The GRC Engineering Club's AntiCheckBox Podcast

Alan Luk has been on both sides of the audit table, and he came on the AntiCheckbox Podcast with a take that runs against the current mood in GRC. Not everything should get AI'd. And the things that should are about to run headfirst into an audit profession that has not moved yet.

The line most teams are not drawing: there is AI you use to learn and experiment, and there is AI you use to build something the business will actually rely on in an audit. Alan sets loose guardrails for his team specifically so nobody burns weeks on something that was never going to survive a control test.

We also got into Delve, why the blast radius is everybody and not just one vendor, and the uncomfortable check on our own movement. If our answer to every problem is "AI all the things," we are not anti-checkbox anymore. We just built a new checkbox with better branding.

KEY TAKEAWAYS

Separate exploring from producing. Playing with a tool to upskill is not the same as shipping an evidence pipeline the business depends on. Say which one you are doing before you start.

Augment the learning, do not replace it. If you have churned out the same deliverable ten times and your actual knowledge never got deeper, all you got better at was writing prompts. You are still accountable for the output.

Know the questions before your auditor asks them. How deterministic is it. How reproducible. How repeatable. How consistent. How complete and accurate. You cannot spin up an agent to go pull evidence when you cannot say what source system it pulled from.

Control owners are doing this too. AI is showing up inside control design and operating effectiveness, not just evidence collection. That gets assessed on its own terms, and the standard depends on how much certainty that control actually needs.

The burden of proof is on us. Auditors are not going to wake up and announce a new model of assurance.

The Big Four will not move first. Smaller firms are more willing to work with teams heading this direction, and the big firms will feel it when clients walk. But there is a floor, and the race to the cheapest possible SOC 2 is a big part of how we got here.

If it leaves the department, it represents the department. That applies to whatever your agent just generated too.

Alan is one of the few people posting from inside the work rather than above it. This one earned the reputation.

Learn GRC Engineering:
- GRC Engineering 101: https://grcengclub.com/learn/grc-engineering-101
- How to Break Into GRC Engineering: https://grcengclub.com/learn/how-to-break-into-grc-engineering
- GRC Engineer Salary Guide: https://grcengclub.com/learn/grc-engineering-salary
- GRC vs Traditional GRC: https://grcengclub.com/learn/grc-vs-traditional-grc

Website: https://grcengclub.com
Merch: https://grcengclub.com/merch
Patreon: https://www.patreon.com/cw/GRCEngineeringClub
LinkedIn: https://www.linkedin.com/company/grc-engineering-club/

Sunil Karir spent 20 years as an accountant before he ever touched cybersecurity. He got laid off, spoke to a couple of friends, took a handful of entry level courses, and then applied to ten jobs a day, every day, for about four months. When he finally landed an interview at an MSP, he got every single technical question wrong. TLS, the handshake, all the layers, all of it. The hiring manager asked him straight up why he should take him on. Sunil said "why not." He got the job.

That is where this one opens, and it does not let up. We get into the part of a career pivot that nobody posts about: the nights and days learning Fortinet and Juniper on the job while your colleagues carry you, raising your hand for the ISO 27001 re-cert nobody else wanted, and figuring out that the audit brain you built over two decades in finance was the asset the whole time.

We also spend real time on where he and I overlap outside the work. Immigrant parents, the family shop, four in the morning, on time is late, and the question every one of us got handed back with a 70 percent test score: what happened to the other 30. Then the harder part, which is figuring out what to keep from all that and what to leave behind when you are the parent now.

If you are trying to break in, or you are already in GRC and wondering why the screenshots feel hollow, this one is for you.

Key Takeaways

Attitude gets you in the door. It does not keep you in the room. Sunil's take is that talent gets you so far and then the only thing left is outworking the people around you.

The pivot is not a hack. Ten applications a day, every day, at every level, including the ones you have no business applying to. Four months of that before the LinkedIn message that changed everything.

The move that redirected his whole career was volunteering for a compliance project nobody else wanted. He ran an ISO 27001 recert between himself and Google, and found the discipline he actually belonged in.

Certs still carry bargaining power because they give an employer a little reassurance when they cannot evaluate you technically. But do the work before the cert, not instead of it.

Thirty people in his training cohort. Two got jobs in cyber. That gap is not talent.

His closing advice: go learn privacy. GDPR is still the global reference point, it gets you into contract conversations, and it is the substrate underneath most of what is happening in AI governance right now.

Learn GRC Engineering:
- GRC Engineering 101: https://grcengclub.com/learn/grc-engineering-101
- How to Break Into GRC Engineering: https://grcengclub.com/learn/how-to-break-into-grc-engineering
- GRC Engineer Salary Guide: https://grcengclub.com/learn/grc-engineering-salary
- GRC vs Traditional GRC: https://grcengclub.com/learn/grc-vs-traditional-grc

Website: https://grcengclub.com
Merch: https://grcengclub.com/merch
Patreon: https://www.patreon.com/cw/GRCEngineeringClub
LinkedIn: https://www.linkedin.com/company/grc-engineering-club/

Our guest builds AI governance for a living and he told us that checkbox compliance is better than nothing. On this show. We let it ride, because the context changes the whole argument.

Chris van der Heijden is not talking about a Fortune 500 with a compliance function. He is talking about the three to ten person startups shipping the AI features the rest of us are about to buy. Every governance guide in existence is written for enterprises, or at minimum for mildly mature companies. The teams actually generating the risk have none of that, and most of them believe they need a full compliance team before they can even start.

Chris spent four years building a data clean room for sports sponsorship data. Encrypted computation on fan records, rights holders on one side, brands on the other. He exited earlier this year and now runs Vaiking AI, helping startups build governance that fits on a runway instead of a roadmap. His framework is called privacy by design from the trenches, and the tell that he actually lived it is that policy is the third pillar, not the first.

Worth noting, this was Chris's first podcast appearance ever. You would not know it.

Key Takeaways

Governance debt is worse than technical debt. Function creep pushes a use case into a higher risk bracket under the EU AI Act, and Chris's argument is that you cannot pay it down after the fact because the artifacts had to exist at the moment the decision was made.

The entry price is lower than founders think. A register, a few small policies, and real conversations about what gets recorded where. Chris built a full ISMS anyway, and the return was not the certificate. It was clearing enterprise due diligence questionnaires without the deal stalling.

Every party in the chain had an incentive not to care. Rights holders wanted sponsors, brands wanted conversions, fans wanted their team to win. Nobody was going to ask for data minimization, so the platform in the middle had to enforce it on all sides.

Chris van der Heijden, founder of Vaiking AI
https://vaiking.ai
https://www.linkedin.com/in/cfvdheijden/

Learn GRC Engineering:
- GRC Engineering 101: https://grcengclub.com/learn/grc-engineering-101
- How to Break Into GRC Engineering: https://grcengclub.com/learn/how-to-break-into-grc-engineering
- GRC Engineer Salary Guide: https://grcengclub.com/learn/grc-engineering-salary
- GRC vs Traditional GRC: https://grcengclub.com/learn/grc-vs-traditional-grc

Website: https://grcengclub.com
Merch: https://grcengclub.com/merch
Patreon: https://www.patreon.com/cw/GRCEngineeringClub
LinkedIn: https://www.linkedin.com/company/grc-engineering-club/

We asked Tamelia Hutchinson whether GRC engineering is a fad or here to stay. She answered with a question of her own: what is your definition of GRC engineering? Everything after that was worth the price of admission.

Tamelia has spent about twenty years in security and compliance, accidentally at first and then on purpose. In this one she splits GRC engineering into its process side and its technical side, argues neither one is going anywhere, and lands on a phrase that is going to live in our head for a while: it has been a fad for forty years, so it is a fad in the geological sense.

We get into the thing nobody warns you about, which is that if you automate a bad process, you are just automating your demise. You get to the cliff faster. Tamelia walks through why software led transformation stalls when the people on the receiving end were never brought along, what she does when there is no internal proof of concept to point at, and the specific question she asks to get a stakeholder to imagine a different way of working instead of defending the current one.

She also breaks down how she actually learned to talk to leadership, which was not from a book. It was from sitting in rooms with people who were better at it than she was, listening for what connected, and then adapting it rather than copying it. Her line on that: copying someone else's delivery is like wearing somebody else's pants who says they are going to fit you.

And then there is the part we did not see coming. Leadership asked her how they would know the investment in compliance and security had paid off. Her answer was that they would know when they could let her go. When the maturity is high enough and the toil is reduced enough that her position is not needed. Her reasoning is the whole thesis of this show compressed into three words: people don't scale.

The GRC Engineering Club is a community of practitioners treating governance, risk, and compliance as an engineering discipline instead of a documentation ritual.

Subscribe for new episodes of the AntiCheckbox Podcast every week.

#GRC #GRCEngineering #Cybersecurity #Compliance #RiskManagement #SecurityLeadership #DevSecOps #Automation

---

Learn GRC Engineering:
- GRC Engineering 101: https://grcengclub.com/learn/grc-engineering-101
- How to Break Into GRC Engineering: https://grcengclub.com/learn/how-to-break-into-grc-engineering
- GRC Engineer Salary Guide: https://grcengclub.com/learn/grc-engineering-salary
- GRC vs Traditional GRC: https://grcengclub.com/learn/grc-vs-traditional-grc

Website: https://grcengclub.com
Merch: https://grcengclub.com/merch
Patreon: https://www.patreon.com/cw/GRCEngineeringClub
LinkedIn: https://www.linkedin.com/company/grc-engineering-club/

"We have this weird model where it's like hand me a SOC 2 or answer a questionnaire, tell me everything's good, let's shake hands and move on. And then we forgot to enable 2FA..."

In this episode of the Anti Checkbox Podcast, O sits down with Rachel Curran to dismantle the current state of Third-Party Risk Management (TPRM). Rachel brings a brutally honest perspective to the industry, explaining why the traditional reliance on massive questionnaires and point-in-time compliance frameworks is nothing more than "security theater."

We discuss why small 10-to-12 person startups are being sold a false narrative that they need a SOC 2 or ISO certification just to do business. Instead, Rachel argues for a return to first principles: focusing on continuous monitoring of core security hygiene, like Multi-Factor Authentication (MFA), which can stop the vast majority of breaches. We also explore how a transparent, right-sized security program acts as a "trust marketplace" that can actually help companies close six-figure deals.

Key Takeaways:

Security Theater: Why passing around massive questionnaires and point-in-time SOC 2 reports completely fails to stop actual breaches.

The MFA Mandate: Why prioritizing basic hygiene like MFA and encryption is infinitely more valuable than completing 250-point compliance checklists.

Advice for Startups: Why tiny companies should avoid the trap of pursuing expensive SOC 2 certifications and instead invest in a few hours of expert consulting to nail down core business risks.

Selling with Security: How treating third-party risk as a competitive differentiator can get you budget, build trust, and help your company close major enterprise deals.


Learn GRC Engineering:
- GRC Engineering 101: https://grcengclub.com/learn/grc-engineering-101
- How to Break Into GRC Engineering: https://grcengclub.com/learn/how-to-break-into-grc-engineering
- GRC Engineer Salary Guide: https://grcengclub.com/learn/grc-engineering-salary
- GRC vs Traditional GRC: https://grcengclub.com/learn/grc-vs-traditional-grc

Website: https://grcengclub.com
Merch: https://grcengclub.com/merch
Patreon: https://www.patreon.com/cw/GRCEngineeringClub
LinkedIn: https://www.linkedin.com/company/grc-engineering-club/