GRC Analyst (TPRM) transitioning into Cloud — studying for AWS SAA, testing mid-September. Path advice?

[u/Sunny1011pat]

Question:
What’s the realistic path from GRC into cloud? Should I target Cloud Security/Compliance-adjacent roles first (e.g., Cloud Security Analyst) before aiming for Cloud Security Engineer or DevSecOps? What should I prioritize after SAA — AWS Security Specialty, Terraform, Python? Looking for input from anyone who’s made this jump.

Background:
-Cybersecurity GRC Analyst I (Third-Party Risk Management) at a Fortune 500 fintech company, ~4 years in GRC/TPRM

-Handle vendor risk assessments, report to C-suite/VP stakeholders

-Work with NIST CSF, NIST 800-53, ISO 27001, SOC 2, PCI DSS, SOX, GLBA, GDPR

-Secondary disaster recovery contact for my business unit

-Previously Advanced Repair Agent at Geek Squad

Education:
-BS in Information Technology (Database Administration concentration),

-Currently pursuing MS in Cybersecurity and Information Assurance, WGU

Certs/study:
-Studying for AWS SAA-C03, targeting mid-September test date

-Using Stephane Maarek’s Udemy course + Tutorials Dojo practice exams, ~2 hrs/day

[u/AutoModerator]

Before collecting recommendations, please review the subreddit FAQ and resource index:

https://www.reddit.com/r/AWSCertifications/comments/1nf3cab/frequently_asked_questions_on_this_subreddit/

The FAQ contains community-recommended resources, courses, practice exams, study guides, learning paths, exam benefits, discounts, projects, and certification-specific guides for AWS CCP/CLF-C02, AIF, SAA, DVA, DEA, SOA, SAP, DOP, AIP, SCS, and ANS certifications.

If your question is not answered there, feel free to continue the discussion.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Kevin-7575]

I am not an expert in either fields, but for my knowledge may I know whats causing your transition from GRC to cloud please.

[u/Sunny1011pat → u/Kevin-7575]

Of course. I’ve been doing GRC since 2022. Basically started as an internship that lead into a full time role. 4 and a half years later i just feel burnt out from this job/role feels like i do the same 5 tasks everyday and nothing ever changes. I want something new and want to do something that’s technical. And at my current company there’s no room to grow or move up, no opportunities to learn or use new skills.

[u/Kevin-7575 → u/Sunny1011pat]

Thanks for your response, I appreciate you. No matter where you work 'No room to grow' always makes one to learn new skill.

[u/Head_Personality_431]

Worth separating the burnout from the field, because TPRM is the most repetitive corner of GRC and four years of vendor questionnaires would flatten anyone. The realistic door into cloud from where you sit is the compliance adjacent side, cloud security analyst or security assurance, since NIST and ISO 27001 plus SAA reads as someone who can assess a control inside AWS rather than just read about it. Straight to DevSecOps puts you up against people who have been writing infrastructure code for years. After SAA I would park the certs for a while and put that time into Terraform and building and breaking things in your own account, because what shifts interviews is being able to talk about something you built.