{"id":1201520,"url":"https://alion.io/job/fanatics-information-security-grc-analyst-iii-controls-assurance","title":"Information Security GRC Analyst III, Controls Assurance","company":{"id":8790,"name":"Fanatics","domain":"fanaticsinc.com","url":"https://alion.io/company/fanatics-inc","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":78,"open_postings":3,"ghost_share":0,"stale_share":0.667,"repost_share":0,"time_to_fill_p50_days":83,"computed_at":"2026-11-02T06:13:15Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Jacksonville, United States","New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":120000,"max":160000,"currency":"USD","period":"year","gross":null,"usd_annual":160000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"NIST 800-53","optional":false},{"name":"PCI DSS","optional":false}],"status":"closed","first_seen_at":"2026-09-24T19:19:31Z","employer_posted_date":"2026-10-08","last_verified_at":"2026-10-30T20:37:49Z","board_verified":false,"closed_at":"2026-10-30T20:37:49Z","days_open":36,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":36},"description":"About Us\nFanatics is building a leading global digital sports platform. We ignite the passions of global sports fans and maximize the presence and reach for our hundreds of sports partners globally by offering products and services across Fanatics Commerce, Fanatics Collectibles, and Fanatics Betting & Gaming, allowing sports fans to Buy, Collect, and Bet. Through the Fanatics platform, sports fans can buy licensed fan gear, jerseys, lifestyle and streetwear products, headwear, and hardgoods; collect physical and digital trading cards, sports memorabilia, and other digital assets; and bet as the company builds its Sportsbook and iGaming platform. Fanatics has an established database of over 100 million global sports fans; a global partner network with approximately 900 sports properties, including major national and international professional sports leagues, players associations, teams, colleges, college conferences and retail partners, 2,500 athletes and celebrities, and 200 exclusive athletes; and over 2,000 retail locations, including its Lids retail stores. Our more than 22,000 employees are committed to relentlessly enhancing the fan experience and delighting sports fans globally. \nThe Role\nThe Information Security GRC Analyst III, Controls Assurance (Fanatics Corporate) sits at the center of how Fanatics proves its security controls actually work, testing across PCI DSS, SOX ITGC, SOC reporting, and our internal NIST-aligned control baselines. This is a Corporate-level role with direct exposure across the full Fanatics portfolio: you will work daily with business units, IT teams, Security Operations, and InfoSec GRC counterparts across our subsidiaries and brands, giving you a rare, enterprise-wide view of how a global, multi-brand organization operates and secures itself.\nWorking in partnership with the designated owner of each control set, you will execute assigned control testing, collect and evaluate evidence, support user access reviews and control exception administration, and contribute to findings tracking and control reporting. Control effectiveness is rarely a clean pass or fail; you will need to read the intent behind a control, work through the grey areas, and take a practical, risk-based approach to compensating controls, tailored to how each subsidiary or brand actually does business. Strong communication is central to the role: you will explain technical and non-technical control requirements clearly and consistently to control owners, and use that clarity to influence timely, positive adoption of controls and remediation.\nControl baselines and framework control sets are established and owned within the GRC team, so this is a controls assurance role rather than a program build-out or control design role. A substantial portion of the work is recurring and deadline-driven, including access review cycles, evidence collection, and assessment calendars.\nWhat You'll Do \nExecute assigned control tests in partnership with control set owners, including: sample selection, evidence requests, walkthroughs, and documented conclusions on operating effectiveness.\nCommunicate control requirements, testing results, and rationale clearly and consistently to control owners across technical and non-technical audiences, and use that clarity to influence timely, positive adoption of controls and remediation.\nPrepare workpapers that withstand assessor review without rework.\nEvaluate evidence critically, identifying artifacts that do not substantiate the control.\nSupport QSA, audit, and service auditor engagements, including evidence request lists and walkthrough preparation.\nSupport user access review campaigns: population scoping, reviewer assignments, completion monitoring, and verification that revocations were executed.\nCollect and quality-check evidence for framework cycles, resolving gaps before assessor fieldwork.\nSupport the control exception process: intake, routing, compensating controls, expiry tracking, and re-review.\nApply practical, risk-based judgment to grey-area control questions, including whether a compensating control adequately addresses the underlying risk given how a specific subsidiary or brand operates.\nIdentify opportunities to reduce manual evidence collection.\nHelp maintain the control library: owners, test procedures, evidence requirements, testing frequency, and system mappings.\nSupport cross-framework mapping, including mapping internal baseline controls to the external requirements they satisfy.\nSupport findings tracking and remediation follow-up, retesting closed items rather than accepting closure on assertion.\nContribute to control reporting and metrics, and to workflow upkeep in the designated GRC platform.\nPartner day-to-day with business units, IT teams, Security Operations, and InfoSec GRC counterparts across Fanatics' subsidiaries and brands, understanding how each operates in order to apply controls appropriately.\nBuild sufficient depth across control sets to provide backup coverage during leave, peak workload, or overlapping cycles.\nWhat We're Looking For \nFour years + in IT audit, IT control testing, information security GRC, or a related discipline; Big Four or regional firm IT audit experience applies directly.\nDemonstrated experience executing control tests to a defined procedure, including sampling, evidence evaluation, and documented conclusions.\nExperience with user access reviews, either administering campaigns or testing them as a control.\nExposure to at least one of PCI DSS, SOX ITGC, SOC, or an internal security control baseline.\nExperience driving a recurring process across stakeholders outside a direct reporting line, with a record of following items to completion.\nCuriosity and adaptability to understand how Fanatics' different subsidiaries and brands operate, and how that context shapes how a control should be applied and assessed for effectiveness.\nWorking knowledge of core control domains: access management and access reviews, privileged access, change management, SDLC, logging and monitoring, encryption, vulnerability and patch management, backup and recovery, and cloud platform fundamentals.\nExcellent written and verbal communication, with the ability to explain technical and non-technical control concepts clearly and consistently to control owners, and to influence stakeholders toward timely, positive adoption of controls and remediation, even without direct authority over them.\nEffective use of approved AI tools in day-to-day work, with sound judgment about where AI output can and cannot be relied upon in an audit context.\nOrganizational discipline, persistence, and judgment about when to escalate.\nDetail-oriented, with sound judgment for navigating grey areas in control descriptions and a practical, risk-based approach to evaluating compensating controls rather than a strict pass/fail mindset.\nBachelor's degree in information security, cybersecurity, information systems, accounting, or a related field, or equivalent practical experience.\nPreferred: CISA certification.\nPreferred: exposure to two or more of PCI DSS, SOX ITGC, and SOC, including familiarity with PCI DSS v4.0.1, and testing against NIST 800-53 or the NIST Cybersecurity Framework.\nPreferred: familiarity with an enterprise GRC or IRM platform\nThe salary range represents base pay only and does not include short-term or long-term incentive compensation. This salary range is specific to New York City and may not be applicable to other locations. When determining base pay, as part of a final compensation package, we consider several factors such as location, experience, qualifications, and training. For information about our benefits, please visit https://benefitsatfanatics.com/\nNYC Salary Range\n$120,000—$160,000 USD\nBy submitting your application, you agree to our terms of service and acknowledge you have read our Candidate Privacy Policy.\nFanatics will never ask candidates for money, banking information, or other sensitive personal information as part of the interview process. If you receive a suspicious message claiming to be from Fanatics recruiting, please do not respond and report it here.","description_format":"text","description_chars":8168,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Sports Betting","Sportswear & Activewear","Collectibles & Trading Cards"],"lifecycle":[{"event":"open","at":"2026-09-24T21:08:29Z"},{"event":"close","at":"2026-10-30T20:37:49Z"}],"visa":[],"liveness":null,"pay":{"stated_usd_annual":160000,"is_top_pay":true},"html_url":"https://alion.io/job/fanatics-information-security-grc-analyst-iii-controls-assurance","json_url":"https://alion.io/job/fanatics-information-security-grc-analyst-iii-controls-assurance.json","meta":{"generated_at":"2026-11-02T15:48:28Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21977,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8790},"rest":"https://alion.io/mcp/rest/get_company?id=8790"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffanatics-information-security-grc-analyst-iii-controls-assurance"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffanatics-information-security-grc-analyst-iii-controls-assurance"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffanatics-information-security-grc-analyst-iii-controls-assurance"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/fanatics-information-security-grc-analyst-iii-controls-assurance\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffanatics-information-security-grc-analyst-iii-controls-assurance"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":1201520}},{"tool":"search_jobs","arguments":{"company":"fanaticsinc.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":1201520},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}