Information Security GRC Analyst III, Controls Assurance

The Role
The Information Security GRC Analyst III Controls Assurance (Fanatics Corporate) sits at the center of how Fanatics proves its security controls actually work testing across PCI DSS SOX ITGC SOC reporting and our internal NIST-aligned control baselines. This is a Corporate-level role with direct exposure across the full Fanatics portfolio: you will work daily with business units IT teams Security Operations and InfoSec GRC counterparts across our subsidiaries and brands giving you a rare enterprise-wide view of how a global multi-brand organization operates and secures itself.

Working in partnership with the designated owner of each control set you will execute assigned control testing collect and evaluate evidence support user access reviews and control exception administration and contribute to findings tracking and control reporting. Control effectiveness is rarely a clean pass or fail; you will need to read the intent behind a control work through the grey areas and take a practical risk-based approach to compensating controls tailored to how each subsidiary or brand actually does business. Strong communication is central to the role: you will explain technical and non-technical control requirements clearly and consistently to control owners and use that clarity to influence timely positive adoption of controls and remediation.

Control baselines and framework control sets are established and owned within the GRC team so this is a controls assurance role rather than a program build-out or control design role. A substantial portion of the work is recurring and deadline-driven including access review cycles evidence collection and assessment calendars.

What Youll Do

• Execute assigned control tests in partnership with control set owners including: sample selection evidence requests walkthroughs and documented conclusions on operating effectiveness.
• Communicate control requirements testing results and rationale clearly and consistently to control owners across technical and non-technical audiences and use that clarity to influence timely positive adoption of controls and remediation.
• Prepare workpapers that withstand assessor review without rework.
• Evaluate evidence critically identifying artifacts that do not substantiate the control.
• Support QSA audit and service auditor engagements including evidence request lists and walkthrough preparation.
• Support user access review campaigns: population scoping reviewer assignments completion monitoring and verification that revocations were executed.
• Collect and quality-check evidence for framework cycles resolving gaps before assessor fieldwork.
• Support the control exception process: intake routing compensating controls expiry tracking and re-review.
• Apply practical risk-based judgment to grey-area control questions including whether a compensating control adequately addresses the underlying risk given how a specific subsidiary or brand operates.
• Identify opportunities to reduce manual evidence collection.
• Help maintain the control library: owners test procedures evidence requirements testing frequency and system mappings.
• Support cross-framework mapping including mapping internal baseline controls to the external requirements they satisfy.
• Support findings tracking and remediation follow-up retesting closed items rather than accepting closure on assertion.
• Contribute to control reporting and metrics and to workflow upkeep in the designated GRC platform.
• Partner day-to-day with business units IT teams Security Operations and InfoSec GRC counterparts across Fanatics subsidiaries and brands understanding how each operates in order to apply controls appropriately.
• Build sufficient depth across control sets to provide backup coverage during leave peak workload or overlapping cycles.

What Were Looking For

• Four years in IT audit IT control testing information security GRC or a related discipline; Big Four or regional firm IT audit experience applies directly.
• Demonstrated experience executing control tests to a defined procedure including sampling evidence evaluation and documented conclusions.
• Experience with user access reviews either administering campaigns or testing them as a control.
• Exposure to at least one of PCI DSS SOX ITGC SOC or an internal security control baseline.
• Experience driving a recurring process across stakeholders outside a direct reporting line with a record of following items to completion.
• Curiosity and adaptability to understand how Fanatics different subsidiaries and brands operate and how that context shapes how a control should be applied and assessed for effectiveness.
• Working knowledge of core control domains: access management and access reviews privileged access change management SDLC logging and monitoring encryption vulnerability and patch management backup and recovery and cloud platform fundamentals.
• Excellent written and verbal communication with the ability to explain technical and non-technical control concepts clearly and consistently to control owners and to influence stakeholders toward timely positive adoption of controls and remediation even without direct authority over them.
• Effective use of approved AI tools in day-to-day work with sound judgment about where AI output can and cannot be relied upon in an audit context.
• Organizational discipline persistence and judgment about when to escalate.
• Detail-oriented with sound judgment for navigating grey areas in control descriptions and a practical risk-based approach to evaluating compensating controls rather than a strict pass/fail mindset.
• Bachelors degree in information security cybersecurity information systems accounting or a related field or equivalent practical experience.
• Preferred: CISA certification.
• Preferred: exposure to two or more of PCI DSS SOX ITGC and SOC including familiarity with PCI DSS v4.0.1 and testing against NIST 800-53 or the NIST Cybersecurity Framework.
• Preferred: familiarity with an enterprise GRC or IRM platform

Required Experience:

IC