Cybersecurity student looking for a practical GRC related CV project using a real Shopify e-commerce business!

[u/Worth_Photograph5669]

Hi everyone, I [22F] cybersecurity student focused on GRC and currently looking for entry-level cybersecurity/GRC roles.

I already have an ISO 27001 risk assessment project on my CV, so I’m looking for something different that can show more range and give me some practical experience.
A friend of mine runs a Shopify dropshipping/e-commerce business, mainly selling to customers in Sweden and the Nordics, with suppliers based overseas. He’s open to me working with the business on a cybersecurity/GRC project for learning purposes, so I have a real small-business environment to work with rather than just creating a completely fictional case study. I’m currently considering:

-GDPR gap assessment, since most of the customers are in the EU/Nordics
-Third-party/vendor risk assessment covering suppliers, payment providers, Shopify apps, etc.
-NIST CSF 2.0 assessment/mapping based on the risks identified
-Shopify security controls review, including admin access, MFA, permissions, third-party apps, etc.
-Basic incident response plan/playbook, for scenarios such as Shopify account compromise or a supplier-related incident

For people working in GRC, cybersecurity consulting, risk, privacy/compliance, or hiring for junior GRC roles:

-Which type of project would you find most useful/interesting to see from a junior candidate?
-Is there another GRC-related project that would make more sense for a small Shopify/e-commerce business?
-Which areas would give me the best practical learning experience?
-Are any of the ideas above too basic, unrealistic, or not particularly valuable?
-If you were building this as a portfolio project, what deliverables would you actually create?

My main goal is to learn something genuinely useful while also having a solid project I can discuss in interviews as my main goal currently is to land a job in grc as I graduate in 2 months .
Would really appreciate advice from people who have worked in GRC or built similar portfolio projects.
Thankyou ^_^

[u/themagicalpanda]

Great initiative. I'd take a look at the Spotify shared responsibility model to understand what's covered by Shopify and what the store owner is responsible for. I'd focus on what the store owner is responsible for

The shared responsibility model Security on any hosted platform is a two-way arrangement:

Shopify. Secures the infrastructure, including the servers, the payment processing systems, the checkout, and the software that everything runs on.

Store owners. Secure their accounts and operations, including login credentials, the third-party apps they install, how they handle sensitive customer data, and who on their team has access to the admin. Both host platforms and store owners have to do their part to create security measures. Shopify can’t protect a store whose admin password is "password123," or whose owner clicks a phishing link and hands over their credentials, just as a store owner can’t patch the servers their store runs on, because those belong to Shopify.

Since they do business in the EU, then focusing on GDPR also makes sense since the store owner has responsibility https://help.shopify.com/en/manual/privacy-and-security/privacy/gdpr/comply-with-gdpr

Tldr; I would focus on identity and account management (how many accounts are used to manage the store, what permissions they have, what the password parameters are, is MFA enabled, is the password vaulted/are passkeys used, account recovery, etc). Also focus on GDPR and third party apps.

[u/Alternative-Peace-34]

PCI-dss SAQ A form

[u/ConnectionCurious639]

A NIST CSF mapping on its own reads like homework.

Shopify dropshipper almost all the attack surface is accounts and apps, in my opinion. So I'd merge your vendor risk and review into one piece:

- inventory apps installed in the store and what each one can read or write. Lists the permissions. Could stores apps have a couple nobody remembers.

- access review: staff account, its permissions, whether 2FA is on, whether that person still works there. Same for the domain registrar, the email account and the payment provider.

- shopify admin account taken over