Different background, shared challenges: Women's experiences across GRC and security operations

As women in cyber security, visibility is increasing but influence does not always follow. The gap between being present and being heard can directly impact decisions, team dynamics, and ultimately, security outcomes.

This session brings together perspectives from Governance, Risk and Compliance (GRC) and Security Operations (SOC) to explore how credibility is built, challenged, and perceived in practice. Drawing on experience across government, critical infrastructure and industry, we examine how the same behaviours, inputs, and decisions can be received differently depending on role, context, and gender.

We explore the lived reality of being the only woman in the room—feeling underrepresented, not taken seriously, and at times questioning whether you belong. Alongside this sits an implicit expectation to represent all women, where success—or failure—can feel like it shapes opportunities for others. Technical expertise is often questioned or second-guessed differently, creating pressure to over-explain, add context, and anticipate scrutiny. 

Across both GRC and technical roles, assumptions persist: GRC professionals may be seen as "just policy," while technical practitioners are asked to prove depth or are overlooked in favour of male counterparts. In both cases, credibility must often be earned repeatedly, rather than granted.

We examine the behavioural double bind—where being assertive can be labelled as difficult, while collaboration may be perceived as a lack of technical depth. Contributions may be interrupted, overridden, or deprioritised, leading to a need to prepare excessively, provide more evidence, and communicate with precision. Over time, this creates mental fatigue: rewriting emails to ensure clarity, carefully managing tone, and navigating backhanded compliments that frame capability as surprising rather than expected.

The session also highlights how women are often associated with "soft skills"—communication, coordination, and stakeholder management—which are critical in cyber security but frequently undervalued or treated as secondary to technical expertise. This reinforces a cycle where recognition is tied to how work is delivered, rather than the depth of knowledge behind it.

We explore the invisible work that underpins effective cyber security: mentoring, bridging technical and business teams, maintaining alignment, and carrying the coordination and communication load. These contributions are essential, yet often unrecognised. At the same time, broader cultural dynamics shape experience and progression including being labelled a "diversity hire," navigating imposter syndrome, and observing how recognition is distributed. This includes moments where men are disproportionately celebrated in spaces intended to recognise women.

This is not just a conversation about diversity it is a practical exploration of how communication, perception, and bias influence cyber security outcomes. By bridging GRC and SOC perspectives, this session demonstrates how addressing these dynamics leads to stronger, more effective, and more resilient security practices.