October 1, 2026 Starting a weekly roundup here of GRC, AI, and cybersecurity updates worth understanding. I’ll include the sources and what I’d pay attention to in the actual work. 1) CISA is changing its vulnerability updates CISA announced September 28 as the retirement date for its weekly Vulnerability Bulletin, part of a shift toward risk-based vulnerability prioritization. My takeaway: If your vulnerability process depends on a weekly email or a severity score, review it. Can you explain which affected systems matter most, who owns remediation, and what evidence supports closing a finding? Source: CISA bulletin notice https://www.cisa.gov/news-events/bulletins 2) Anthropic reports AI being used to coordinate cyberattacks Anthropic’s September threat report describes cases where attackers used AI to execute or coordinate reconnaissance, exploitation, and data theft. Humans still directed targets and reviewed results. The report covers activity from December 2025 through August 2026, rather than attacks that all happened this week. My takeaway: Give your next incident-response exercise a tighter timeline. Test how quickly the team can identify the owner, revoke compromised access, preserve evidence, and escalate. Treat these as vendor-reported case studies, not a measurement of every attacker’s capabilities. Source: Anthropic’s September report https://www.anthropic.com/threat-intelligence-report-september-2026 3) A practical NIST resource to review before October 15 NIST’s draft SP 1353 explores using AI for Cybersecurity Framework analysis and reporting. Released in August, it includes example prompts, simulated company files, and three illustrative use cases. Public comments remain open through October 15. This is draft guidance. My takeaway: This could make a useful portfolio exercise. Use the fictional company materials, generate a draft analysis, then document what you corrected and why. Show your judgment alongside the output.

Five new openings are worth reviewing today. Curana Health and Squarespace are the strongest traditional GRC roles. SNHU is strong for controls assurance. Treasure AI is a technical GRC stretch role. Robert Half has a solid contract option for candidates around the 3-year mark. 1) GRC Security Analyst | Curana Health - Location: Remote, US - Salary: Starting at $130,000 - Experience: 2-5 years in GRC, information security, risk, audit, compliance, cybersecurity, or a related function - Education: Related bachelor's degree or equivalent experience - Skills: HIPAA, SOC 2, NIST CSF, CIS Controls, HITRUST, and ISO 27001 - Skills: Risk assessments, control validation, audit evidence, and remediation tracking - Skills: Third-party risk and vendor security reviews - Skills: Risk registers, compliance metrics, and governance documentation - Skills: ServiceNow GRC, Archer, OneTrust, AuditBoard, or LogicGate preferred This is a strong early-career health-tech GRC role because candidates at the 2-3 year level can build experience across audits, risk, controls, TPRM, policies, and compliance operations. Apply: https://general-careers-curanahealth.icims.com/jobs/4229/grc-security-analyst/job 2) GRC Analyst | Squarespace - Location: New York, NY | Hybrid, 3 days per week in office - Salary: $130,000-$170,000 - Experience: 3+ years in GRC, IT audit, security compliance, or privacy compliance - Skills: SOX, SOC 1/2, PCI DSS, NIST, and ISO - Skills: Control testing, audit scoping, findings, and issue management - Skills: Third-party security and privacy assessments - Skills: Security questionnaires and customer assurance - Skills: GRC automation, continuous monitoring, and AI-enabled workflows This is one of the strongest roles today for someone around the 3-year mark because the work covers the full audit lifecycle plus TPRM, customer assurance, privacy, and compliance automation inside a technology company.

55 members today. Appreciate everyone who’s joined so far. I don’t want to keep adding resources JUST to add resources (lol). I want the next thing I build here to solve an actual problem for you. So if you're serious about this, please see below. Reply with one number: 1. I need stronger GRC resume bullets and better ways to explain my experience 2. I need hands-on practice with control testing, audit evidence, and documentation 3. I need a clearer path into a GRC, IT audit, risk, or compliance role 4. I’m already in the field and want to get better at TPRM, risk assessments, or audit work 5. Something else. Tell me what you’re stuck on in one sentence I’ll use the responses to decide what GRC Lab 002 or the next practical resource should cover.