I want to make sure the free resources I add here are actually useful, not just more stuff to scroll past. What certification are you focused on right now, and why? It could be CISA, Security+, CISSP, CRISC, ISO 27001, or something else. Drop the cert and your reason in the comments. I’ll use the responses to decide which certification guide, study plan, or practical resource I build next.

Howdy y'all! Look below for some open roles. Four new roles cleared the filter. Cloud for Good is the strongest traditional GRC opening. TIAA is the best true entry-level opportunity because it requires no prior experience. Broadridge is a clean 1-3 year TPRM role. Rose International is a solid contract option for someone with about 3 years of risk experience. 1) IT GRC Analyst | Cloud for Good - Location: Remote, US or Canada | Up to 30% travel - Salary: Not listed in the verified posting - Experience: 2+ years in GRC, IT compliance, or security operations - Skills: SOC 2 Type I/II, audit evidence and auditor coordination, vendor and penetration-test management, security questionnaires and due diligence, risk registers and security policies - Why it matters: This is a strong early-career GRC role because you would own real SOC 2, customer assurance, vendor risk, policy, evidence, and remediation work instead of just supporting one narrow compliance process. - Apply: https://www.linkedin.com/jobs/view/it-grc-analyst-at-cloud-for-good-4458273622 2) 2027 Early Talent Rotational Program: Audit, Risk & Compliance | TIAA - Location: Charlotte, NC | Hybrid/in-office - Salary: $28.22-$35.53/hour - Experience: No experience required - Education: Bachelor's degree required - Start date: July 2027 - Skills: Audit program execution, risk and compliance operations, regulatory assessments, governance reporting, process and procedure documentation - Why it matters: This is one of the better genuine break-in opportunities because the 24-month program provides up to three rotations across Audit, Risk, and Compliance with no prior professional experience required. - Apply: https://careers.tiaa.org/2027-early-talent-rotational-program-audit-risk-compliance/job/74F263FAFF1ECA82A9334779057BF8B8

October 1, 2026 Starting a weekly roundup here of GRC, AI, and cybersecurity updates worth understanding. I’ll include the sources and what I’d pay attention to in the actual work. 1) CISA is changing its vulnerability updates CISA announced September 28 as the retirement date for its weekly Vulnerability Bulletin, part of a shift toward risk-based vulnerability prioritization. My takeaway: If your vulnerability process depends on a weekly email or a severity score, review it. Can you explain which affected systems matter most, who owns remediation, and what evidence supports closing a finding? Source: CISA bulletin notice https://www.cisa.gov/news-events/bulletins 2) Anthropic reports AI being used to coordinate cyberattacks Anthropic’s September threat report describes cases where attackers used AI to execute or coordinate reconnaissance, exploitation, and data theft. Humans still directed targets and reviewed results. The report covers activity from December 2025 through August 2026, rather than attacks that all happened this week. My takeaway: Give your next incident-response exercise a tighter timeline. Test how quickly the team can identify the owner, revoke compromised access, preserve evidence, and escalate. Treat these as vendor-reported case studies, not a measurement of every attacker’s capabilities. Source: Anthropic’s September report https://www.anthropic.com/threat-intelligence-report-september-2026 3) A practical NIST resource to review before October 15 NIST’s draft SP 1353 explores using AI for Cybersecurity Framework analysis and reporting. Released in August, it includes example prompts, simulated company files, and three illustrative use cases. Public comments remain open through October 15. This is draft guidance. My takeaway: This could make a useful portfolio exercise. Use the fictional company materials, generate a draft analysis, then document what you corrected and why. Show your judgment alongside the output.