Security & GRC Decoded

The episode delivers substantial, non-obvious insights about GRC transformation in AI infrastructure, particularly the tension between ephemeral systems and traditional audit models. Jasmine articulates concrete problems (GPU return cycles, evidence staleness, ephemeral infrastructure) and proposes novel frameworks (GRC as infrastructure, signals/thresholds, agentic GRC). However, some segments include repetitive explanation and softer advice toward the end that dilutes density.

“by the time our audit readiness dance completed, the GPUs were already returned to the pool. The identity was already revoked. and the new network paths, the storage, et cetera, will be reconfigured”

“When I say GRC is part of the infrastructure, I mean your control set, your compliance guardrails are embedded in the infrastructure itself. It runs all the time. It scales automatically.”

The framing of GRC as fundamentally broken for AI infrastructure is relatively fresh and contrarian to mainstream GRC thinking. The specific assertion that audit models assume systems will 'pause long enough' for sampling, and the proposal that GRC must become infrastructure-embedded rather than application-layer are genuinely counterintuitive. However, continuous controls monitoring and 'shift-left' concepts are established patterns, limiting novelty somewhat.

“audits assume the system will pause long enough for it to be able to sample or pull an evidence, right? But the AI systems don't. And it's not only because there is a misconfiguration, it's because they are short-lived by design.”

“the traditional way of managing audit will not work for us”

Jasmine Kaur is a genuinely strong practitioner guest: 20+ years in cybersecurity, hands-on GRC leadership at major scale (Google, SAP, CoreWeave), currently building GRC strategy at an AI hyperscaler during a critical inflection point. She speaks from real operational constraints, not theoretical positions. Her credibility is reinforced by specific war stories and the complexity of her current role.

“Jasmine has 20 plus years in cybersecurity managing security operations teams, GRC. She has worked for some fantastic companies like SAP, Google, and now she's at CoreWeave.”

“the way it what it means to us right so as a GRC practitioner I would also like to tell you Raj working for AI hyperscaler what does it mean right it means that the traditional GRC models will not work for us”

Jasmine provides the GPU-return-cycle audit story as concrete evidence of the core problem, and references specific techniques (policy-as-code, controls-as-code, signals/thresholds). She names CoreWeave, Google, SAP, and mentions frameworks like CCM. However, she lacks dollar figures, timelines, quantified impact metrics, or details on actual implementations at CoreWeave. The agentic GRC discussion is conceptual without concrete use cases or prototypes demonstrated.

“At Coreweave, we were to audit our product, which is an AI cloud product. Now, for us to be able to scope that particular audit, we had AI training workloads running on the GPU-backed infrastructure.”

“policy as a code, control as a code, or embedding GRC part of the infrastructure itself”

Raj demonstrates strong interviewing: he asks clarifying follow-ups (model vs. ML model distinction), challenges assumptions (SIEM vs. infrastructure-embedded approach), and pushes on the auditor relationship. However, he occasionally accepts claims without deep pushback (e.g., on the feasibility of agentic GRC adoption, or how leadership actually funds this). Some questions are soft or generic (women in leadership), and there's an awkward audio issue mid-conversation. The host does synthesize well and summarize key points.

“Are you saying that the GRC team should take an active role in threat modeling?”

“how is this different than traditionally log shipping into a central SIM like Splunk or LogRhythm”