IT Governance Analyst Job Description

An IT governance analyst keeps the decision rules for technology written down, assigned and tested. Someone has to say who may approve a new system, which controls protect financial data, how long a policy exception may last and what goes to the board. That someone may be an analyst in the CIO's office, an IT risk group or a security governance, risk and compliance (GRC) team.

The federal workforce model describes the territory well. The NICE Workforce Framework for Cybersecurity, published through CISA's NICCS site, groups this kind of work under its Oversight and Governance category, the category that provides leadership, management, direction and advocacy so an organization can manage cybersecurity risk. NIST gave the same idea a formal place in 2024: the Cybersecurity Framework 2.0 added a GOVERN function, under which the organization's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored. NIST says it moved much of the old Identify function into Govern, including activities such as setting risk tolerances, defining roles and responsibilities and establishing policies. For an analyst, Govern is the part of the framework that names their deliverables.

The work runs on a few artifacts:

• The policy library. IT policies and standards, each with an owner, a review date and a change history. The analyst drafts updates when a regulation, a system or an incident changes the facts, then walks the draft through legal, security and business sign-off.
• The control library. A list of controls mapped to the frameworks the organization follows. ISACA publishes COBIT, a framework for the governance and management of enterprise IT, along with guides such as IT Control Objectives for Sarbanes-Oxley, 4th Edition, which covers assessing internal control over financial reporting. Good mapping lets one tested control satisfy SOX, ISO/IEC 27001 and customer contract terms at once.
• The risk register. Each IT risk with a rating, an owner, a treatment decision and a due date. The analyst's job is to keep it honest: no orphaned items, no risk accepted by someone without the authority to accept it.
• The evidence pack. Access reviews, change tickets, backup test results and vendor reports, organized for internal and external auditors before they ask.

Around those artifacts sit recurring meetings. A governance committee reviews new projects and exceptions; an audit committee sees open findings; architecture boards ask whether a proposed tool fits policy. When the organization buys a cloud service, launches an AI assistant or acquires a company, the analyst is the one asking where the data lives, who approved the exception and whether the vendor's SOC 2 report covers the services actually in use.

Where the organization uses a GRC platform such as ServiceNow, Archer or MetricStream, controls, attestations and audit requests are tracked there. Configuring those workflows, not only filling in records, moves routine reminders and evidence requests out of email and leaves the analyst's time for the judgment calls that need a person.

Education. As a rough guide, the role starts from a bachelor's in information systems, accounting information systems, computer science or business with a technical minor. Accounting graduates often arrive through SOX testing; computer science graduates often arrive through security operations or systems administration. A master's in information assurance or IT management can help for senior posts at banks, insurers and federal contractors, but it is not a gate.

Experience. Typically 2 to 5 years in a neighboring seat comes first: IT audit at a public accounting firm, internal audit, security compliance, service management or systems administration. What counts is having seen controls from both sides, as the person producing evidence and as the person judging it. The core skill is reading a change ticket or an access review and spotting what is missing.

Certifications. ISACA awards the credentials that line up most closely with this job:

• CGEIT (Certified in the Governance of Enterprise IT, ISACA): the governance-specific credential.
• CRISC (Certified in Risk and Information Systems Control, ISACA): for analysts whose scope centers on the IT risk register.
• CISA (Certified Information Systems Auditor, ISACA): useful for analysts coming from or working beside audit.
• CISM (Certified Information Security Manager, ISACA): fits governance seats inside a security program.
• ISACA's AI credentials: ISACA now lists Advanced in AI Audit (AAIA), Advanced in AI Security Management (AAISM) and Advanced in AI Risk (AAIR), with Advanced in AI Governance (AAIG) in beta as of June 2026.
• The COBIT Foundation certificate (ISACA) and ITIL 4 Foundation (PeopleCert) give framework vocabulary early in a career.
• CISSP (ISC2) and CIA (Certified Internal Auditor, The Institute of Internal Auditors) are worth a look for senior candidates.

Technical ground to cover.

• Frameworks: COBIT, NIST CSF 2.0, NIST SP 800-53, ISO/IEC 27001, CIS Controls.
• Regulations by sector: SOX IT general controls for public companies, the HIPAA Security Rule in health care, GLBA in financial services, PCI DSS for card data, DFARS 252.204-7012 for defense work.
• Identity and access: role design, privileged access, quarterly recertification.
• Cloud governance: tagging standards, policy-as-code tools such as Azure Policy or AWS Config rules, shared responsibility in vendor contracts.
• GRC tooling, plus enough SQL or scripting to pull evidence directly.

Working style. The job rewards precise writing, because a policy sentence may be read by an auditor or a regulator years later. It also rewards patience: getting an engineering team to adopt a compensating control takes explanation, not a citation. Turning a control failure into a business consequence an executive understands is a skill worth practicing from the first year.

There is no federal projection for IT governance analysts as a title, so the nearest guide is the occupation O*NET uses for IT risk specialists. BLS projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations, with about 14,100 openings a year on average over the decade. That projection covers the whole occupation, including security operations and engineering roles, so read it as context for governance work rather than a forecast of it.

Pay by sector follows the same pattern of reading the occupation, not the title. In finance and insurance, BLS reported a May 2025 median of $130,630 for information security analysts. At banks and insurers, governance work includes supporting regulator examinations as well as internal and external audits.

On AI, ISACA reports that governance and operational readiness continue to lag. Its 2026 AI Pulse Poll, a global survey of more than 3,400 digital trust professionals released May 5, 2026, found that 38 percent of organizations have a full, formal AI policy, up from 28 percent in 2025, while 30 percent have only a limited policy and 25 percent have no active policy. For an IT governance analyst, that gap turns into concrete tasks: an inventory of AI tools in use, an approval path for new ones, data handling rules for prompts and outputs, and controls an auditor can test. A policy lifecycle and a risk register already provide the machinery; the work is extending them to a new class of system.

Career paths branch in a few directions:

• Up the governance line: senior analyst, IT governance or GRC manager, director of IT risk and compliance. Some go on to chief information security officer or chief risk officer roles after adding security leadership experience.
• Into assurance: IT audit or internal audit, where the CISA credential and control knowledge carry over. An auditor should not test controls they designed, so a move to audit at the same employer means stepping away from that work.
• Into risk and privacy: enterprise risk management, third-party risk or privacy program roles, where the risk register and vendor reviews are the core of the job.
• Into consulting: advisory practices at accounting and consulting firms sell control design, framework mapping and readiness assessments, which is the analyst's daily work packaged for clients.

Whichever branch an analyst takes, the job pairs framework fluency with hands-on system knowledge: mapping a control to COBIT, then logging in to check that the control actually fires. A GRC workflow can schedule attestations and send reminders; deciding whether the evidence proves anything is still the analyst's call.

Dear Hiring Manager,

I am applying for the IT Governance Analyst role on your technology risk team. For the past four years I have worked in IT risk and compliance at a regional insurance carrier, where I own our policy library, run our risk register and coordinate evidence for the SOX IT general controls our external auditors test each year.

Two pieces of that work match what your posting describes. First, I rebuilt our control library last year. We had separate spreadsheets for SOX, our state insurance examiners and customer security questionnaires, with the same access review described three different ways. I mapped everything to a single set of controls in our GRC platform, set up quarterly attestation campaigns and gave each control one owner. Audit preparation that used to take a month of email now runs through one workflow.

Second, I wrote our first AI use standard. When business units started asking to use chat assistants on claims documents, I worked with legal, security and our data office to define what data could go into which tools, who approves a new tool and what logs we keep. The standard passed internal audit review on its first pass, and I now chair the small review group that handles new requests.

I hold CISA and passed the CRISC exam this spring. I am working toward CGEIT as my experience in governance roles accumulates.

What draws me to your team is the scale: more systems, more regulators and a GRC program that is still being built out. I would welcome a conversation about how I could help.

Sincerely, Jordan Ellis