If you have any college degree period you should be fine with IT job experience, an AWS cert, Security+ and a few projects to talk about.
Without a degree, it'll be harder.
This is what I would do.
Sign up for practical hands on AWS training here and go for the Solutions Architect Cert.
learn.cantrill.io
And learn everything you can about cloud security and CIS Controls.
I would create projects in AWS in Python, Go, Rust. Learn Python, Rust and Go and you'll be fine in technology. Create a GitHub and hunt for bugs in open source projects.
While doing this, I would be studying for the CISSP or the CISM. You need experience to be fully certified in CISSP but if you pass the test will be an Associate and it counts just the same in the eyes of HR.
This is how you break down your study and career gameplan.
Learning a technology and a skill is more important than getting certs and learning about cybersecurity. Cybersecurity is a mid-career skill.
Therefore, block out 8 weeks.
For 8 weeks, all you are doing is the Cantril AWS Solutions Architect course and simple programming and scripting. Dedicate 3 hours a day of actually doing shit. Not just reading and gathering resources, but hands on keyboard learning.
While doing this, you are passively learning about cybersecurity. Pick up an CISSP book and read it in your spare time. Listen to podcasts. Go through HacktheBox Academy. Follow CISA alerts, whatever. You not studying for a cybersecurity exam.
Take the AWS Solutions Architect exam.
After 8 weeks, you should have an AWS project.
Then do another 8 weeks, focus on securing your project according to the CIS Controls, while passively learning about cybersecurity.
After these 8 weeks, take a week long break. You learned junior level cloud engineering and security.
Now, you wanna do an 8 week intensive on Python, Go and Rust. These languages are important to cloud development, backend development, API programming and services. So you wanna learn about system programming, system engineering and server architecture. You are not creating software.
I would do 3 projects:
I would create a simple blog site using Django for the backend, which is based on Python. Don't worry about how it looks, focus on securing it.
The second project, I would buy a Raspberry Pi and create a simple file transfer server to transfer files from my computer to the Raspberry Pi. Secure it.
The third project, I would buy another Raspberry Pi and create a VPN for me to use on my phone. It's a simple project. Then focus on securing that.
You may think, what this gotta do with GRC? Well how you gonna tell someone to secure something if you don't know how the shit works? You still should be passively learning about cybersecurity. You still at the help desk but you should be confident at your job. You should be looking for Cyber Analyst job or a AWS Solution Achitect job or a Sys Administrator job. You have projects to talk about.
Now you should be at a junior level of cloud security, networking, cloud engineering, backend development, server architecture, Python, Go and Rust.
You should be able to sit down and get the CompTIA CySA+ just by reading the book. Sit for the exam, but remember the goal is CISSP or CISM.
The next 8 weeks, go do the SOC Analyst Pathway on HacktheBox Academy. Nuff said. There you learn the ElasticStack, a SIEM. You have the programming and networking knowledge from your previous projects.
You should be interviewing now for cyber roles because you have CySA+.
Anyway, y'all should be good lol.