IT Risk position update

I've been in this role for roughly 3 months now and I'm enjoying it so far. It's kept me challenged and busy the entire time. In my prior roles, I haven't had that. I'm also studying for the CISSP, so that's eating up my free time, but I think it's a worthwhile investment. I've been involved with everything from reports development to working with vendors on security solutions. So this is a great position for a 20 something person that has an interest in IT Risk.

The confusion now is what direction do I want to go in. I mean do I want to focus on governance, resilience, or risk consulting?

That's the next question

UPDATE:Transition to new role

So I started my new role about 3 weeks ago, and so far so good. I'm already getting exposure to the regular issues of the department like IT asset management, vulnerability and audit reporting, working with/pestering PMs on audit issue remediation.

 I'm also working through my transition plan. I did that after reading the First 90 Days. The book talks about how to be successful in any sort of new role.

A few books that I'm reading or in the process of reading that I have found to be interesting/helpful are:

• The First 90 Days - Watkins, Harvard Business Press
• The 7C's of Consulting- Mick Cope (e-book available on Safari/O'Reilly)
• Managing the Unexpected, Weick, Sutcliffe, Jossey-Bass, part of the University of Michigan Business School Series
• several Harvard Business Review readings such as
  Reclaim Your job-Ghosal and Bruch
  Managing your Boss -Gabarro and Kotter
  Managing One's Self-Drucker

Also it looks like I'm going to be taking the CISSP and the CISA by the end of the year. So I'm going to have a very, very busy year.