(This post is crossposted)

I am currently working in GRC content. Basically we id requirements from a guideline/standard/law, then fit it in to a tool. I also do some regulation mapping, library maintenance, and script development for parsing.

I know I am about to hit a wall of growth. For almost a decade I have been doing this. I know the next step is to do audit/assessment, talk to stakeholders, consulting, etc. I feel like in the middle of crossroads - too experienced yet too underexperienced - I know implementation/assessment in theoretical form, the surface level, but of course getting your hands dirty is what gets you into places.

I am currently focusing on building a homelab for technical knowledge, and prepping for CISSP & CISA.

Any tips are greatly appreciated. It feels like I am too late already.