Senior Technology Governance, Risk & Compliance (GRC) Analyst

THE POSITION Our roster has an opening with your name on it

FanDuel is seeking a Senior Technology Governance, Risk & Compliance (GRC) Analyst to join its Technology GRC team as a strategic specialist supporting our first line of defense (1LOD) function. This role offers a unique opportunity to shape how technology governance, risk management, and compliance work together across the organization. The ideal candidate brings breadth of knowledge and understanding across the full GRC landscape—understanding not just where controls fit, but how governance frameworks drive accountability, how risks cascade through technology systems, and where to plug into partner teams to deliver meaningful outcomes.

At its core, this role is about building and maturing our Technology Unified Controls framework. You will be instrumental in designing and establishing the governance structures and frameworks that define how technology decisions are made, who has authority over critical systems, and how accountability flows through the organization. You'll develop and maintain the comprehensive technology governance policies, standards, and procedures that serve as the backbone for consistent, compliant operations. Beyond creating these frameworks, you'll ensure they remain aligned with enterprise governance principles and regulatory requirements as the landscape evolves.

Across the risk and control landscape, you will navigate the complete control lifecycle. This means collaborating on process discovery to understand how FanDuel workstreams function, identifying controls that address key risks and regulatory requirements, implementing those controls across the technology environment, and establishing testing and continuous assurance mechanisms to ensure controls remain effective. You'll manage issues as they emerge, providing remediation guidance and tracking progress toward resolution. You'll also lead relevant compliance obligations and assessments—whether PCI, SOC2, GLI, state regulatory requirements, or others—ensuring that technology controls specifically address these mandates.

In addition to the specific responsibilities outlined above, employees may be required to perform other such duties as assigned by the Company. This ensures operational flexibility and allows the Company to meet evolving business needs.

THE GAME PLAN Everyone on our team has a part to play

• Lead and mature a risk-based technology control program to design, implement, and monitor the effectiveness of key controls across the Technology organization, ensuring alignment with FanDuel's security frameworks, industry best practices, and regulatory requirements (NIST CSF, GLI-GSF, PCI, SOC2, SOX)
• Navigate the complete control lifecycle - including process discovery, control identification and implementation, testing and continuous assurance, and issue management with remediation guidance bringing along an automation-first mindset
• Develop and deliver executive reports of technology control health, issues, and risk posture
• Serve as the Technology organization's first line point of contact for various compliance activities (e.g. SOC2, PCI, State Regulatory Exams) and act as a primary liaison between audit teams and internal control stakeholders to ensure clear communication of requirements, timelines, and expectations
• Partner with Technology and Enterprise Risk Management teams to maintain FanDuel's technology risk and controls framework, ensuring risks are identified, assessed, documented, and mapped to effective controls aligned with the company's risk appetite
• Advise and support technology control owners during regulatory examinations or internal audits / assessments, including clarifying scope, expectations and timelines, coordinating meetings, facilitating evidence gathering, clarifying issues with relevant SMEs & stakeholders, and developing necessary action plans and management responses
• Develop and maintain comprehensive technology governance policies, standards, and procedures; ensure alignment with enterprise governance principles and regulatory requirements
• Actively develop, support, and maintain FanDuel's GRC tools to provide continuous controls monitoring and consistent control health reporting while pushing forward an audit-ready environment.
• Align control standards with Flutter Entertainment and other brands' GRC groups to push efficiencies and best practices across the enterprise
• Track issues throughout the lifecycle, from initial deviation identification, root cause analysis, remediation plan development, and reporting, as well as supporting resolution and ongoing monitoring
• Lead cross-functional discussions and workshops to enhance awareness and foster continuous improvement across the technology control environment
• Stay abreast of evolving technology & cybersecurity threats, trends, and regulatory changes to enhance control, risk, and governance strategies
• Develop and deliver tailored training and communications on relevant GRC obligations for the technology community, as needed
• Maintain procedures, playbooks, reference documentation, and metrics dashboards
• Assist with special GRC, regulatory, and control assessment and department initiatives, as assigned
• Mentor and guide junior team members, sharing expertise and promoting continuous professional development

THE STATS What we're looking for in our next teammate

• Bachelor’s degree preferred in a technical field (e.g., Cybersecurity, Information Technology) or equivalent combination of education, training, and relevant experience.
• 5+ years related experience across technology and cybersecurity Governance, Risk, and Compliance (GRC), with demonstrated breadth across all three disciplines.
• Hands-on experience navigating the full control lifecycle – process and risk identification, control design and definition, design and operating effectiveness testing, issue management, and remediation tracking.
• Experience conducting technology risk assessments and maintaining risk registers and partnering with risk owners to define and track mitigation strategies aligned to risk appetite.
• In-depth understanding of various IT platform and systems including but not limited to AWS, Okta, GitHub, and Atlassian products.
• Ability to partner with technical stakeholders to discover, analyze, and document comprehensive data flows, establishing a clear line of sight into how data moves across our infrastructure.
• Experience developing or maintaining technology policies, standards, procedures, and supporting governance committees / forums with related reporting.
• Hands-on experience executing and managing IT and security audits or regulatory assessments in a heavily regulated industry, including writing, documenting, and assessing risks/controls and drafting business process summaries for executives.
• “Stay Hungry, Stay Humble” mindset that strives to continu