While some cybersecurity jobs are all about technology, the role of a risk and compliance cybersecurity specialist is clearly focused on business risk and regulatory safeguards.
This job sits under a company’s GRC umbrella (governance, risk, and compliance) and provides a critical function for the business. Depending on the organization, requirements may include SOX, PCI DSS or HIPAA, and the need to show auditors how they’re meeting them. Having someone monitor compliance, identify gaps and help mitigate risk is really important.
According to recent dataOpens a new window from Robert Half International, this is one of the fastest growing, most dynamic sectors in the IT workforce. For insights on how much this role is in demand, and what makes for a strong candidate, I spoke with Caitlin Wehniainen, president of staffing firm On Cue HireOpens a new window; Jon Hill, chairman and CEO of recruiting firm The EnergistsOpens a new window; and Kanani Breckenridge, CEO and ‘headhuntress’ at San Diego-based recruiting firm Kismet SearchOpens a new window.
Let’s explore the core responsibilities, hiring demand trends, essential skills, and rewards shaping the rapidly growing career path of a risk and compliance cybersecurity specialist.
What does a risk and compliance cybersecurity specialist entail
Your full responsibilities may differ slightly by industry. But they will primarily focus on identifying cybersecurity risks to corporate IT and operational technology systems, preparing for regulatory audits, documenting compliance, and developing and monitoring security controls. In many sectors, a security failure can impact operations and reliability, which makes these roles especially important.
Current hiring trends
When it comes to the role of a risk and compliance specialist, you’ll find yourself in strong demand in the GRC sector right now, because risks keep increasing and the penalties for noncompliance can be significant. The function will remain necessary, especially for companies handling sensitive information or working in regulated industries. However, the hard truth is that just because companies need this role doesn’t mean they’ll hire more people to do it.
As with some other cybersecurity roles, AI and new tools can help monitor controls, gather evidence, and flag compliance gaps. More of the work will no doubt shift toward owning those tools, validating what they find and investigating issues. Candidates who can use the technology while applying their judgment will be better positioned.
Ideal candidates combine strong technology skills with equally strong business insights. That combined need often drives organizations to seek out recruiting firms to handle the search.
You’ll find a few industries to be best bets for hiring demand. In the energy sector, demand is strong and should remain strong. The increasingly connected IT and OT environments in energy companies, combined with growing regulatory expectations, creates a continuing need for people who can make sure cybersecurity requirements actually translate into day-to-day operations.
“I do anticipate that demand will become more specialized in coming years,” Hill says. “Energy companies want professionals who understand their particular regulatory environment and operational realities. Professionals who combine cybersecurity expertise with energy-sector knowledge will likely see an especially strong market for the foreseeable future.”
What makes the risk and compliance cybersecurity specialist role appealing
Perhaps your greatest reward in this job is knowing you help prevent problems that could have a significant financial or reputational impact on the organization. You also get to work across departments and understand how the company operates, which can be rewarding for someone who enjoys connecting the dots and solving problems.
As far as tangible rewards go, salaries typically start at $85,000 and up. There is six-figure earning potential as you gain experience, especially with specialized industry knowledge or responsibility for a larger program. Pay levels differ significantly based on geographic location and experience level, as well as organizational size and the specific field in which the position operates.
If you’ a’re a strong candidate, you also have considerable leverage when it comes to such benefits as bonuses and other incentives, especially when you’re competing against individuals who lack OT, NERC CIP, or critical-infrastructure experience.
Preferred backgrounds and experience
As far as experience that you should have for a risk and compliance specialist, IT audit, cybersecurity, risk management, and compliance are strongly preferred backgrounds. IT support or operations experience can also be valuable because you understand how systems and controls work in practice.
Employers also look for candidates who have worked across business functions. If you’ ha’ve worked with security engineers and can also sit down with legal or executive teams, that makes you much more valuable than someone who only understands one side of that equation.
Key technical competencies encompass security controls, identity and access management, vulnerability management, incident response, network security, and security monitoring. Across certain sectors, expertise in operational technology, industrial control systems, and the distinctions between IT and OT security can set professionals apart.
On the business side, you should be skilled in risk assessment, regulatory interpretation, policy development, audit preparation, and documentation. Communication is also highly valuable since you’ll often need to explain technical vulnerabilities and make a compelling business case for addressing them.
Top skills and traits for the job
For a risk and compliance cybersecurity specialist, the personal traits that guide your choices and behaviors matter just as much as your technical expertise.
You’ll do well if you can boast strong attention to detail, integrity, curiosity and follow-through. Being able to present bad news or negative news to higher ups with urgency is not easy for most people. You should be willing to ask questions and speak up when something doesn’t add up.
Being approachable while holding people accountable is also important because you’ll depend on different teams for information and action. An effective risk professional questions whether controls truly work rather than simply trusting policy documentation. You must examine your assumptions critically and gain genuine insight into how your organization actually operates.
Certifications can help set you apart as a strong candidate. CRISC is relevant for IT risk and controls, CISA for auditing, and CGRC for governance, risk, and compliance. CISM can also be valuable for those moving toward security management. Choose the one best for you based on the work you want to do and what employers require.
While the certifications can help, you still need to explain how you’ve applied that knowledge to real situations. There are also several organizations like ARMA you can join to help you network in the field.
Beyond certifications, perhaps your best steps to succeed in this role are to learn the business, build relationships across departments, and be willing to address problems directly. Whatever else you do, you’re advised to be a continuous learner.
Do you still have questions? Head over to the Spiceworks Community to find answers.Take me to Community
