Governance, Risk Compliance Analyst

The Governance, Risk, & Compliance Analyst supports Fontainebleau Las Vegas's Governance, Risk, and Compliance (GRC) and Privacy programs. This is an entry-level role. Under the direction of GRC leadership, the Analyst supports risk management, regulatory and framework compliance, audit, policy management, and security awareness, with assignments made across these areas as business needs require. The role offers the opportunity to build hands‑on experience across multiple GRC disciplines.

The Analyst works with Information Technology, Digital Technology, Legal, and other business units to help keep FBLV's security and privacy practices documented, tested, and in line with gaming regulations, payment card industry requirements, privacy laws, and internal policy.

The following and other duties may be assigned as necessary. The Analyst will support one or more of the following program areas as assigned:

• Supports vendor risk assessments, including intake, security questionnaires, evidence review, and tracking findings until they are resolved
• Assists with documenting and tracking cybersecurity and IT risks in the risk register, including treatment plans and status updates
• Performs assigned internal IT audit and control testing procedures, including user access reviews, and prepares evidence for gaming regulatory audits, PCI DSS, and other compliance requirements
• Assists with audit coordination and evidence requests, and maps controls to applicable frameworks. Tracks audit findings and corrective actions until they are closed
• Supports the technology Policy and Standard program, including the policy register, review cycles, version control, and approval tracking
• Assists document owners with updates and helps track requests for policy exceptions
• Supports the cybersecurity training and awareness program, including assigning training, tracking completion, and preparing awareness communications
• Reviews phishing simulation results and handles follow-up communications, remedial training, and reporting
• Assists with program metrics and reporting and with keeping GRC tools and documentation current, and supports privacy program activities and other GRC functions as needed
• Temporary or permanent duties and responsibilities may be added to or modified as deemed necessary

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. Must be at least 21 years of age.

• Foundational knowledge of cybersecurity concepts, IT fundamentals (e.g., access management, change management, logging, vulnerability management), and at least one common framework such as the NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001/27002, PCI DSS, or SOC 2, gained through coursework, certification study, internships, or work experience
• Strong written and verbal communication skills, including the ability to translate technical concepts into plain business language
• Strong attention to detail and the ability to follow documented procedures and maintain accurate records.
• Excellent time management skills with the ability to manage multiple priorities and meet deadlines in a fast-paced environment
• Ability to handle sensitive information in a confidential manner
• Excellent interpersonal skills to deal effectively with a varying group of contacts
• Ability to obtain and maintain full knowledge and understanding of Company and department rules and regulations, policies, and procedures
• Working knowledge of Microsoft…