vespers-nine's journey

I was laid off in March 2026 due to organizational restructuring, and since then, I've been actively searching for a job in the Information Security Governance, Risk and Compliance (GRC) field. I have about 4 years of experience, with nearly 3 years spent at my last company, a mid-sized product-based multinational corporation. My role there involved supporting internal security governance and being a secondary owner for external audit readiness. While I gained valuable exposure, my position wasn't heavily focused on audits, which I think has affected my current job search. In the past three months, I've applied to over 70 jobs but have only managed to secure 2 interviews. I've been tailoring my resume for each job description, reaching out for referrals, and networking on LinkedIn, but the rejections keep piling up. I'm starting to realize that my time in a support-heavy role may have limited my hands-on experience, making it difficult for me to provide strong real-world examples during interviews. My responses often feel unstructured, and I find myself rambling instead of delivering concise, practical answers. This situation has really taken a toll on my confidence. I'm beginning to question whether I need to strengthen my fundamentals and revisit important frameworks like ISO 27001, SOC 2, PCI DSS, and NIST. I’m also considering ways to gain more practical experience. I'm looking for honest advice on a few points: Is the GRC job market really this challenging right now? Does a few months' career gap significantly impact my prospects in this field? How can I enhance my interview storytelling when my recent experience has been more support-oriented? Lastly, what steps can I take to become more marketable again? My savings are dwindling, and I won’t lie; it’s starting to affect my mental well-being. I would greatly appreciate any guidance from those who have faced similar challenges or who are hiring in this space.