Does GRC Belongs Outside Security? The Case for an Independent Second Line ft Charles Nwatu - GRC... скачать в хорошем качестве

Does GRC Belongs Outside Security? The Case for an Independent Second Line ft Charles Nwatu - GRC...

What if GRC shouldn’t sit inside Security at all—and what if the bigger problem isn’t automation, but what you do after you automate? In this episode, Raj Krishnamurthy (  / rajkrishnamurthy  ) sits down with Charles Nwatu (  / cnwatu  ) (former Security GRC Engineering & Assurance leader at Netflix) for a candid, systems-level conversation about why “annual audit rituals” fail modern engineering, how GRC can produce high-fidelity signals that strengthen security decision-making, and why the next wave of GRC engineering is about analytics, specifications, and business impact—not just speeding up evidence collection. Key Takeaways: • GRC is a continuous discipline—point-in-time compliance can help, but it can’t be the end state. • Automation is necessary but not sufficient: the real value is in turning collected evidence into actionable insights. • Specifications enable measurement—without clear expected behaviors, security metrics become inconsistent and hard to compare. • GRC can feed security with high-fidelity signals (like identity/access review metadata) that improve posture beyond audit readiness. • Third-party risk doesn’t “finish”—the goal is visibility, data lineage awareness, and making the mess less messy.  What You’ll Learn: • Where Charles believes GRC should sit org-wise—and why Security should be a “customer” of GRC • What “shift-left GRC” looks like in practice (beyond annual audits) • Why “efficiency savings” don’t automatically equal “security value” • How to think about metrics, specifications, and risk in a shared language • Why third-party risk management is “unsolvable,” and how to build guardrails anyway This podcast is brought to you by ComplianceCow (https://www.compliancecow.com/) — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.com (https://www.compliancecow.com/) Watch more episodes: https://www.compliancecow.com/podcast (https://www.compliancecow.com/podcast...) Connect With Our Guest: Charles Nwatu | GRC Engineering Leader Connect on LinkedIn:   / cnwatu   Rate, review, and share if you enjoyed the show! Subscribe to Security & GRC Decoded wherever you get your podcasts: Spotify: https://open.spotify.com/show/5pigcMw... Apple Podcasts: https://podcasts.apple.com/us/podcast...