Governance, Risk, & Compliance Analyst

What the role needs

• The following and other duties may be assigned as necessary. The Analyst will support one or more of the following program areas as assigned:
• Supports vendor risk assessments, including intake, security questionnaires, evidence review, and tracking findings until they are resolved
• Assists with documenting and tracking cybersecurity and IT risks in the risk register, including treatment plans and status updates
• Performs assigned internal IT audit and control testing procedures, including user access reviews, and prepares evidence for gaming regulatory audits, PCI DSS, and other compliance requirements
• Assists with audit coordination and evidence requests, and maps controls to applicable frameworks. Tracks audit findings and corrective actions until they are closed
• Supports the technology Policy and Standard program, including the policy register, review cycles, version control, and approval tracking
• Assists document owners with updates and helps track requests for policy exceptions
• Supports the cybersecurity training and awareness program, including assigning training, tracking completion, and preparing awareness communications
• Reviews phishing simulation results and handles follow-up communications, remedial training, and reporting
• Assists with program metrics and reporting and with keeping GRC tools and documentation current, and supports privacy program activities and other GRC functions as needed
• Temporary or permanent duties and responsibilities may be added to or modified as deemed necessary
• Strong written and verbal communication skills, including the ability to translate technical concepts into plain business language

From the employer

POSITION OVERVIEW The Governance, Risk, & Compliance Analyst supports Fontainebleau Las Vegas's Governance, Risk, and Compliance (GRC) and Privacy programs. This is an entry-level role. Under the direction of GRC leadership, the Analyst supports risk management, regulatory and framework compliance, audit, policy management, and security awareness, with assignments made across these areas as business needs require. The role offers the opportunity to build hands-on experience across multiple GRC disciplines. The Analyst works with Information Technology, Digital Technology, Legal, and other business units to help keep FBLV's security and privacy practices documented, tested, and in line with gaming regulations, payment card industry requirements, privacy laws, and internal policy. ESSENTIAL DUTIES AND RESPONSIBILITIES The following and other duties may be assigned as necessary. The Analyst will support one or more of the following program areas as assigned: • Supports vendor risk assessments, including intake, security questionnaires, evidence review, and tracking findings until they are resolved • Assists with documenting and tracking cybersecurity and IT risks in the risk register, including treatment plans and status updates • Performs assigned internal IT audit and control testing procedures, including user access reviews, and prepares evidence for gaming regulatory audits, PCI DSS, and other compliance requirements • Assists with audit coordination and evidence requests, and maps controls to applicable frameworks. Tracks audit findings and corrective actions until they are closed • Supports the technology Policy and Standard program, including the policy register, review cycles, version control, and approval tracking • Assists document owners with updates and helps track requests for policy exceptions • Supports the cybersecurity training and awareness program, including assigning training, tracking completion, and preparing awareness communications • Reviews phishing simulation results and handles follow-up communications, remedial training, and reporting • Assists with program metrics and reporting and with keeping GRC tools and documentation current, and supports privacy program activities and other GRC functions as needed • Temporary or permanent duties and responsibilities may be added to or modified as deemed necessary QUALIFICATION REQUIREMENTS To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. Must be at least 21 years of age. • Foundational knowledge of cybersecurity concepts, IT fundamentals (e.g., access management, change management, logging, vulnerability management), and at least one common framework such as the NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001/27002, PCI DSS, or SOC 2, gained through coursework, certification study, internships, or work experience • Strong written and verbal communication skills, including the ability to translate technical concepts into plain business language • Strong attention to detail and the ability to follow documented procedures and maintain accurate records. • Excellent time management skills with the ability to manage multiple priorities and meet deadlines in a fast-paced environment • Ability to handle sensitive information in a confidential manner • Excellent interpersonal skills to deal effectively with a varying group of contacts • Ability to obtain and maintain full knowledge and understanding of Company and department rules and regulations, policies, and procedures • Working knowledge of Microsoft Office Suite (Excel, Word, SharePoint, Teams). • Professional appearance and demeanor • Bachelor's degree in Information Security, Information Systems, Computer Science, Business, or a related field and/or equivalent combination of education and experience preferred • One to three (1-3) years of experience in cybersecurity GRC, IT audit, risk management, privacy, or a related field, or relevant internship experience, preferred • Experience in the gaming or hospitality industry, including knowledge of Nevada Gaming Control Board (NGCB) Minimum Internal Control Standards (MICS) for IT or other gaming regulatory requirements, preferred • Hands-on experience with GRC or compliance automation platforms or security awareness training platforms, preferred • Entry-level certification, or active progress toward one, such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or ISACA IT Audit Fundamentals, preferred • Must be willing and able to work a flexible schedule to include holidays, nights, and weekends. SUPERVISORY RESPONSIBILITIES This job does not have any supervisory responsibilities. DIVERSITY COMMITMENT Fontainebleau Las Vegas is committed to ensuring an inclusive space and sense of belonging for our Members. We believe our workforce should reflect the vast diversity of the communities we serve, and that diverse voices should be intentionally integrated into our work. We foster a culture of difference and diversity of identity, experience, and perspective, while actively striving for inclusive behaviors across our Company. By promoting these values and continuously pushing for better, we aim to create a positive work environment that encourages equality, inclusion, empowerment, and respect. CERTIFICATES, LICENSES, REGISTRATIONS Member must be able to qualify for licenses and permits required by federal, state, and local regulations. Member must be able to obtain and maintain the gaming registration or license required by the Nevada Gaming Control Board for this position. LANGUAGE SKILLS Ability to read, analyze, and interpret regulations, technical standards, contracts, audit reports, and policy documents in English. Ability to write reports, findings, policies, and business correspondence in English. Ability to present information effectively to Members, management, auditors, and vendors. REASONING ABILITY Ability to apply analytical and critical thinking to evaluate controls, identify risks, and interpret regulatory and framework requirements. Ability to define problems, collect data, establish facts, and draw valid conclusions. Ability to handle several variables in situations where only limited standardization exists. PHYSICAL DEMANDS The physical demands described here are representative of those that must be met by a Member to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. While performing the duties of this job, the Member is regularly required to stand and use hands and fingers to handle or utilize objects, tools, or controls. The Member frequently is required to reach with hands and arms and talk or hear. Specific vision abilities required by this job include close vision and peripheral vision. The Member must regularly lift and/or move up to 10 pounds, frequently lift and/or move up to 25 pounds, and occasionally lift and/or move up to 50 pounds, and must have the ability to push, pull, reach, bend, twist, stoop, stack, crouch, kneel and balance when performing job duties in varying work areas such as confined spaces. WORK ENVIRONMENT The work environment characteristics described here are representative of those a Member encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. The noise level in the work environment is usually moderate. Member could be exposed to an environment containing unrestricted secondhand tobacco smoke. PAY TRANSPARENCY Fontainebleau Las Vegas believes in developing and supporting our talent into the future. Our compensation program is designed to attract, motivate, and retain talented Members who are the driving force behind the Company's success. We strive to provide market-competitive compensation. Salary will be commensurate with experience and skill set, considering a candidate's qualifications, skills, competencies, and experience, as well as internal equity and market data alignment. In alignment with our Company culture, we will strive to communicate openly about the goals of the Company and the design of the compensation program. The compensation process is designed to be fair and simple so that all Members and managers understand the Company's goals and future career development opportunities for upward mobility. SALARY $80000.00 per year - $100000.00 per year