Information Security GRC Analyst III, Controls Assurance

Controls assurance analyst on Fanatics' corporate information security GRC team, testing whether security controls hold up under PCI DSS, SOX ITGC, SOC reports and the company's NIST-aligned baselines throughout the company's subsidiaries and brands. Based in Jacksonville or New York.

The analyst runs assigned control tests with each control set owner, from sampling and walkthroughs to documented conclusions, prepares workpapers that stand up to assessors, supports QSA and audit engagements, runs user access review campaigns, administers control exceptions and compensating controls, maintains the control library and framework mappings, and retests remediated findings. A large share of the work runs on fixed, recurring deadlines. Fanatics wants four or more years in IT audit, control testing or security GRC, user access review experience and exposure to PCI, SOX or SOC; CISA is preferred.