Job Description

Company Information
For more than 20 years, AEG has played a pivotal role in transforming sports and live entertainment. Annually, we host more than 160 million guests, promote more than 10,000 shows and present more than 22,000 events around the world. We are committed to innovation, artistry, and community, and leverage the power of our 300+ venues, leading sports franchises, marquee music brands, integrated entertainment districts, premier ticketing platform and global sponsorship activations, to create memorable moments that give the world reason to cheer.
Our business is interwoven with the human mind and heart, and we strive to build a diverse and inclusive company that reflects the artists, athletes, and fans that we host; reach beyond traditional boundaries to support the communities in which we operate; and minimize our impact on the environment by adopting sustainable practices throughout our business operations.
If you want to be challenged to up your game and make a difference, then join us in giving the world reason to cheer!
Job Summary
The GRC Analyst will support the continued evolution of AEG's Governance, Risk & Compliance program with a focus on helping to mature the Enterprise Risk Management (ERM) function. This role will assist in identifying, measuring, and documenting risks across business units, ensuring consistent updates to the enterprise risk register, and supporting leadership visibility into key risk themes. In addition to ERM activities, the GRC Analyst will contribute to compliance assessments, audit readiness, and the integration of risk management into projects, third-party oversight, and security awareness initiatives. This is a hands-on role requiring strong organizational skills, attention to detail, and the ability to collaborate across IT, Operations, Legal, Finance, and other global business functions.
Essential Functions

• Maintain the enterprise risk register; support cross-business risk workshops; document risks, causes, and controls; help track inherent vs. residual risk and remediation progress. Examples include but are not limited to:

• Risk data stewardship & taxonomy. Configure and maintain risk fields (statement, drivers/causes, impacted assets/processes, control mappings, impact/likelihood scales, owners, due dates, KRI linkages) in the GRC platform (e.g., Archer, ServiceNow GRC, OneTrust, LogicGate).
• Control & evidence threading. Map risks to policies/standards and controls; attach evidence links and test results so treatment status and audit readiness are visible from the register.
• Remediation orchestration. Create remediation tasks, owners, SLAs in the GRC workflow; monitor burn down, due date slippage, and inherent?residual deltas; surface trends on heatmaps.
• Develop and refine reports, metrics, and dashboards; translate top risks into a set of leading risk indicators to develop KRIs; prepare materials for quarterly Risk Committee meetings turning the data into a clear narrative and decisions; ensure audit-ready evidence is maintained; keeping a traceable evidence library mapped to each control/risk so internal or external auditors can verify quickly.
• Planning and execute compliance assessments (NIST CSF/800-53, ISO 27001, PCI-DSS) by building assessment plans, defining scope, and sending questionnaires to control owners, collecting the evidence (configs, screenshots, logs), and documenting the results in GRC tool; maintain policies/standards by drafting new policies, reviewing existing ones, routing for approvals, and publishing updates ensuring they align with security and compliance frameworks; support internal/external audits with evidence collection by pulling reports, screenshots, system configs, and linking them to the right control in the GRC tool as well as maintaining an audit-ready library so responses are quick and complete.
• Partner with the IT Vendor Management team to integrate vendor risks into the register; assist with project/system risk reviews to embed compliance and security requirements.
• Lead GRC platform updates; workflows, data integrity optimization, and dashboard maintenance.
• Partner with the SATE Program Manager to create awareness materials and quick guides translating top enterprise risks and recurring control gaps into micro-learnings; embedding ERM concepts into training initiatives.

Required Qualifications

• BA/BS Degree (4-year) BA/BS Degree (4-year) Degree in Information Security, Computer Science, Business, Risk Management, or related field; or equivalent related work experience.
• 2-4 years experience in GRC, compliance, or risk-related roles, ideally in complex/global environments. Experience supporting a risk register, compliance assessments, and audits.
• Experience supporting a risk register, compliance assessments, and audits.
• Experience technical/business experience in complex, global environments.
• Familiarity with ERM concepts (risk taxonomy, appetite/tolerance, inherent/residual risk).
• Working knowledge of compliance frameworks (NIST, ISO 27001, PCI-DSS, GDPR/CPRA).
• Ability to analyze and present risk/control data in business-friendly terms.
• Proficiency with GRC platforms (Archer, ServiceNow GRC, OneTrust, LogicGate) and Microsoft O365.
• Strong written/verbal communication; able to collaborate across functions.
• Highly organized, self-starter, able to manage competing priorities across regions and time zones.
• CISSP Certified Information Systems Security Professional highly preferred
• CISM - Certified Information Security Manager preferred but not required
• Certified Information Systems Auditor (CISA) preferred but not required
• CompTIA Security+ Certification a plus

Pay Scale: $95,000 - 110,000
Bonus: This position is not eligible for a bonus under the current bonus plan requirements.
Benefits: Full-time: We offer a comprehensive benefits package that includes: medical, dental and vision insurance, paid holidays, vacation and sick time, company paid basic life insurance, voluntary life insurance, parental leave, 401k Plan (with a current employer match of 3%), flexible spending and health savings account options, and wellness offerings.
AEG reserves the right to change or modify the employee's job description whether orally or in writing, at any time during the employment relationship. AEG may require an employee to perform duties outside their normal description.
AEG's policy is to hire the most qualified applicants. We are an equal opportunity employer and will not discriminate against any individual, employee, or application for employment on the basis of race, color, marital status, religion, age, sex, sexual orientation, national origin, or any other legally protected status recognized by federal, state or local law.

Skills Required