IT Controls Manager

SUMMARY: 

The IT Controls Manager leads the development, implementation, and oversight of IT governance, risk, and compliance programs. Serving as the primary coordinator for technology audits, assessments, and policy management, this role ensures rigorous alignment with regulatory, legal, and industry standards. By partnering closely with IT, Internal Audit, Gaming Operations, Finance, Human Resources, and external regulators, the manager drives remediation efforts and cross-functional initiatives to mitigate organizational risk and strengthen cybersecurity practices.

MINIMUM NECESSARY QUALIFICATIONS: 

Education:

•    High School diploma or GED

•    2-year degree in a computer-related discipline and 2 years of experience in IT governance, internal controls, risk management, policy administration, or technology controls; or 4 years of work experience in IT governance, internal controls, risk management, policy administration, or technology controls

Experience:

●    Minimum of 2 years of hands-on experience in IT governance, cybersecurity, information security, risk management, auditing, or a closely related field

●    Background using enterprise tools for governance, risk, controls, identity management, security monitoring, vulnerability management, audit management, policy management, and administration

●    Experience supporting audits, regulatory examinations, and working within regulated sectors (strongly preferring gaming, hospitality, financial services, healthcare, or government)

●    Experience working with a Tribally run casino and/or resort preferred

Preferred Certifications Must hold or be pursuing one or more of the following:

•    Certified Information Systems Auditor (CISA)

•    Certified Information Systems Security Professional (CISSP)

•    Certified in Risk and Information Systems Control (CRISC)

•    Certified Information Security Manager (CISM)

•    PCI Professional (PCIP)

•    Certified Internal Auditor (CIA)

A documented and verifiable combination of education and experience may be substituted for degree requirements.

Age Requirement:

●    At least 21 years of age

SKILLS AND ABILITIES:

•    Excellent computer skills with experience in word processing, databases, and spreadsheets

•    Ability to maintain privacy and data protection regulations

•    Strong analytical and problem-solving abilities

•    Excellent organizational, written and verbal communication skills

•    Excellent problem-solving skills 

•    Accurate and detail-oriented 

•    Ability to interpret complex regulatory requirements

•    Ability to maintain confidentiality of sensitive information

•    Ability to effectively communicate with regulators, auditors, executives, and technical personnel

•    Ability to manage multiple extensive amounts of paperwork

•    Ability to work independently with minimal supervision

•    Ability to build collaborative relationships across departments

CONDITIONS OF EMPLOYMENT:

Conditions of employment with Little River Casino Resort include passing a pre-employment drug test excluding marijuana, a background investigation to secure a license from the Little River Band of Ottawa Indians Gaming Commission, passing Resort background check to meet the employment eligibility requirements as they pertain to the position and successfully completing a 90-day introductory period.  

Individual must not have been charged or released from employment or involved in anything which could be considered a liability to the Resort, e.g. harassment, theft, violence, or integrity issues.

ESSENTIAL DUTIES AND RESPONSIBILITIES:

•    Develop, implement, and maintain IT governance programs, controls, policies, and procedures. 

•    Ensure compliance with applicable Tribal, Federal, State, and Gaming regulatory requirements, including TMICS, Gaming Commission, and GLI standards. 

•    Monitor and enforce adherence to internal policies, cybersecurity standards, and regulatory controls. 

•    Coordinate governance, compliance, and audit activities across departments to support organizational objectives. 

•    Serve as the primary point of contact for regulatory examinations, audits, and controls reviews. 

•    Track audit findings and recommendations; coordinate and monitor remediation efforts to ensure timely resolution. 

•    Conduct risk assessments of information systems, processes, vendors, and technologies. 

•    Maintain accurate documentation to support audit readiness, regulatory compliance, and controls validation. 

•    Support the implementation, maintenance, and monitoring of cybersecurity frameworks and controls. 

•    Participate in security assessments, vulnerability management, and incident response activities as needed. 

•    Coordinate cybersecurity awareness and governance training programs for Team Members. 

•    Manage regulatory submissions and maintain supporting documentation for inspections and audits. 

•    Support privacy and data protection initiatives, including the handling of PII and other sensitive information. 

•    Participate in privacy impact assessments and controls reviews. 

•    Evaluate and monitor third-party vendors for compliance with governance, security, and risk requirements. 

•    Assist with third-party risk management activities, including review of vendor audits, certifications, and contracts. 

•    Maintain and update IT governance documentation to ensure accuracy and alignment with regulatory requirements. 

•    Track regulatory changes and provide recommendations regarding impacts to governance and controls. 

•    Promote a culture of compliance, accountability, and security awareness throughout the organization. 

•    Provide guidance and support to leadership and Team Members regarding governance, controls, and regulatory requirements. 

PHYSICAL DEMANDS: 

While performing the duties of this job, the team member may be required to frequently stand, walk, sit, bend, twist, talk, hear, and perform repetitive motions. There may be prolonged periods of sitting, keyboarding, and reading. Must have manual dexterity necessary to manipulate all computer/video equipment. Must be able to perform repetitive hand and wrist motions.  The team member must occasionally be able to push, pull, grasp, lift and/or move up to 50 pounds routinely.  Any lifting and/or moving over 50 pounds needs to be done in a team lift. Specific vision abilities required by this job include reading, document, computer, distance, and color vision. Talking and hearing are essential to communicate with team members, vendors, and guests in individual, department, small and/or large group meetings. Communication in face-to-face discussions, telephone, emails, and other electronic ways required. Must have a good sense of balance and be able to bend and kneel.  

WORKING ENVIRONMENT:

A working environment is the setting, social features, and physical conditions in which a job is performed. The general working environment for the Resort is office, gaming floor, food outlet, hotel and convention/entertainment center including flashing lights, frequent loud noises, and a smoke-filled environment. Must be flexible with work schedule for any hours and/or shift, as assigned, according to business needs. Occasional overtime required. Occasionally must deal with angry or hostile individuals. Extensive computer use.  

DISCLAIMER OF EMPLOYMENT:

The above statements are intended to describe the general nature and level of work being performed by people assigned to this job description. It shall govern all positions as defined in the Team Member Handbook. They are not intended to be construed as an exhaustive list of all responsibilities, duties and skills required.

All Little River Casino Resort Team Members are responsible to ensure they are in compliance with Little River Casino Resort Policies and Tribal Gaming Regulations.

ACKNOWLEDGMENT: 

I have reviewed the content and description of the above listed position and have been provided a copy of the description. I certify that I am able to perform the essential functions of this position as outlined in this description, with or without reasonable accommodation.