Senior InfoSec GRC Analyst – Controls Assurance

Fanatics; New York (NY); On-site; USD 120,000 - 160,000; Full time

Job summary

Fanatics seeks an Information Security GRC Analyst III, Controls Assurance to verify security controls across PCI DSS, SOX ITGC, SOC, and NIST baselines in a global corporate setting. You will work with business units, IT teams, and auditors to test controls, gather evidence, and report findings.

The role emphasizes practical risk-based judgments, collaboration across Fanatics' subsidiaries, and ongoing control library maintenance. NYC-based, on-site position.

Qualifications

• Four years+ in IT audit, IT control testing, information security GRC.
• Experience with PCI DSS, SOX ITGC, SOC or equivalent control baselines.
• Experience driving recurring processes with stakeholders outside direct reporting lines.
• Excellent written and verbal communication to explain technical concepts clearly.

Responsibilities

• Execute control tests with owners, including sampling, evidence requests, and conclusions.
• Communicate control requirements and testing results to control owners.
• Prepare workpapers that withstand assessor review.
• Evaluate evidence and identify non-substantial artifacts.
• Support audits and service auditor engagements.
• Manage user access review campaigns: population scoping and completion monitoring.
• Collect and quality-check evidence for framework cycles.

Skills

IT audit

IT control testing

information security GRC

PCI DSS

SOX ITGC

SOC

risk-based assessment

communication

Cross-functional collaboration

Education

Bachelor's degree in information security / cybersecurity / information systems

CISA certification

Tools

GRC platform

AI tools

PCI DSS tooling

Job description

Fanatics seeks an Information Security GRC Analyst III, Controls Assurance to verify security controls across PCI DSS, SOX ITGC, SOC, and NIST baselines in a global corporate setting. You will work with business units, IT teams, and auditors to test controls, gather evidence, and report findings.

The role emphasizes practical risk-based judgments, collaboration across Fanatics' subsidiaries, and ongoing control library maintenance. NYC-based, on-site position.