TJ, Kendra, and Elliot are back, and welcomed Evan Millman, GRC Manager at Abnormal Security, for what started as a casual chat and evolved into a sharp look at compliance blind spots, the role of AI in GRC, and how professionals can shape their careers in a changing field.
[00:02:00] Evan shares how he used ChatGPT to analyze a risk assessment report.
[00:05:00] What GRC leadership looks like at Abnormal Security (ISO 27001, 27701, 42001, SOC 2).
[00:07:00] The complicated relationship between organizations and auditors — bias, incentives, and the reality of “clean” reports.
[00:12:00] Why third-party attestations are table stakes, not real assurance.
[00:19:00] TJ and Evan debate solutions: peer reviews, government oversight, or is the system fundamentally flawed?
[00:27:00] How Abnormal approaches vendor risk: criticality ratings, renewals, and compensating controls.
[00:32:00] Tools and automation in GRC — benefits and buyer’s remorse.
[00:36:00] The role of AI: evidence review, documentation search, and “trust but verify.”
[00:39:00] Should GRC professionals become coders, or double down on soft skills?
[00:44:00] Evan’s career advice: networking, persistence, and why soft skills matter more than technical depth.
","author_name":"Chaos"}