<![CDATA[The GRC Engineering Club's AntiCheckBox Podcast]]>Compliance became a documentation ritual somewhere along the way.

Screenshots, spreadsheets, a scramble every quarter, and a piece of paper at the end that tells you almost nothing about whether the control actually works. That job is getting automated out from under the people doing it, and good riddance.


The AntiCheckbox Podcast is about the other version of this work. Controls as a data and engineering problem. Evidence that generates itself. Governance you can defend to a regulator, a board, or a plaintiff's attorney because the system produces the proof, not because somebody filled in a cell.

Every week we sit down with the practitioners actually building this way. Auditors who got tired of asking for screenshots and learned to write code. Engineers who got handed a framework and refused to accept that it had to be miserable. The people writing the standards, the people running programs at scale, and the ones who lived through the audit that changed how they think.

No vendor pitches. No certification worship. No pretending the current model is fine.

If you work in GRC, security, risk, audit, privacy, or you are trying to get into any of it and cannot get a straight answer from anybody, this is for you.

The show is the front door to the GRC Engineering Club, a community of practitioners doing this work in the open. Early episodes, the Slack, and The Convergence newsletter live at patreon.com/c/GRCEngineeringClub.

]]>https://www.patreon.com/c/GRCEngineeringClubRiverside.fm (https://riverside.com)Thu, 06 Aug 2026 05:13:22 GMTTue, 28 Jul 2026 10:27:44 GMT60Dr. Omar Sangurima<p>Compliance became a documentation ritual somewhere along the way. <br /><br />Screenshots, spreadsheets, a scramble every quarter, and a piece of paper at the end that tells you almost nothing about whether the control actually works. That job is getting automated out from under the people doing it, and good riddance.</p><p><br />The AntiCheckbox Podcast is about the other version of this work. Controls as a data and engineering problem. Evidence that generates itself. Governance you can defend to a regulator, a board, or a plaintiff's attorney because the system produces the proof, not because somebody filled in a cell.<br /></p><p>Every week we sit down with the practitioners actually building this way. Auditors who got tired of asking for screenshots and learned to write code. Engineers who got handed a framework and refused to accept that it had to be miserable. The people writing the standards, the people running programs at scale, and the ones who lived through the audit that changed how they think.<br /></p><p>No vendor pitches. No certification worship. No pretending the current model is fine.<br /></p><p>If you work in GRC, security, risk, audit, privacy, or you are trying to get into any of it and cannot get a straight answer from anybody, this is for you.<br /></p><p>The show is the front door to the GRC Engineering Club, a community of practitioners doing this work in the open. Early episodes, the Slack, and The Convergence newsletter live at <a rel="noopener noreferrer nofollow" href="http://patreon.com/c/GRCEngineeringClub" target="_blank">patreon.com/c/GRCEngineeringClub</a>.</p>episodicDr. Omar Sangurimaosangurima1@gmail.comno<![CDATA[People Don't Scale: Tamelia Hutchinson on the 40 Year "Fad" of GRC Engineering]]>We asked Tamelia Hutchinson whether GRC engineering is a fad or here to stay. She answered with a question of her own: what is your definition of GRC engineering? Everything after that was worth the price of admission.

Tamelia has spent about twenty years in security and compliance, accidentally at first and then on purpose. In this one she splits GRC engineering into its process side and its technical side, argues neither one is going anywhere, and lands on a phrase that is going to live in our head for a while: it has been a fad for forty years, so it is a fad in the geological sense.

We get into the thing nobody warns you about, which is that if you automate a bad process, you are just automating your demise. You get to the cliff faster. Tamelia walks through why software led transformation stalls when the people on the receiving end were never brought along, what she does when there is no internal proof of concept to point at, and the specific question she asks to get a stakeholder to imagine a different way of working instead of defending the current one.

She also breaks down how she actually learned to talk to leadership, which was not from a book. It was from sitting in rooms with people who were better at it than she was, listening for what connected, and then adapting it rather than copying it. Her line on that: copying someone else's delivery is like wearing somebody else's pants who says they are going to fit you.

And then there is the part we did not see coming. Leadership asked her how they would know the investment in compliance and security had paid off. Her answer was that they would know when they could let her go. When the maturity is high enough and the toil is reduced enough that her position is not needed. Her reasoning is the whole thesis of this show compressed into three words: people don't scale.

The GRC Engineering Club is a community of practitioners treating governance, risk, and compliance as an engineering discipline instead of a documentation ritual.

Subscribe for new episodes of the AntiCheckbox Podcast every week.

#GRC #GRCEngineering #Cybersecurity #Compliance #RiskManagement #SecurityLeadership #DevSecOps #Automation

---

Learn GRC Engineering:
- GRC Engineering 101: https://grcengclub.com/learn/grc-engineering-101
- How to Break Into GRC Engineering: https://grcengclub.com/learn/how-to-break-into-grc-engineering
- GRC Engineer Salary Guide: https://grcengclub.com/learn/grc-engineering-salary
- GRC vs Traditional GRC: https://grcengclub.com/learn/grc-vs-traditional-grc

Website: https://grcengclub.com
Merch: https://grcengclub.com/merch
Patreon: https://www.patreon.com/cw/GRCEngineeringClub
LinkedIn: https://www.linkedin.com/company/grc-engineering-club/

]]>ae62d57e-4205-448a-b5ad-99e8788414e3Sat, 01 Aug 2026 13:15:00 GMT<p>We asked Tamelia Hutchinson whether GRC engineering is a fad or here to stay. She answered with a question of her own: what is your definition of GRC engineering? Everything after that was worth the price of admission.<br /><br />Tamelia has spent about twenty years in security and compliance, accidentally at first and then on purpose. In this one she splits GRC engineering into its process side and its technical side, argues neither one is going anywhere, and lands on a phrase that is going to live in our head for a while: it has been a fad for forty years, so it is a fad in the geological sense.<br /><br />We get into the thing nobody warns you about, which is that if you automate a bad process, you are just automating your demise. You get to the cliff faster. Tamelia walks through why software led transformation stalls when the people on the receiving end were never brought along, what she does when there is no internal proof of concept to point at, and the specific question she asks to get a stakeholder to imagine a different way of working instead of defending the current one.<br /><br />She also breaks down how she actually learned to talk to leadership, which was not from a book. It was from sitting in rooms with people who were better at it than she was, listening for what connected, and then adapting it rather than copying it. Her line on that: copying someone else's delivery is like wearing somebody else's pants who says they are going to fit you.<br /><br />And then there is the part we did not see coming. Leadership asked her how they would know the investment in compliance and security had paid off. Her answer was that they would know when they could let her go. When the maturity is high enough and the toil is reduced enough that her position is not needed. Her reasoning is the whole thesis of this show compressed into three words: people don't scale.<br /><br />The GRC Engineering Club is a community of practitioners treating governance, risk, and compliance as an engineering discipline instead of a documentation ritual. <br /><br />Subscribe for new episodes of the AntiCheckbox Podcast every week.<br /><br />#GRC #GRCEngineering #Cybersecurity #Compliance #RiskManagement #SecurityLeadership #DevSecOps #Automation<br /><br />---<br /><br />Learn GRC Engineering:<br />- GRC Engineering 101: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com/learn/grc-engineering-101" target="_blank">https://grcengclub.com/learn/grc-engineering-101</a><br />- How to Break Into GRC Engineering: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com/learn/how-to-break-into-grc-engineering" target="_blank">https://grcengclub.com/learn/how-to-break-into-grc-engineering</a><br />- GRC Engineer Salary Guide: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com/learn/grc-engineering-salary" target="_blank">https://grcengclub.com/learn/grc-engineering-salary</a><br />- GRC vs Traditional GRC: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com/learn/grc-vs-traditional-grc" target="_blank">https://grcengclub.com/learn/grc-vs-traditional-grc</a><br /><br />Website: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com" target="_blank">https://grcengclub.com</a><br />Merch: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com/merch" target="_blank">https://grcengclub.com/merch</a><br />Patreon: <a rel="noopener noreferrer nofollow" href="https://www.patreon.com/cw/GRCEngineeringClub" target="_blank">https://www.patreon.com/cw/GRCEngineeringClub</a><br />LinkedIn: <a rel="noopener noreferrer nofollow" href="https://www.linkedin.com/company/grc-engineering-club/" target="_blank">https://www.linkedin.com/company/grc-engineering-club/</a></p>no00:41:2112People Don't Scale: Tamelia Hutchinson on the 40 Year "Fad" of GRC Engineeringfull<![CDATA[The End of Security Theater: Why TPRM and SOC 2 Are Broken | Guest: Rachel Curran from Locktivity]]>"We have this weird model where it's like hand me a SOC 2 or answer a questionnaire, tell me everything's good, let's shake hands and move on. And then we forgot to enable 2FA..."

In this episode of the Anti Checkbox Podcast, O sits down with Rachel Curran to dismantle the current state of Third-Party Risk Management (TPRM). Rachel brings a brutally honest perspective to the industry, explaining why the traditional reliance on massive questionnaires and point-in-time compliance frameworks is nothing more than "security theater."

We discuss why small 10-to-12 person startups are being sold a false narrative that they need a SOC 2 or ISO certification just to do business. Instead, Rachel argues for a return to first principles: focusing on continuous monitoring of core security hygiene, like Multi-Factor Authentication (MFA), which can stop the vast majority of breaches. We also explore how a transparent, right-sized security program acts as a "trust marketplace" that can actually help companies close six-figure deals.

Key Takeaways:

Security Theater: Why passing around massive questionnaires and point-in-time SOC 2 reports completely fails to stop actual breaches.

The MFA Mandate: Why prioritizing basic hygiene like MFA and encryption is infinitely more valuable than completing 250-point compliance checklists.

Advice for Startups: Why tiny companies should avoid the trap of pursuing expensive SOC 2 certifications and instead invest in a few hours of expert consulting to nail down core business risks.

Selling with Security: How treating third-party risk as a competitive differentiator can get you budget, build trust, and help your company close major enterprise deals.


Learn GRC Engineering:
- GRC Engineering 101: https://grcengclub.com/learn/grc-engineering-101
- How to Break Into GRC Engineering: https://grcengclub.com/learn/how-to-break-into-grc-engineering
- GRC Engineer Salary Guide: https://grcengclub.com/learn/grc-engineering-salary
- GRC vs Traditional GRC: https://grcengclub.com/learn/grc-vs-traditional-grc

Website: https://grcengclub.com
Merch: https://grcengclub.com/merch
Patreon: https://www.patreon.com/cw/GRCEngineeringClub
LinkedIn: https://www.linkedin.com/company/grc-engineering-club/

]]>29d66140-eb98-4710-9862-2d546ecb0316Tue, 28 Jul 2026 22:24:49 GMT<p>"We have this weird model where it's like hand me a SOC 2 or answer a questionnaire, tell me everything's good, let's shake hands and move on. And then we forgot to enable 2FA..." <br /><br />In this episode of the Anti Checkbox Podcast, O sits down with Rachel Curran to dismantle the current state of Third-Party Risk Management (TPRM). Rachel brings a brutally honest perspective to the industry, explaining why the traditional reliance on massive questionnaires and point-in-time compliance frameworks is nothing more than "security theater." <br /><br />We discuss why small 10-to-12 person startups are being sold a false narrative that they need a SOC 2 or ISO certification just to do business. Instead, Rachel argues for a return to first principles: focusing on continuous monitoring of core security hygiene, like Multi-Factor Authentication (MFA), which can stop the vast majority of breaches. We also explore how a transparent, right-sized security program acts as a "trust marketplace" that can actually help companies close six-figure deals. <br /><br />Key Takeaways:<br /><br />Security Theater: Why passing around massive questionnaires and point-in-time SOC 2 reports completely fails to stop actual breaches. <br /><br />The MFA Mandate: Why prioritizing basic hygiene like MFA and encryption is infinitely more valuable than completing 250-point compliance checklists. <br /><br />Advice for Startups: Why tiny companies should avoid the trap of pursuing expensive SOC 2 certifications and instead invest in a few hours of expert consulting to nail down core business risks. <br /><br />Selling with Security: How treating third-party risk as a competitive differentiator can get you budget, build trust, and help your company close major enterprise deals. <br /><br /><br />Learn GRC Engineering:<br />- GRC Engineering 101: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com/learn/grc-engineering-101" target="_blank">https://grcengclub.com/learn/grc-engineering-101</a><br />- How to Break Into GRC Engineering: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com/learn/how-to-break-into-grc-engineering" target="_blank">https://grcengclub.com/learn/how-to-break-into-grc-engineering</a><br />- GRC Engineer Salary Guide: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com/learn/grc-engineering-salary" target="_blank">https://grcengclub.com/learn/grc-engineering-salary</a><br />- GRC vs Traditional GRC: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com/learn/grc-vs-traditional-grc" target="_blank">https://grcengclub.com/learn/grc-vs-traditional-grc</a><br /><br />Website: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com" target="_blank">https://grcengclub.com</a><br />Merch: <a rel="noopener noreferrer nofollow" href="https://grcengclub.com/merch" target="_blank">https://grcengclub.com/merch</a><br />Patreon: <a rel="noopener noreferrer nofollow" href="https://www.patreon.com/cw/GRCEngineeringClub" target="_blank">https://www.patreon.com/cw/GRCEngineeringClub</a><br />LinkedIn: <a rel="noopener noreferrer nofollow" href="https://www.linkedin.com/company/grc-engineering-club/" target="_blank">https://www.linkedin.com/company/grc-engineering-club/</a></p>no00:47:3311The End of Security Theater: Why TPRM and SOC 2 Are Broken | Guest: Rachel Curran from Locktivityfull