Security & GRC Decoded
Security & GRC Decoded
Podcast Description
How today’s top organizations navigate the complex world of governance, risk, and compliance (GRC).
Security & GRC Decoded brings you actionable strategies, expert insights, and real-world stories that help professionals elevate their security and compliance programs.
Hosted by Raj Krishnamurthy.
It’s for security professionals, compliance teams, and business leaders responsible security GRC and ensuring their organizations’ are safe, secure and adhere to regulatory mandates.
Security & GRC Decoded brings you:
+ Actionable strategies.
+ Expert insights.
+ Real-world stories to elevate your Security GRC programs.
Each episode explores frameworks, risk management strategies, and innovations shaping the future of GRC – from practitioners in the trenches.
Subscribe now to unlock the tools and knowledge you need to succeed.
Podcast Insights
Content Themes
The podcast explores vital topics in security governance, risk management, and compliance, with episodes such as Engineering Better Relationships highlighting the engineering perspective in GRC and navigating AI Risks sharing crucial AI security insights, creating a comprehensive approach to modern security strategies
How today’s top organizations navigate the complex world of governance, risk, and compliance (GRC). Security & GRC Decoded brings you actionable strategies, expert insights, and real-world stories that help professionals elevate their security and compliance programs. Hosted by Raj Krishnamurthy. It’s for security professionals, compliance teams, and business leaders responsible security GRC and ensuring their organizations’ are safe, secure and adhere to regulatory mandates. Security & GRC Decoded brings you: Actionable strategies, expert insights, and real-world stories to elevate your Security GRC programs. Each episode explores frameworks, risk management strategies, and innovations shaping the future of GRC – from practitioners in the trenches. Subscribe now to unlock the tools and knowledge you need to succeed!
In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Doug Barbin, President and National Managing Principal at Schellman, to take apart one of the oldest habits in compliance: pulling a sample of 25 change tickets from a year of thousands of deployments and calling it assurance. Doug's answer is simple — audit the process, not the results.
Drawing on 17 years at Schellman and nearly a decade at VeriSign before that, Doug explains why compliance and security were never opposites, why every breached-but-compliant company still benefited from its program, and how AI and agents are changing what auditors look at.
Doug covers:
- Why sampling change tickets misses the point in a cloud and AI release cadence.
- How to audit an enterprise with 18 different build environments.
- What automation should cover first — and why 30% can still save hundreds of engineer hours.
- How auditors evaluate AI agents doing work like backups.
If you're running an audit program for a modern engineering org — or sitting on the other side of the table from an auditor — this episode shows what good looks like.
Key Takeaways:
- Sampling 25 changes out of 500,000 isn't assurance. Modern audits should test the SDLC, build environments, and enforcement mechanisms that ship the code.
- If automation enforces approvals before every push, you don't need to sample for approvals. You validate that the process works.
- Compliance is not the opposite of security. Mature teams use it to show their work to customers; frameworks like PCI, DORA, and NIS2 already assume you'll be attacked.
- Automation doesn't need to hit 100%. Thirty percent that covers the evidence eating 200 engineer hours is a huge win — start with identity and access, then change control.
- When an AI agent does the work, auditors examine its identity, permissions, and configuration, then check the logs to confirm it ran.
What You'll Learn:
- Why ”audit the process, not the results” changes how evidence is gathered and tested
- How compensating controls like Slack notifications and fast rollback can satisfy separation of duties at a small company
- Where AI is already helping auditors, and where it's just getting started
- Why screenshots are fading and live observation is taking their place
- How technical auditors need to be — and how the CPA exam is adding IT assurance
This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.com
Watch more episodes: https://www.compliancecow.com/podcast
Connect With Our Guest: Doug Barbin | President | Schellman
Connect on LinkedIn: https://www.linkedin.com/in/douglasbarbin/
Rate, review, and share if you enjoyed the show!
Subscribe to Security & GRC Decoded wherever you get your podcasts:
Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683
Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450
Disclaimer
This podcast’s information is provided for general reference and was obtained from publicly accessible sources. The Podcast Collaborative neither produces nor verifies the content, accuracy, or suitability of this podcast. Views and opinions belong solely to the podcast creators and guests.
For a complete disclaimer, please see our Full Disclaimer on the archive page. The Podcast Collaborative bears no responsibility for the podcast’s themes, language, or overall content. Listener discretion is advised. Read our Terms of Use and Privacy Policy for more details.