Working with requirements
Experience reviewing software and content against written criteria, documenting differences and explaining findings.
Pelin Dragos
Quality assurance · GRC
Governance, risk & compliance · junior career direction
Bringing a QA mindset to governance, risk and compliance.
I am preparing for junior GRC roles through completed cybersecurity and GRC programmes. My studies cover governance, risk assessment and treatment, compliance and incident response. I bring professional QA experience in documentation, policy reviews and clear reporting; I have not yet held a GRC role.
What I bring from QA
Clear documentation
Test cases, defect reports and process documentation that help colleagues understand an issue and follow up.
Consistent decisions
Calibration meetings, vendor quality reviews and stakeholder feedback at TikTok. These are transferable skills; my GRC preparation comes from the study below.
What I studied
2 completed programmes · expand each course list for details
Google Cybersecurity Professional Certificate
A course-by-course programme with practice-based assessments, plus a portfolio of exercises written in the labs.
View 8 courses and learning outcomes
Foundations of Cybersecurity
The analyst's job, the events that shaped the field, the eight CISSP security domains, common frameworks and controls, and the confidentiality, integrity and availability triad.
Learning outcome: Placing a requirement before judging it: which domain a control belongs to, and which of the three properties it is meant to protect.
Play It Safe: Manage Security Risks
Security frameworks and controls, risk management, business continuity, SIEM tools and security playbooks.
Learning outcome: Understanding how security frameworks guide controls and how a risk register records risks, owners and treatment decisions.
Connect and Protect: Networks and Network Security
Network architecture and protocols, network attacks, hardening, firewalls, VPNs, and intrusion detection and prevention systems.
Learning outcome: Asking what a network control actually protects before accepting that the control exists.
Tools of the Trade: Linux and SQL
The Linux command line, file systems and permissions, users and authorisation, and SQL queries with filters and joins.
Learning outcome: Reaching the data behind a claim and searching it myself, instead of trusting a summary table.
Assets, Threats, and Vulnerabilities
Asset classification, threat modelling, vulnerability assessment, encryption and hashing, authentication and access control.
Learning outcome: Keeping an asset, a threat and a vulnerability apart — the distinction a finding depends on before it can be written.
Sound the Alarm: Detection and Response
Incident detection, log and packet analysis, SIEM queries, intrusion detection, and incident response playbooks.
Learning outcome: Reading an event log as evidence, and knowing what a playbook has to state before anyone can test it.
Automate Cybersecurity Tasks with Python
Python for security work: variables and functions, regular expressions, reading and parsing files, and debugging.
Learning outcome: Using Python to parse files and automate routine checks in coursework exercises.
Put It to Work: Prepare for Cybersecurity Jobs
Applying for entry-level security roles: presenting the portfolio, describing the work and communicating a finding to a non-technical reader.
Learning outcome: Presenting a concise portfolio and explaining a security finding to a non-technical reader.
Scope: foundational cybersecurity coursework and lab exercises. This programme does not represent professional security operations experience.
Cyber Security: Essentials for Governance, Risk & Compliance
Applied projects across the programme: a governance framework, a risk assessment and an incident response playbook.
View 3 courses and learning outcomes
Cyber Security: GRC Part 1 — Governance
How organisations design governance structures, write policy and align cyber security strategy with business objectives; governance frameworks and the three lines of defence.
Learning outcome: Reading a policy against the structure that gives it authority: who owns it, who approves it, and which decision it exists to support.
Cyber Security: GRC Part 2 — Risk Management and Compliance
Identifying and assessing cyber risk, choosing treatments, applying NIST, ISO/IEC 27001 and the CIS Controls, and working through regulatory obligations.
Learning outcome: Taking a risk from identification to a treatment decision, and telling a framework requirement apart from an internal criterion written for one exercise.
Cyber Security: Incident Response — Theory to Practice
Preparing for, detecting and containing an incident, recovery, and the review afterwards; the contents of an incident response playbook.
Learning outcome: Judging a recovery plan by what can be tested — objectives, evidence and who decides — instead of by whether the document exists.
Scope: GRC coursework and educational projects. This specialisation does not represent employment in GRC or a professional designation such as CISA or CISM.
Both programmes were completed through Coursera alongside full-time work. The course lists describe the subjects studied and my learning outcomes.
Practical development
From coursework to practical application
My next step is to apply this learning in practical exercises with documented checks, results and retests. There is currently no completed practical GRC project published on this site. Any future work will be clearly identified as an educational exercise or professional experience.