Senior GRC Analyst, Controls Assurance

Fanatics Inc.; New York (NY); Hybrid; USD 110.000 - 140.000; Vollzeit

Zusammenfassung

Fanatics Inc. is seeking an Information Security GRC Analyst III, Controls Assurance to verify the effectiveness of security controls across PCI DSS, SOX ITGC, SOC, and internal baselines. You will collaborate with business units, IT teams, and auditors to collect evidence, run control tests, and drive remediation across Fanatics' brands and subsidiaries.

The role emphasizes practical, risk-based assessment, documentation quality, and cross-framework mapping within a corporate-level GRC program.

Qualifikationen

• Four years+ in IT audit, IT control testing, information security GRC, or a related discipline.
• Demonstrated experience executing control tests to a defined procedure with sampling, evidence evaluation, and documented conclusions.
• Experience with user access reviews, either administering campaigns or testing them as a control.
• Exposure to PCI DSS, SOX ITGC, SOC, or an internal security control baseline.
• Experience driving recurring processes across stakeholders outside a direct reporting line.
• Curiosity to understand Fanatics' subsidiaries and brands and how controls apply.
• Knowledge of core control domains: access management, change management, SDLC, logging, encryption, patch management, backup, cloud fundamentals.

Aufgaben

• Execute assigned control tests with control set owners, including sampling, evidence requests, walkthroughs, and documented conclusions on operating effectiveness.
• Communicate control requirements and testing results clearly to control owners, influencing timely adoption of controls and remediation.
• Prepare workpapers that withstand assessor review without rework.
• Evaluate evidence critically and identify artifacts that do not substantiate the control.
• Support QSA/audit engagements with evidence request lists and walkthrough preparation.
• Support user access review campaigns: scoping, reviewer assignments, and completion monitoring.
• Collect and quality-check evidence for framework cycles, resolving gaps before fieldwork.
• Assist with control exception processes: intake, routing, compensating controls, expiry tracking, re-review.
• Contribute to control reporting and metrics, and maintain GRC workflow in the platform.
• Partner with business units, IT, Security Operations, and GRC counterparts across Fanatics' subsidiaries to apply controls appropriately.

Kenntnisse

IT audit

IT control testing

Information security GRC

Control testing procedures

User access reviews

PCI DSS

SOX ITGC

SOC

NIST 800-53

GRC platforms

Ausbildung

Bachelor's degree in information security/cybersecurity/information systems/accounting or related field

Tools

GRC platform

Jobbeschreibung

Fanatics Inc. is seeking an Information Security GRC Analyst III, Controls Assurance to verify the effectiveness of security controls across PCI DSS, SOX ITGC, SOC, and internal baselines. You will collaborate with business units, IT teams, and auditors to collect evidence, run control tests, and drive remediation across Fanatics' brands and subsidiaries.

The role emphasizes practical, risk-based assessment, documentation quality, and cross-framework mapping within a corporate-level GRC program.