When GRC Stops Watching and Starts Working ft Ryan Schoeller, Director of Security & GRC @ Treasure Data

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Doug Barbin, President and National Managing Principal at Schellman, to take apart one of the oldest habits in compliance: pulling a sample of 25 change tickets from a year of thousands of deployments and calling it assurance. Doug's answer is simple — audit the process, not the results. Drawing on 17 years at Schellman and nearly a decade at VeriSign before that, Doug explains why compliance and security were nev...

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Omar Santos, Distinguished Engineer for AI Security at Cisco, for an unusually concrete look at what it takes to run autonomous offensive security safely — and what breaks when you try. Omar co-chairs the Coalition for Secure AI, chairs the CSAF technical committee, led the DEF CON Red Team Village, and has authored more than 25 books. He walks through the architecture his team actually runs: the three-modality ev...

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Sunil Agrawal, CISO at Glean, to discuss why the traditional "security as friction" narrative is outdated. Sunil explains his philosophy that security functions as the brakes on a car—not to slow you down, but to provide the safety net that allows you to move faster. Drawing on three decades of leadership at companies like Netflix, Adobe, and Qualcomm, Sunil unpacks the critical shift in the post-Mythos threat lan...

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with James Tabron, Director of GRC Engineering at Aquia, for a conversation almost nobody in this space is qualified to have: what GRC looks like from inside an engineering org. James spent two decades in IT before building GRC programs at SendGrid, Twilio, and Snapdocs — and then did something almost no GRC practitioner ever does. He crossed the aisle. A VP of engineering hired him into the engineering organization t...

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with James Huang, Head of GRC at Gong, to explore how Governance, Risk, and Compliance has evolved from a traditional audit function into a strategic engineering discipline. Drawing on experience building GRC programs at Ernst & Young, Cisco, Salesforce, and Gong, James explains why modern GRC leaders must think beyond compliance checklists and focus instead on understanding risk, partnering with engineering, and b...