Project Controls Analyst Jobs in New York
Project Controls Analyst jobs in New York are concentrated in the construction, infrastructure, and capital programs sectors, with demand at every level from junior cost engineers through senior program controllers. New York City, Buffalo, and Albany account for the heaviest hiring, anchored by large employers such as Turner Construction, AECOM, and the MTA, which maintain deep project controls teams across major public and private developments. The most sought-after specialties in New York are earned value management, schedule analysis for large-scale transit and utility projects, and cost forecasting on multi-year capital programs. Find a role that fits below and apply directly.
Find Project Controls Analyst JobsOverview
Showing 4 of 6+ Project Controls Analyst jobs
About Us
The Role
The Information Security GRC Analyst III, Controls Assurance (Fanatics Corporate) sits at the center of how Fanatics proves its security controls actually work, testing across PCI DSS, SOX ITGC, SOC reporting, and our internal NIST-aligned control baselines. This is a Corporate-level role with direct exposure across the full Fanatics portfolio: you will work daily with business units, IT teams, Security Operations, and InfoSec GRC counterparts across our subsidiaries and brands, giving you a rare, enterprise-wide view of how a global, multi-brand organization operates and secures itself.
Working in partnership with the designated owner of each control set, you will execute assigned control testing, collect and evaluate evidence, support user access reviews and control exception administration, and contribute to findings tracking and control reporting. Control effectiveness is rarely a clean pass or fail; you will need to read the intent behind a control, work through the grey areas, and take a practical, risk-based approach to compensating controls, tailored to how each subsidiary or brand actually does business. Strong communication is central to the role: you will explain technical and non-technical control requirements clearly and consistently to control owners, and use that clarity to influence timely, positive adoption of controls and remediation.
Control baselines and framework control sets are established and owned within the GRC team, so this is a controls assurance role rather than a program build-out or control design role. A substantial portion of the work is recurring and deadline-driven, including access review cycles, evidence collection, and assessment calendars.
What You'll Do
- Execute assigned control tests in partnership with control set owners, including: sample selection, evidence requests, walkthroughs, and documented conclusions on operating effectiveness.
- Communicate control requirements, testing results, and rationale clearly and consistently to control owners across technical and non-technical audiences, and use that clarity to influence timely, positive adoption of controls and remediation.
- Prepare workpapers that withstand assessor review without rework.
- Evaluate evidence critically, identifying artifacts that do not substantiate the control.
- Support QSA, audit, and service auditor engagements, including evidence request lists and walkthrough preparation.
- Support user access review campaigns: population scoping, reviewer assignments, completion monitoring, and verification that revocations were executed.
- Collect and quality-check evidence for framework cycles, resolving gaps before assessor fieldwork.
- Support the control exception process: intake, routing, compensating controls, expiry tracking, and re-review.
- Apply practical, risk-based judgment to grey-area control questions, including whether a compensating control adequately addresses the underlying risk given how a specific subsidiary or brand operates.
- Identify opportunities to reduce manual evidence collection.
- Help maintain the control library: owners, test procedures, evidence requirements, testing frequency, and system mappings.
- Support cross-framework mapping, including mapping internal baseline controls to the external requirements they satisfy.
- Support findings tracking and remediation follow-up, retesting closed items rather than accepting closure on assertion.
- Contribute to control reporting and metrics, and to workflow upkeep in the designated GRC platform.
- Partner day-to-day with business units, IT teams, Security Operations, and InfoSec GRC counterparts across Fanatics' subsidiaries and brands, understanding how each operates in order to apply controls appropriately.
- Build sufficient depth across control sets to provide backup coverage during leave, peak workload, or overlapping cycles.
What We're Looking For
- Four years + in IT audit, IT control testing, information security GRC, or a related discipline; Big Four or regional firm IT audit experience applies directly.
- Demonstrated experience executing control tests to a defined procedure, including sampling, evidence evaluation, and documented conclusions.
- Experience with user access reviews, either administering campaigns or testing them as a control.
- Exposure to at least one of PCI DSS, SOX ITGC, SOC, or an internal security control baseline.
- Experience driving a recurring process across stakeholders outside a direct reporting line, with a record of following items to completion.
- Curiosity and adaptability to understand how Fanatics' different subsidiaries and brands operate, and how that context shapes how a control should be applied and assessed for effectiveness.
- Working knowledge of core control domains: access management and access reviews, privileged access, change management, SDLC, logging and monitoring, encryption, vulnerability and patch management, backup and recovery, and cloud platform fundamentals.
- Excellent written and verbal communication, with the ability to explain technical and non-technical control concepts clearly and consistently to control owners, and to influence stakeholders toward timely, positive adoption of controls and remediation, even without direct authority over them.
- Effective use of approved AI tools in day-to-day work, with sound judgment about where AI output can and cannot be relied upon in an audit context.
- Organizational discipline, persistence, and judgment about when to escalate.
- Detail-oriented, with sound judgment for navigating grey areas in control descriptions and a practical, risk-based approach to evaluating compensating controls rather than a strict pass/fail mindset.
- Bachelor's degree in information security, cybersecurity, information systems, accounting, or a related field, or equivalent practical experience.
- Preferred: CISA certification.
- Preferred: exposure to two or more of PCI DSS, SOX ITGC, and SOC, including familiarity with PCI DSS v4.0.1, and testing against NIST 800-53 or the NIST Cybersecurity Framework.
- Preferred: familiarity with an enterprise GRC or IRM platform
By submitting your application, you agree to our terms of service and acknowledge you have read our Candidate Privacy Policy.
About Us
The Role
The Information Security GRC Analyst III, Controls Assurance (Fanatics Corporate) sits at the center of how Fanatics proves its security controls actually work, testing across PCI DSS, SOX ITGC, SOC reporting, and our internal NIST-aligned control baselines. This is a Corporate-level role with direct exposure across the full Fanatics portfolio: you will work daily with business units, IT teams, Security Operations, and InfoSec GRC counterparts across our subsidiaries and brands, giving you a rare, enterprise-wide view of how a global, multi-brand organization operates and secures itself.
Working in partnership with the designated owner of each control set, you will execute assigned control testing, collect and evaluate evidence, support user access reviews and control exception administration, and contribute to findings tracking and control reporting. Control effectiveness is rarely a clean pass or fail; you will need to read the intent behind a control, work through the grey areas, and take a practical, risk-based approach to compensating controls, tailored to how each subsidiary or brand actually does business. Strong communication is central to the role: you will explain technical and non-technical control requirements clearly and consistently to control owners, and use that clarity to influence timely, positive adoption of controls and remediation.
Control baselines and framework control sets are established and owned within the GRC team, so this is a controls assurance role rather than a program build-out or control design role. A substantial portion of the work is recurring and deadline-driven, including access review cycles, evidence collection, and assessment calendars.
What You'll Do
- Execute assigned control tests in partnership with control set owners, including: sample selection, evidence requests, walkthroughs, and documented conclusions on operating effectiveness.
- Communicate control requirements, testing results, and rationale clearly and consistently to control owners across technical and non-technical audiences, and use that clarity to influence timely, positive adoption of controls and remediation.
- Prepare workpapers that withstand assessor review without rework.
- Evaluate evidence critically, identifying artifacts that do not substantiate the control.
- Support QSA, audit, and service auditor engagements, including evidence request lists and walkthrough preparation.
- Support user access review campaigns: population scoping, reviewer assignments, completion monitoring, and verification that revocations were executed.
- Collect and quality-check evidence for framework cycles, resolving gaps before assessor fieldwork.
- Support the control exception process: intake, routing, compensating controls, expiry tracking, and re-review.
- Apply practical, risk-based judgment to grey-area control questions, including whether a compensating control adequately addresses the underlying risk given how a specific subsidiary or brand operates.
- Identify opportunities to reduce manual evidence collection.
- Help maintain the control library: owners, test procedures, evidence requirements, testing frequency, and system mappings.
- Support cross-framework mapping, including mapping internal baseline controls to the external requirements they satisfy.
- Support findings tracking and remediation follow-up, retesting closed items rather than accepting closure on assertion.
- Contribute to control reporting and metrics, and to workflow upkeep in the designated GRC platform.
- Partner day-to-day with business units, IT teams, Security Operations, and InfoSec GRC counterparts across Fanatics' subsidiaries and brands, understanding how each operates in order to apply controls appropriately.
- Build sufficient depth across control sets to provide backup coverage during leave, peak workload, or overlapping cycles.
What We're Looking For
- Four years + in IT audit, IT control testing, information security GRC, or a related discipline; Big Four or regional firm IT audit experience applies directly.
- Demonstrated experience executing control tests to a defined procedure, including sampling, evidence evaluation, and documented conclusions.
- Experience with user access reviews, either administering campaigns or testing them as a control.
- Exposure to at least one of PCI DSS, SOX ITGC, SOC, or an internal security control baseline.
- Experience driving a recurring process across stakeholders outside a direct reporting line, with a record of following items to completion.
- Curiosity and adaptability to understand how Fanatics' different subsidiaries and brands operate, and how that context shapes how a control should be applied and assessed for effectiveness.
- Working knowledge of core control domains: access management and access reviews, privileged access, change management, SDLC, logging and monitoring, encryption, vulnerability and patch management, backup and recovery, and cloud platform fundamentals.
- Excellent written and verbal communication, with the ability to explain technical and non-technical control concepts clearly and consistently to control owners, and to influence stakeholders toward timely, positive adoption of controls and remediation, even without direct authority over them.
- Effective use of approved AI tools in day-to-day work, with sound judgment about where AI output can and cannot be relied upon in an audit context.
- Organizational discipline, persistence, and judgment about when to escalate.
- Detail-oriented, with sound judgment for navigating grey areas in control descriptions and a practical, risk-based approach to evaluating compensating controls rather than a strict pass/fail mindset.
- Bachelor's degree in information security, cybersecurity, information systems, accounting, or a related field, or equivalent practical experience.
- Preferred: CISA certification.
- Preferred: exposure to two or more of PCI DSS, SOX ITGC, and SOC, including familiarity with PCI DSS v4.0.1, and testing against NIST 800-53 or the NIST Cybersecurity Framework.
- Preferred: familiarity with an enterprise GRC or IRM platform
By submitting your application, you agree to our terms of service and acknowledge you have read our Candidate Privacy Policy.
See All 6 Project Controls Analyst Jobs in New York
Find roles in New York that match your experience and apply in just a few clicks.
Find Project Controls Analyst JobsProject Controls Analyst Jobs by City in New York
Where New York roles are concentrated, by current openings.
Project Controls Analyst Job Market in New York
A snapshot from current New York openings, updated as new roles post.
Who's Hiring
What New York Employers Look For
The qualifications that appear most often in project controls analyst jobs across New York.
- Bachelor's degree in engineering, construction management, or a related technical field
- Proficiency in Primavera P6 and Microsoft Project for scheduling and planning tasks
- Experience with earned value management, cost forecasting, and budget control processes
- Familiarity with New York public agency contract structures and capital program reporting requirements
- PMI Project Management Professional or AACE International certification preferred by many New York employers
- Strong command of Excel-based cost models and project reporting tools such as Power BI
Project Controls Analyst Jobs in New York: Frequently Asked Questions
How do you become a project controls analyst in New York?
Most project controls analysts in New York enter the field with a bachelor's degree in construction management, civil engineering, or a closely related discipline. New York does not require a state-issued license specifically for this role, but candidates who earn an AACE International Certified Cost Professional or a PMI scheduling credential consistently advance faster in the New York market. Many start in junior cost engineer or scheduler roles on large capital programs run by New York City agencies or major general contractors.
How much do project controls analysts make in New York?
Project controls analysts in New York earn a median of about $121,040 a year, based on May 2025 Bureau of Labor Statistics wage data, ranging from around $74,580 for the lowest 10% to over $192,160 for the top 10%. Pay rises with experience, specialty, and employer.
Which companies hire project controls analysts in New York?
Employers hiring project controls analysts in New York right now include AECOM, Fanatics, and Moog, based on current listings on Migrate Mate as of October 2026. New York's volume of large public infrastructure programs, including MTA capital plans and Port Authority projects, keeps demand from major construction managers and engineering consultants consistently active throughout the year.
Which New York cities have the most project controls analyst jobs?
New York, Buffalo, and Washington lead in project controls analyst openings across New York. New York City dominates because of its concentration of major construction management firms, transit agencies, and developer-driven capital programs, while Buffalo and Albany carry significant activity from state infrastructure investment and regional construction programs tied to semiconductor and energy development initiatives.
Are there remote project controls analyst jobs in New York?
Yes, but they are less common than in purely desk-based fields, since many project controls roles require on-site coordination with project teams and regular site visits. About 100% of project controls analyst openings tied to New York are remote or hybrid as of October 2026, with remote work most accessible for cost reporting, forecasting, and schedule analysis tasks that do not require physical site presence.
How can I get hired as a project controls analyst in New York with little or no experience?
The most realistic entry path is through a junior cost engineer or project controls coordinator role on a large public capital program managed by a New York City agency contractor or a major construction management firm. Turner Construction and AECOM both recruit through campus programs at New York institutions such as NYU Tandon and City College. Building proficiency in Primavera P6, earning an AACE International Intern Certificate, and targeting cost assistant roles on MTA or Port Authority contracts gives early-career candidates a concrete edge.
Where can I find and apply to project controls analyst jobs in New York?
You can find and apply to project controls analyst jobs in New York on Migrate Mate, which lists current New York openings updated regularly. Search the available roles, identify the ones that fit your experience and target industry, and apply directly to each position through the listing.
See All 6 Project Controls Analyst Jobs in New York
Find roles in New York that match your experience and apply in just a few clicks.
Find Project Controls Analyst Jobs