Need honest advice: Law school vs cybersecurity GRC from someone with my background
Hey everyone,
I’ve been stuck between law school and cybersecurity for a while now and wanted honest advice from people already working in cyber, especially GRC/compliance/risk type roles.
I graduated with a Criminal Justice degree and Pre-Law minor with a 3.94 GPA and I’m currently studying for the LSAT. Law school was originally the plan, but lately I’ve been questioning whether it’s worth it financially unless I get a really strong scholarship/full ride. The idea of taking on huge debt and spending 3 years out of the workforce honestly worries me.
That’s what started making me look into cybersecurity, mainly the GRC/governance/compliance side rather than hardcore engineering or offensive security.
I live in Colorado Springs, so I’m around a lot of defense/government contractor cyber stuff, and cyber seems attractive because of the growth, flexibility, online options, and what looks like a better ROI overall.
At the same time, I want to be realistic with myself. I’m not from a CS background and I’m not someone who’s been coding since high school. I can learn technical concepts, but I’m naturally more into writing, analysis, policy/legal thinking, communication, research, etc.
So I guess what I’m trying to figure out is:
- Is GRC actually realistic for someone with my background?
- How hard is it REALLY to break into right now?
- Does school prestige matter a lot in cyber hiring?
- Is WGU actually respected for GRC/compliance roles?
- How much do you think AI changes this field over the next 10–20 years?
- And based on what I wrote, does this honestly sound like a field I could realistically succeed in long term?
I’ve been looking at programs like WGU, UCCS, CU Boulder Information Science, and other online/hybrid cyber programs.
Part of me also thinks I might still pursue law school later in life if the opportunity makes sense financially. I keep wondering whether combining cybersecurity + law could actually become valuable in areas like privacy, AI governance, cyber law, investigations, compliance, etc., or if that just sounds good online.
If you were in my position, what path would you take?
Would really appreciate honest advice from people already in the field. And if anyone is open to connecting or sharing guidance privately, I’d appreciate that too.