone else off the list. For the vendors you keep, assess for real: the audit report before remediation, the tickets behind the gaps, three months of AppSec findings and how they closed. Align every tool, contract and service to a named risk. If it maps to nothing, cut it at renewal. If a risk maps to nothing, fund something. The skill most people breaking into GRC are missing is outcome focus. Start with the result and work backwards. Find out what the person who pays your salary gets paid on, then tie your goals to it. The market changes. The process for getting hired doesn't. FIND JAKE LinkedIn: https://www.linkedin.com/in/jakeleobernardes/

  5. Oct 3

    AI Agents Will Use Every Permission You Give Them | Guest: Dan Barahona

    AI agents will use every permission you give them. Dan Barahona co-founded APIsec University and built it to more than 150,000 students. Now he runs AI Security University, where every course is free. On this episode of the AntiCheckbox Podcast, he makes the case for managing agents like employees, then names the place that comparison breaks: agents have no judgment. We start with the basics for anyone newer to the field. What an API is, and why Dan says we are not in a post API world but a hyper API world. APIs now have a new consumer, and it can press the same button ten thousand times. From there we get into permission creep, how shortcuts taken while vibe coding on a laptop end up in production, and why a guardrail that has to hold cannot live inside a model that is nondeterministic by design. Then the part that lands on GRC and third party risk. We vet vendors with pen test results, ISO certifications, and SOC 2 reports. An agent skill is instructions written in plain English. What is your review process scanning for there? Dan also makes the case for AI literacy beyond the security team, for the HR, finance, and operations staff who can now connect tools in seconds. KEY TAKEAWAYS We are not in a post API world. AI agents are a new consumer of your APIs, and they do not behave like people. Manage agents like employees: onboard them, credential them, monitor them, review them, and fire them when they fail. Agents have no judgment. A person handed excess permissions may never touch them. An agent will use all of them. Permission creep often starts on a laptop. Hard coded keys from a local prototype ship to production with the tool. Telling a model not to do something is not a control. A guardrail that has to hold belongs outside the model. Security teams should be the earliest adopters, so they understand a tool before the business asks to use it. An agent skill is plain English instructions. Vendor due diligence built around code and attestations does not cover it yet. AI literacy is everyone's job now. Shadow AI, data pasted into prompts, and meeting note takers are everyday risks. The EU AI Act requires organizations that provide or deploy AI to take measures supporting AI literacy for their staff. When an employee causes harm, ask where the protections, monitoring, and training were before blaming the employee. If it goes out under your name, it is your output, no matter which model wrote it. Match your review to the stakes. Free training can be sustainable. AI Security University keeps courses free for students and funds them through corporate training. FIND DAN BARAHONA LinkedIn: https://www.linkedin.com/in/rdbarahona/ AI Security University: https://aisec.university Free courses: https://aisec.university/courses Dan's site: https://danbarahona.com #AISecurity #GRCEngineering #AIGovernance #AgenticAI #APISecurity #ThirdPartyRisk #Cybersecurity #GRC #AntiCheckbox

  6. Sep 26

    Cybersecurity Doesn't Have An Interest Problem. It Has An Entry Problem | Harsh Kashiparekh

    Cybersecurity does not have an interest problem. It has an entry problem. Harsh Kashiparekh, founder of Securis360 and a former PwC risk and compliance consultant, built Securis Academy around that gap. His model goes straight to the security vendors, asks for not for resale seats on their platforms, and puts those seats in front of students at community colleges and universities before they ever apply for a job. Josh Mason, former Air Force pilot and founder of Noob Village at DEF CON, joins for the first part of the conversation with the structural argument. Accreditation requires a school to build a full, fixed path to a diploma, and security content changes faster than that model can serve on its own. Lauren Alex-Igwe co-hosts. She started as an IT auditor and pushes on the catch-22 every newcomer knows: you need experience to get the experience. We also get into the part most training companies would rather skip. How do you keep your compass pointed north in a space full of people selling shortcuts? Josh draws a hard line between two ways of funding this work and names what each one forces you to accept. Harsh explains why his courses are not free, on purpose. He also walks through which schools keep saying no, which ones say yes, and where this goes next, including a corporate version where a company picks its own stack and trains its team on it. One piece of news in this one. Securis Academy is building prep training for the GRC Engineering Club certifications and taking it into the university network it already works with. KEY TAKEAWAYS The workforce gap is an entry problem. People want in. The path in is the bottleneck. Vendors want students trained on their platforms. Twenty not for resale seats for a university is an easy yes for a lot of them. University accreditation locks in a full path. Security content moves faster than that path can be rewritten. Large universities have been slow to let third parties into their ecosystem. Community colleges have been the fastest to say yes. Real environments mix vendors, so training should be tool agnostic too. Consulting firms, including twenty person shops, are the natural hiring pull for students who have already touched the tools. No access to a tool is not a reason to skip it. Learn what the platform does and what its output looks like. New privacy laws are creating demand for privacy roles faster than anyone is training people to fill them. From the buyer side, one place to train blue team, threat intel, and GRC staff on different stacks beats managing five training vendors. FIND HARSH KASHIPAREKH LinkedIn: https://www.linkedin.com/in/harsh-kashiparekh-cisa-a4961528/ Securis360: https://securis360.com Securis Academy: https://securisacademy.com FIND JOSH MASON Noob Village: https://noobvillage.org #CybersecurityCareers #GRCEngineering #Cybersecurity #GRC #CyberSecurityTraining #WorkforceDevelopment #NoobVillage #AntiCheckbox

  7. Sep 20

    The People Getting Recruited In GRC Are Not More Experienced Than You | Guest: Dex Copeland

    Dex Copeland writes the GRC Engineering Club curriculum and runs the live sessions. He also walked into a senior GRC engineering interview, got asked what happens when a policy and the system it governs fall out of sync, and could not answer it. He did not get the job. Then he went and built the policy as code trainer that club members learn from now. He walks through all of it on this episode, including a ranking that will annoy half of cybersecurity: experience first, certification second, degree last. Lauren Alex-Igwe co-hosts and pushes him on the part most career advice skips. If two people both have real experience and only one of them gets recruited, what is actually different between them? Dex has an answer, and it has almost nothing to do with skill. We also get into where certifications stop working. His position is that a cert says you knew something at a point in time, and if you are not doing the work, the knowledge decays while the credential stays on your profile. He contrasts that with the CGE-P model, where the capstone ships on GitHub, and argues that hands on validation is a wake up call the wider certification industry has not answered yet. That is a pointed thing to say on a channel that runs its own certifications, and he says it anyway. The last stretch goes somewhere we did not plan. Four days at a beach with no desktop, no Claude, no GitHub, and Dex came back with a clear view of what AI governance is actually for. Not the framework. The people who have been doing the work for years and are afraid of what gets built next. KEY TAKEAWAYS Experience ranks first because it is where the friction is. Problem solving, conflict resolution, translating between technical and non technical people. A certification says you passed a test. Experience says you did the thing. The gap between people who apply for jobs and people who get recruited is usually not skill. One of them is better at showing the work in public. Chase certifications without doing the work and the knowledge decays while the credential stays on the profile. Contractors with twenty years on the job are opting out of mandated certs rather than pay to prove something their record already proves. You can tell within minutes whether someone teaching a course actually understands the material or is reading slides they did not write. The strongest signal that someone is ready to be coached is that they struggled first and can say exactly where they got stuck. Failing an interview question is a curriculum input, not an embarrassment. AI should augment the people already doing the work, not build the thing that makes them look replaceable. Transparency and review on AI output is the line between a deliverable and slop. Knowing when to stop is a skill, and nobody building something they care about comes by it naturally. FIND DEX COPELAND https://www.linkedin.com/in/dexcopeland/ CO-HOSTED BY LAUREN ALEX-IGWE https://www.linkedin.com/in/lauren-alex-igwe-18a66816b/ #GRC #GRCEngineering #CyberSecurityCareers #PolicyAsCode #AIGovernance #ComplianceAutomation #CISSP #CareerAdvice #Mentorship #GRCJobs

  8. Sep 13

    Ten Years In GRC Without A Single Certification | Guest: Pradeep Reddy

    Pradeep Reddy went ten years into his career before he pursued a single certification. Twelve years in now, he has spent the last four mentoring people trying to break into GRC and security, and this episode is the closest thing we have published to an operating manual for that, on both sides of the call. His path was not a straight line. STEM, then commerce, then a master's in finance, then IT audit at KPMG almost by accident, third line of defense to second line, and eventually into information security risk management. Nobody along the way told him he needed a lead auditor cert or a CISA to have a career, and one of his early mentors gave him a piece of advice about credentials and careers that he still repeats. His position on learning is that it counts in any form. A podcast, a YouTube playlist, an article, somebody's LinkedIn timeline, a breach report you read closely enough to understand the root cause. What makes this one useful is that he has actually built a process. There is an intake step before the first call ever happens. There is documentation, because he ran it as a loose series of calls for a year and it did not work. There is a hiring calendar most people ignore. And there is a hard line on what a mentor can and cannot promise you, which is where we pushed him hardest. KEY TAKEAWAYS Why he asks for a set of answers in writing before the first mentoring call, and what those answers tell him. The thing that makes him tell somebody they are not ready yet. It is not skill level. Why he stopped running mentorship as a string of calls after a year of it not working, and what he replaced it with. The hiring calendar. Why January and February are slow, why March is the real deadline, and how far ahead of it you need to start. Using the NIST NICE framework to mentor. Start from the role somebody wants, work backward to the skills that role actually requires, and stop re-teaching the basics they already have. His pitch to employers: alongside the performance manager who evaluates you, put somebody whose only job is guidance, and the difference between advice from 30,000 feet and advice from 1,000 feet. How to spot a mentorship program that is working you. He is generous about it. We were less generous. What he says to anybody who asks him for a job guarantee, which is shorter and blunter than you would expect from him. Why he corrects people who say cybersecurity when they mean information security, and why that distinction matters on day one. What he actually gets out of mentoring. His answer is about a generational shift and it is not the answer most people give. FIND PRADEEP LinkedIn: https://www.linkedin.com/in/infosecpradeep/ #CyberSecurityCareers #GRC #Mentorship #GRCEngineering #AntiCheckbox #CyberSecurity #InfoSec #CareerChange #ITAudit #NICEFramework

See All (16)

About

Compliance became a documentation ritual somewhere along the way. Screenshots, spreadsheets, a scramble every quarter, and a piece of paper at the end that tells you almost nothing about whether the control actually works. That job is getting automated out from under the people doing it, and good riddance. The AntiCheckbox Podcast is about the other version of this work. Controls as a data and engineering problem. Evidence that generates itself. Governance you can defend to a regulator, a board, or a plaintiff's attorney because the system produces the proof, not because somebody filled in a cell. Every week we sit down with the practitioners actually building this way. Auditors who got tired of asking for screenshots and learned to write code. Engineers who got handed a framework and refused to accept that it had to be miserable. The people writing the standards, the people running programs at scale, and the ones who lived through the audit that changed how they think. No vendor pitches. No certification worship. No pretending the current model is fine. If you work in GRC, security, risk, audit, privacy, or you are trying to get into any of it and cannot get a straight answer from anybody, this is for you. The show is the front door to the GRC Engineering Club, a community of practitioners doing this work in the open. Early episodes, the Slack, and The Convergence newsletter live at patreon.com/c/GRCEngineeringClub.

Information

You Might Also Like