Senior Technology Governance, Risk & Compliance (GRC) Analyst

FanDuel is seeking a Senior Technology Governance, Risk & Compliance (GRC) Analyst to join its Technology GRC team as a strategic specialist supporting its first line of defence (1LOD) function. This role offers a unique opportunity to shape how technology governance, risk management, and compliance work together across the organisation.

The role is focused on building and maturing the Technology Unified Controls framework. The analyst will be instrumental in designing and establishing the governance structures and frameworks that define how technology decisions are made, who has authority over critical systems, and how accountability flows through the organisation. They will develop and maintain comprehensive technology governance policies, standards, and procedures that serve as the backbone for consistent, compliant operations.

Beyond creating these frameworks, the analyst will ensure they remain aligned with enterprise governance principles and regulatory requirements as the landscape evolves. They will navigate the complete control lifecycle, including process discovery, identifying controls that address key risks, implementing those controls, and establishing testing and continuous assurance mechanisms. The role also involves managing issues as they emerge, providing remediation guidance, and leading relevant compliance obligations and assessments.

• Lead and mature a risk-based technology control program to design, implement, and monitor the effectiveness of key controls across the Technology organisation, ensuring alignment with FanDuel's security frameworks, industry best practices, and regulatory requirements (NIST CSF, GLI-GSF, PCI, SOC2, SOX).
• Navigate the complete control lifecycle, including process discovery, control identification and implementation, testing and continuous assurance, and issue management with remediation guidance, bringing along an automation-first mindset.
• Develop and deliver executive reports of technology control health, issues, and risk posture.
• Serve as the Technology organisation's first line point of contact for various compliance activities (e.g. SOC2, PCI, State Regulatory Exams) and act as a primary liaison between audit teams and internal control stakeholders to ensure clear communication of requirements, timelines, and expectations.
• Partner with Technology and Enterprise Risk Management teams to maintain FanDuel's technology risk and controls framework, ensuring risks are identified, assessed, documented, and mapped to effective controls aligned with the company's risk appetite.
• Advise and support technology control owners during regulatory examinations or internal audits/assessments, including clarifying scope, expectations and timelines, coordinating meetings, facilitating evidence gathering, clarifying issues with relevant SMEs & stakeholders, and developing necessary action plans and management responses.
• Develop and maintain comprehensive technology governance policies, standards, and procedures; ensure alignment with enterprise governance principles and regulatory requirements.
• Actively develop, support, and maintain FanDuel's GRC tools to provide continuous controls monitoring and consistent control health reporting while pushing forward an audit-ready environment.
• Align control standards with Flutter Entertainment and other brands' GRC groups to push efficiencies and best practices across the enterprise.
• Track issues throughout the lifecycle, from initial deviation identification, root cause analysis, remediation plan development, and reporting, as well as supporting resolution and ongoing monitoring.
• Lead cross-functional discussions and workshops to enhance awareness and foster continuous improvement across the technology control environment.
• Stay abreast of evolving technology & cybersecurity threats, trends, and regulatory changes to enhance control, risk, and governance strategies.
• Develop and deliver tailored training and communications on relevant GRC obligations for the technology community, as needed.
• Maintain procedures, playbooks, reference documentation, and metrics dashboards.
• Assist with special GRC, regulatory, and control assessment and department initiatives, as assigned.
• Mentor and guide junior team members, sharing expertise and promoting continuous professional development.

• Bachelor’s degree preferred in a technical field (e.g., Cybersecurity, Information Technology) or equivalent combination of education, training, and relevant experience (preferred).
• 5+ years related experience across technology and cybersecurity Governance, Risk, and Compliance (GRC), with demonstrated breadth across all three disciplines (required).
• Hands-on experience navigating the full control lifecycle – process and risk identification, control design and definition, design and operating effectiveness testing, issue management, and remediation tracking (required).
• Experience conducting technology risk assessments and maintaining risk registers and partnering with risk owners to define and track mitigation strategies aligned to risk appetite (required).
• In-depth understanding of various IT platform and systems including but not limited to AWS, Okta, GitHub, and Atlassian products (required).
• Ability to partner with technical stakeholders to discover, analyze, and document comprehensive data flows, establishing a clear line of sight into how data moves across our infrastructure (required).
• Experience developing or maintaining technology policies, standards, procedures, and supporting governance committees / forums with related reporting (required).
• Hands-on experience executing and managing IT and security audits or regulatory assessments in a heavily regulated industry, including writing, documenting, and assessing risks/controls and drafting business process summaries for executives (required).
• Strong IT & security risk domain knowledge of technology and cybersecurity best practices, principles, tools, and industry control frameworks (e.g., GLI-33b, GLI-19, NIST 800-53, NIST CSF, SOX, SOC2, PCI) (required).
• Knowledge of qualitative and quantitative risk management methodologies (e.g., NIST RMF / 800-37 / 800-30, FAIR) (required).
• Ability to translate risk/control standards into functional business requirements (required).
• Strong written and verbal communication skills to articulate GRC insights to both technical and non-technical stakeholders (required).
• Proficient working with Microsoft Office, GRC and project management tools (e.g., Optro, Anecdotes, Jira, Sharepoint) (required).
• Experience working as a consultant in the risk, compliance, or audit space is a plus (nice-to-have).
• Relevant professional certifications such as CISA, CISM, CISSP, CRISC, CGEIT, CCSK/CCSP, PCI ISA/QSA, Security+ are preferred (preferred).

• Health plans including programs for fertility and family planning, mental health support, and fitness benefits.
• Generous paid time off (PTO) and sick leave.
• Annual bonus and long-term incentive opportunities (based on performance).
• 401k with up to a 5% match.
• Commuter benefits.
• Pet insurance.
• 14 paid company holidays.

FanDuel Group is an innovative sports-tech entertainment company that is changing the way consumers engage with their favorite sports, teams, and leagues. The premier gaming destination in the North America, FanDuel Group consists of a portfolio of leading brands across gaming, sports betting, daily fantasy sports, advance-deposit wagering, and TV/media, including FanDuel, Stardust Casino and TVG. The company is based in New York with US offices in Los Angeles, Atlanta, and Jersey City, as well as global offices in Canada and Scotland. The company’s affiliates have offices worldwide, including in Ireland, Portugal, Romania, and Australia. FanDuel Group is a subsidiary of Flutter Entertainment, the world's largest sports betting and gaming operator with a portfolio of globally recognized brands and traded on the New York Stock Exchange (NYSE: FLUT).

Read more about FanDuel →