The GRC Podcast

I’ve hesitated to post this because I’m well aware of the social implications. The term 'bullying' is often overused, and I've worried that discussing it might come across as whining, playing the victim, or unfairly throwing someone under the bus. But it’s important to talk about. Workplace bullying is often subtle—it's a slow, insidious process that can go unnoticed. It’s not overt actions (think cheesy HR training video) but small infractions that, over time, can erode your confidence and make you question reality. Unfortunately, I didn’t trust my gut early on, and I learned the hard way that these feelings should never be ignored. Anyone can be a victim, and it’s crucial to protect yourself from the start. Document anything that feels off—screenshots, timestamps, notes. It’s a minor inconvenience if you’re wrong, but if you’re right, it will be invaluable. One of the most effective defenses is to follow up on conversations with emails that confirm the agreed-upon path forward. I wish I had done this because it could have removed the "your word vs. mine" element, especially in situations with a power imbalance. When you're dealing with someone who doesn't have your best interests in mind, a lack of documentation usually leads to conflicts being adjudicated in alignment with the existing power structure—meaning the leader’s perspective is often favored over that of an individual contributor or lower-level manager. Get as much as you can in concrete, undeniable terms to protect yourself. If you seek clarity on something and they refuse to confirm or correct your follow-up, that refusal itself can help demonstrate that the issue isn't on you but on the leader. It's essential to make your efforts undeniable and show that any friction or obstacles are due to the other person's intentional action or inaction. This approach not only shields you but also makes a strong case for your diligence and integrity. Lastly, be aware that if the behavior doesn’t target a legally protected class, companies may be hesitant to take strong action. I don’t fault them for this, but it can be difficult to balance logic and emotion when the outcome doesn’t align with the level of accountability or justice expected. Try your best to not let it discourage you. Focus on what you can control—your work and your growth. Excellence is always the best response. If this has happened to you and you need to talk, rant, or get a sanity check, please reach out—I’m here to share my experience, offer suggestions, and provide insights that might help you navigate this challenging situation.

I've been exploring the use of graph databases like Neo4j for governance in GRC programs, where traditional methods like Word docs and spreadsheets clearly just don't cut it anymore. Graph databases clearly visualize the intricate relationships between authorities, directives, policies, standards, controls, and evidence—mirroring our (usually undocumented) mental maps. The real-time, dynamic navigation and visualization of these connections in graph databases definitely offer advantages over traditional document-based linking. I’m feeling optimistic about this approach so far, and keeping my fingers crossed it can create some efficiency. Has anyone else tried this approach in their GRC processes? I'd love to hear about your experiences—what worked and what didn't?

I’m more worried about the likelihood and impact of jacked up Okta configurations in my company’s own app instance than I am about Okta, the company, being breached (and given their recent track record, that’s saying something) You use a vendor, you assume the risk. - If a vendor directly impacts your revenue, have a back up plan. - If a vendor stores critical data, determine how to limit blast radius during implementation. - If a vendor gives you concerns, redline contracts or pick someone else.

“I have hobbies,” I lie to myself, while working on projects that are directly related to my 9-5. Feeling burnt out? Pick up a hobby entirely unrelated to work, earning, or self-improvement. The only goal is enjoyment. Last month, I purchased a Game Boy Color for a hit of nostalgia. After seeing some photos of some modded consoles, I decided to try my hand at it. It’s been almost therapeutic.

Happy Monday, Comrades. :salute: