Carolina Pinto

Helping organizations turn regulation into practical security.

4 minute read

The Short Version

I’m a lawyer. Specifically, a lawyer who specialized in finance, banking, and corporate law — the kind of background that sounds impressive on paper and mostly meant I spent over a decade helping clients move capital across borders, clean up compliance messes, and keep regulators happy. Good, stable, respectable work.

So why am I now writing a bootcamp diary about cybersecurity?

Here’s the long version.

Ten Years of Rules, Risk, and Other People’s Money

My whole career has lived at the intersection of law and money. I’ve helped ultra-high-net-worth clients and family offices move capital between jurisdictions. I’ve run compliance clean-ups — the unglamorous, detail-obsessed work of making sure everything lines up with AML, KYC, and OFAC standards. I’ve sat across tables negotiating, or watching negotiators do deals that needed to fall into a specific guideline or regulatory standard. Then I sat behind a desk making sure the paperwork behind those deals wouldn’t blow up later.

If there’s one thing that career teaches you, it’s how to read risk. Not just legal risk — operational risk, reputational risk, the kind of risk that shows up in the fine print nobody wants to read.

Then a Fintech in Miami Cracked Something Open

At some point, looking for something different, fresher, more interesting, I took a job with a fintech startup here in Miami — and it was the first time in my career I worked inside a real startup environment. Small teams, fast pace, everyone wearing three hats, everyone rowing toward the same number: revenue. Everyone allowed to be creative, outside the box.

It was chaotic in the best way. I wasn’t just doing legal work in a silo anymore — I was in the room with product, ops, and sales, using every skill I had to help the whole team hit the goal. It scratched an itch that had always been there, just hidden.

Eventually, I went back to more traditional finance work. But that fintech stint left a mark. I couldn’t stop thinking about tech — not as a user, but as a field I wanted in.

So, I started searching. Not casually — seriously. What part of tech was actually for me? I looked into a handful of paths, trying to find the one that would hold my attention past the honeymoon phase, past the 9-5, the one I’d still be curious about a year in.

Then I found cybersecurity, and specifically the world of GRC — governance, risk, and compliance — and something clicked in a way none of the other paths had.

My “Slumdog Millionaire” Moment

If you’ve seen the movie, you know the setup: a guy who’s supposedly unqualified keeps getting asked questions he can answer perfectly — because it turns out every random, disconnected experience of his life was actually preparing him for exactly this moment.

That’s what discovering cybersecurity felt like.

Risk assessment? I’ve been doing that for a decade. Reading dense regulatory frameworks and translating them into something a business can actually act on? Also a decade. Communicating with senior leadership, protecting sensitive client information, building trust with stakeholders who have zero patience for vague answers? Same decade.

I wasn’t starting from zero. I was starting from ten years of transferable skills I just hadn’t had a name for yet.

Where I’m Headed

I’m not pretending I know everything now — far from it. I’m actively building out the technical side: security frameworks, network fundamentals, cloud concepts, governance practices, and how frameworks like NIST actually get applied in practice. That part is new, and it’s humbling in the best way.

But the direction is clear. I want to work in GRC — the place where cybersecurity, compliance, risk, and business strategy actually meet. It’s the one corner of this field where my legal and finance background isn’t a detour from the story; it’s the whole reason the story makes sense.

I’m bringing:

  • A decade of regulatory and risk expertise (AML, KYC, OFAC, and more)
  • Real experience bridging legal, financial, and business teams
  • Strong written and verbal communication, forged in high-stakes client work
  • A genuine, growing curiosity about how organizations actually stay secure

Why I’m Writing This Blog

I’m currently working through a cybersecurity bootcamp — more on that in a future post — and I wanted a place to document the process honestly: the wins, the dumb mistakes, the concepts that finally click after the third explanation. Partly for my own learning. Partly because if you’re also making a career pivot later in the game, I want you to know it’s not as crazy as it feels at 2am when you’re questioning everything.

Ten years in law and finance didn’t derail this path — it built the foundation for it. So let’s call it “expanding into cybersecurity.”

Let’s see where it goes.

You May Also Enjoy