Governance, Risk, & Compliance Analyst
About The Position
The Governance, Risk, & Compliance Analyst supports Fontainebleau Las Vegas's Governance, Risk, and Compliance (GRC) and Privacy programs. This entry-level role works under the direction of GRC leadership and supports risk management, regulatory and framework compliance, audits, policy management, and security awareness. Assignments across these areas depend on business needs, offering hands-on experience in multiple GRC disciplines. The Analyst works with Information Technology, Digital Technology, Legal, and other business units to help ensure security and privacy practices are documented, tested, and aligned with gaming regulations, payment card industry requirements, privacy laws, and internal policy. The position has no supervisory responsibilities. The role requires the ability to work a flexible schedule that includes holidays, nights, and weekends, and the ability to obtain and maintain any required gaming registration or license.
Requirements
- Must be at least 21 years of age.
- Foundational knowledge of cybersecurity concepts, IT fundamentals such as access management, change management, logging, and vulnerability management, and at least one common framework such as NIST CSF, NIST SP 800-53, ISO/IEC 27001/27002, PCI DSS, or SOC 2. Knowledge may be gained through coursework, certification study, internships, or work experience.
- Strong written and verbal communication skills, including the ability to explain technical concepts in plain business language.
- Strong attention to detail and the ability to follow documented procedures and maintain accurate records.
- Excellent time management and the ability to manage multiple priorities and meet deadlines in a fast-paced environment.
- Ability to handle sensitive information confidentially.
- Excellent interpersonal skills to work effectively with a varied group of contacts.
- Ability to obtain and maintain full knowledge and understanding of Company and department rules, regulations, policies, and procedures.
- Working knowledge of Microsoft Office Suite, including Excel, Word, SharePoint, and Teams.
- Professional appearance and demeanor.
- Ability to qualify for licenses and permits required by federal, state, and local regulations, and to obtain and maintain the gaming registration or license required by the Nevada Gaming Control Board.
- Ability to read, analyze, and interpret regulations, technical standards, contracts, audit reports, and policy documents in English; write reports, findings, policies, and business correspondence in English; and present information effectively to Members, management, auditors, and vendors.
- Ability to apply analytical and critical thinking to evaluate controls, identify risks, and interpret regulatory and framework requirements; define problems, collect data, establish facts, and draw valid conclusions; and handle several variables where standardization is limited.
- Must be willing and able to work a flexible schedule that includes holidays, nights, and weekends.
Nice To Haves
- Bachelor's degree in Information Security, Information Systems, Computer Science, Business, or a related field, or an equivalent combination of education and experience.
- One to three years of experience in cybersecurity GRC, IT audit, risk management, privacy, or a related field, or relevant internship experience.
- Experience in the gaming or hospitality industry, including knowledge of Nevada Gaming Control Board Minimum Internal Control Standards (MICS) for IT or other gaming regulatory requirements.
- Hands-on experience with GRC or compliance automation platforms or security awareness training platforms.
- An entry-level certification, or active progress toward one, such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or ISACA IT Audit Fundamentals.
Responsibilities
- Support vendor risk assessments, including intake, security questionnaires, evidence review, and tracking findings until resolution.
- Assist with documenting and tracking cybersecurity and IT risks in the risk register, including treatment plans and status updates.
- Perform assigned internal IT audit and control testing procedures, including user access reviews, and prepare evidence for gaming regulatory audits, PCI DSS, and other compliance requirements.
- Assist with audit coordination and evidence requests, map controls to applicable frameworks, and track findings and corrective actions through closure.
- Support the technology Policy and Standard program, including the policy register, review cycles, version control, and approval tracking.
- Assist document owners with policy updates and track requests for policy exceptions.
- Support cybersecurity training and awareness, including assigning training, tracking completion, and preparing awareness communications.
- Review phishing simulation results and manage follow-up communications, remedial training, and reporting.
- Assist with program metrics and reporting, keep GRC tools and documentation current, and support privacy program activities and other GRC functions as needed.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Entry Level
Education Level
No Education Listed
