IT Risk Analyst Jobs
IT Risk Analyst jobs are open across financial services, healthcare, government contracting, and technology, at every level from junior to senior and lead, with specializations in GRC, third-party risk, and cybersecurity risk management. Find a role that fits below and apply directly.
Find IT Risk Analyst JobsLooking for remote work? View remote IT risk analyst jobs →Overview
Showing 5 of 96+ IT Risk Analyst jobs
Please reference the schedule and minimum qualifications listed below before applying.
If you need assistance with filling out our application form or during any phase of the application, interview, or employment process, please notify our Human Resources Team at 801-366-6947 option 1 or email macurecruiting@macu.com and every reasonable effort will be made to accommodate your needs in a timely manner.
Job Summary
The Director of IT and Data Risk Management provides second line of defense oversight for technology and data-related risk domains. Reporting to the VP of IT, Cyber, and Data Risk Management, this role is responsible for maturing the credit union’s IT risk governance practices and building a scalable, sustainable second line data risk and governance program from the ground up. This leader ensures alignment with the enterprise risk framework, regulatory guidance, and business objectives while helping to embed technology and data risk awareness into enterprise decision-making.Job Description
LOCATION
Mountain America Center - Hybrid:
9800 S Monroe St
Sandy, UT 84070
SCHEDULE
Full Time
To be effective, an individual must be able to perform each job duty successfully.
IT Risk Governance
- Oversee the credit union’s second line IT Risk Management Framework, including risk assessments, issue oversight, control testing strategy, and governance documentation.
- Evaluate and provide challenge to first line practices related to system change management, software development, platform resilience, vendor platforms, and IT operations.
- Collaborate with IT and ERM to define key risk indicators (KRIs), support risk appetite alignment, and develop enterprise reporting for IT risk themes.
Data Risk and Governance Development
- Lead the build-out of the second line enterprise Data Risk Governance Program, defining policies, roles, standards, and escalation protocols.
- Establish risk-based processes for data classification, quality, lineage, privacy, lifecycle management, and metadata governance.
- Partner with data owners, stewards, and business units to integrate risk controls into data handling and analytics processes.
- Collaborate with Legal, Privacy, and Compliance teams to support regulatory readiness for data usage, access, and storage requirements.
AI Governance
- Lead the design and implementation of a comprehensive AI governance program that establishes policies, controls, and oversight mechanisms to ensure responsible development and deployment of AI across the organization.
- Coordinate cross‑functional stakeholders—including legal, compliance, data, security, and business leaders—to identify, assess, and mitigate AI‑related risks and ensure alignment with regulatory, ethical, and organizational standards
GRC Integration and Risk Reporting
- Contribute to the development and automation of technology and data risk processes within the credit union’s GRC platform.
- Manage reporting routines, issue escalation protocols, and regulatory documentation for IT and data risk domains.
- Assist in the coordination of regulatory exams and internal audits related to IT governance, operational resilience, and data protection.
Leadership and Strategic Collaboration
- Manage a team of risk analysts or program specialists in support of IT and data risk management objectives.
- Serve as a trusted advisor across business units and risk domains, building consensus and driving a proactive risk culture.
- Influence the design and adoption of sustainable governance practices for emerging technologies, including AI, cloud services, and automation.
KNOWLEDGE, SKILLS, and ABILITIES
The requirements listed are representative of the knowledge, skills, and/or abilities required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential job functions.
Education and Experience
- Bachelor’s degree in information technology, Risk Management, Data Analytics, or related field.
- 8+ years of experience in IT risk, data governance, or enterprise risk within a financial institution or regulated entity.
- 3+ years in a related leadership role, governance focus preferred
- Strong working knowledge of IT governance frameworks such as COBIT, NIST RMF, ITIL, and data governance best practices.
- Strong working knowledge of AI governance frameworks and regulations such as NIST AI Risk Management Framework, EU AI Act, US-state laws regulating AI systems, and ISO 42001.
- Experience with data governance tools or metadata platforms (e.g., Cyera, Collibra, Informatica).
- Familiarity with data privacy regulations and standards (e.g., GLBA, CCPA, ISO/IEC 38505).
Licenses, Certifications, Registrations
- Certifications such as CISSP, CRISC, CISA, CDPSE, CGEIT, or equivalent.
Knowledge and Skills
- Prominent knowledge of theory and organizational experience through extensive exposure to complex practices across several different disciplines within IT governance and/or data governance.
- Technology Governance Acumen: Deep understanding of IT risk drivers, controls, and operating environments.
- Data & AI Governance Vision: Strong foundational understanding of how to stand up and mature data and AI governance capabilities.
- Strategic Execution: Skilled at translating risk vision into phased implementation plans and metrics.
- Credible Challenge: Ability to raise concerns, recommend alternative strategies, and influence decision-making across departments.
- Collaboration and Communication: Engages diverse stakeholders and communicates risk insights with clarity and confidence.
- Leverages knowledge of trends in profession and/or specialized areas to influence strategy
Leadership and Organization Development
- Creates a sense of urgency and accountability in delivering objectives and a culture which fosters innovation and creativity
- Develops multifunctional leadership
- Coaches individuals to reach full potential, builds coaching capability in others
- Helps orchestrate talent development & movement across the business unit or function
- Leads Work effectively & regularly across functions
- Responsible for effectiveness of team(s) and performance results
Scope and Strategic Impact
- Responsible for a business process in a function of notable risk and complexity
- Directs multiple related teams or function with significant and critical organization-wide impact
- Operates with autonomy on operational matters, accountable to BU Leadership
- Limited to no revenue generation responsibilities
- Has budget responsibility
- Actively develops strategic plan for the function or business processes with VP
- Sets objectives for self and/or a team/project members
- Delivers the results that have a tangible impact for function or business process
- Adapts strategy to changing conditions
- Identifies external threats and opportunities and adapts strategy to changing conditions
- Strategic planning horizon generally 1 - 3 years
- Actively participates in building BU plan
Analytical Thinking & Problem Solving
- Applies company level financial and economic perspectives to decision making and problem solving
- Gathers and analyzes information at an expert level
- Manages the resolution of complex or unusual business problems
- Applies analytical thinking, problem identification and solving and decision making
- Implementation of solutions requires a medium-term view
PHYSICAL ABILITIES / WORKING CONDITIONS
Physical Demands
Ability to sit, talk and hear consistently
Vision Requirements
Close vision (clear vision at 20 inches or less)
Distance vision (clear vision at 20 feet or more)
Color vision (ability to identify and distinguish colors)
Weight Lifted or Force Exerted
Ability to lift up to 10 pounds frequently and up to 25 pounds occasionally
Environmental
There are no unusual environmental factors (such as a typical office)
Noise Environment
Moderate noise (business office with computers and printers, light traffic)
***This Job is not eligible to be performed in Colorado or Connecticut, either remotely or in-person.***
#LI-PN1
Mountain America Credit Union is an EEO/AA/ADA/Veterans employer.
Please reference the schedule and minimum qualifications listed below before applying.
If you need assistance with filling out our application form or during any phase of the application, interview, or employment process, please notify our Human Resources Team at 801-366-6947 option 1 or email macurecruiting@macu.com and every reasonable effort will be made to accommodate your needs in a timely manner.
Job Summary
The Director of IT and Data Risk Management provides second line of defense oversight for technology and data-related risk domains. Reporting to the VP of IT, Cyber, and Data Risk Management, this role is responsible for maturing the credit union’s IT risk governance practices and building a scalable, sustainable second line data risk and governance program from the ground up. This leader ensures alignment with the enterprise risk framework, regulatory guidance, and business objectives while helping to embed technology and data risk awareness into enterprise decision-making.Job Description
LOCATION
Mountain America Center - Hybrid:
9800 S Monroe St
Sandy, UT 84070
SCHEDULE
Full Time
To be effective, an individual must be able to perform each job duty successfully.
IT Risk Governance
- Oversee the credit union’s second line IT Risk Management Framework, including risk assessments, issue oversight, control testing strategy, and governance documentation.
- Evaluate and provide challenge to first line practices related to system change management, software development, platform resilience, vendor platforms, and IT operations.
- Collaborate with IT and ERM to define key risk indicators (KRIs), support risk appetite alignment, and develop enterprise reporting for IT risk themes.
Data Risk and Governance Development
- Lead the build-out of the second line enterprise Data Risk Governance Program, defining policies, roles, standards, and escalation protocols.
- Establish risk-based processes for data classification, quality, lineage, privacy, lifecycle management, and metadata governance.
- Partner with data owners, stewards, and business units to integrate risk controls into data handling and analytics processes.
- Collaborate with Legal, Privacy, and Compliance teams to support regulatory readiness for data usage, access, and storage requirements.
AI Governance
- Lead the design and implementation of a comprehensive AI governance program that establishes policies, controls, and oversight mechanisms to ensure responsible development and deployment of AI across the organization.
- Coordinate cross‑functional stakeholders—including legal, compliance, data, security, and business leaders—to identify, assess, and mitigate AI‑related risks and ensure alignment with regulatory, ethical, and organizational standards
GRC Integration and Risk Reporting
- Contribute to the development and automation of technology and data risk processes within the credit union’s GRC platform.
- Manage reporting routines, issue escalation protocols, and regulatory documentation for IT and data risk domains.
- Assist in the coordination of regulatory exams and internal audits related to IT governance, operational resilience, and data protection.
Leadership and Strategic Collaboration
- Manage a team of risk analysts or program specialists in support of IT and data risk management objectives.
- Serve as a trusted advisor across business units and risk domains, building consensus and driving a proactive risk culture.
- Influence the design and adoption of sustainable governance practices for emerging technologies, including AI, cloud services, and automation.
KNOWLEDGE, SKILLS, and ABILITIES
The requirements listed are representative of the knowledge, skills, and/or abilities required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential job functions.
Education and Experience
- Bachelor’s degree in information technology, Risk Management, Data Analytics, or related field.
- 8+ years of experience in IT risk, data governance, or enterprise risk within a financial institution or regulated entity.
- 3+ years in a related leadership role, governance focus preferred
- Strong working knowledge of IT governance frameworks such as COBIT, NIST RMF, ITIL, and data governance best practices.
- Strong working knowledge of AI governance frameworks and regulations such as NIST AI Risk Management Framework, EU AI Act, US-state laws regulating AI systems, and ISO 42001.
- Experience with data governance tools or metadata platforms (e.g., Cyera, Collibra, Informatica).
- Familiarity with data privacy regulations and standards (e.g., GLBA, CCPA, ISO/IEC 38505).
Licenses, Certifications, Registrations
- Certifications such as CISSP, CRISC, CISA, CDPSE, CGEIT, or equivalent.
Knowledge and Skills
- Prominent knowledge of theory and organizational experience through extensive exposure to complex practices across several different disciplines within IT governance and/or data governance.
- Technology Governance Acumen: Deep understanding of IT risk drivers, controls, and operating environments.
- Data & AI Governance Vision: Strong foundational understanding of how to stand up and mature data and AI governance capabilities.
- Strategic Execution: Skilled at translating risk vision into phased implementation plans and metrics.
- Credible Challenge: Ability to raise concerns, recommend alternative strategies, and influence decision-making across departments.
- Collaboration and Communication: Engages diverse stakeholders and communicates risk insights with clarity and confidence.
- Leverages knowledge of trends in profession and/or specialized areas to influence strategy
Leadership and Organization Development
- Creates a sense of urgency and accountability in delivering objectives and a culture which fosters innovation and creativity
- Develops multifunctional leadership
- Coaches individuals to reach full potential, builds coaching capability in others
- Helps orchestrate talent development & movement across the business unit or function
- Leads Work effectively & regularly across functions
- Responsible for effectiveness of team(s) and performance results
Scope and Strategic Impact
- Responsible for a business process in a function of notable risk and complexity
- Directs multiple related teams or function with significant and critical organization-wide impact
- Operates with autonomy on operational matters, accountable to BU Leadership
- Limited to no revenue generation responsibilities
- Has budget responsibility
- Actively develops strategic plan for the function or business processes with VP
- Sets objectives for self and/or a team/project members
- Delivers the results that have a tangible impact for function or business process
- Adapts strategy to changing conditions
- Identifies external threats and opportunities and adapts strategy to changing conditions
- Strategic planning horizon generally 1 - 3 years
- Actively participates in building BU plan
Analytical Thinking & Problem Solving
- Applies company level financial and economic perspectives to decision making and problem solving
- Gathers and analyzes information at an expert level
- Manages the resolution of complex or unusual business problems
- Applies analytical thinking, problem identification and solving and decision making
- Implementation of solutions requires a medium-term view
PHYSICAL ABILITIES / WORKING CONDITIONS
Physical Demands
Ability to sit, talk and hear consistently
Vision Requirements
Close vision (clear vision at 20 inches or less)
Distance vision (clear vision at 20 feet or more)
Color vision (ability to identify and distinguish colors)
Weight Lifted or Force Exerted
Ability to lift up to 10 pounds frequently and up to 25 pounds occasionally
Environmental
There are no unusual environmental factors (such as a typical office)
Noise Environment
Moderate noise (business office with computers and printers, light traffic)
***This Job is not eligible to be performed in Colorado or Connecticut, either remotely or in-person.***
#LI-PN1
Mountain America Credit Union is an EEO/AA/ADA/Veterans employer.
See All 96 IT Risk Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find IT Risk Analyst JobsIT Risk Analyst Job Market
Who's Hiring
- Baker Tilly Canada19
- Grant Thornton5
- Luxoft3
- Riveron3
- Freddie Mac3
Top Industries Hiring
- Accounting & Auditing
- Banking & Financial Services
What Employers Look For
The qualifications that appear most often in IT risk analyst jobs.
- Three to five years of experience in IT risk, audit, or information security roles
- Hands-on knowledge of GRC frameworks including NIST, ISO 27001, or COBIT
- Experience conducting risk assessments and maintaining enterprise risk registers
- CRISC, CISA, or CISSP certification, or active pursuit of one
- Familiarity with third-party risk management and vendor assessment processes
- Strong written communication skills for drafting risk reports and executive summaries
Tips for Your IT Risk Analyst Job Search
Tailor your resume to GRC frameworks
Hiring managers scan for specific frameworks like NIST, ISO 27001, COBIT, and SOC 2. Name the ones you've actually worked with and pair each with a concrete outcome, like a control gap you closed or an audit you supported.
Highlight your risk register experience clearly
Many it risk analyst postings filter for hands-on risk register ownership. Describe the scope of registers you've maintained, the number of controls tracked, and how findings fed into executive reporting or remediation planning.
Apply early to roles that fit
Migrate Mate lists it risk analyst openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Target postings that name your certifications
Roles explicitly listing CRISC, CISA, or CISSP in requirements are written for candidates who already hold them. If you're pursuing one, check whether the posting says 'preferred' versus 'required' before prioritizing your application time.
Prepare for a risk scenario walkthrough
Interviewers frequently ask you to walk through how you'd assess a new vendor's risk posture or respond to a control failure. Practice narrating your reasoning out loud, covering identification, impact rating, and recommended treatment options.
Negotiate by anchoring to certification value
If you hold CRISC or CISA, use the documented cost and study time those credentials require as a concrete anchor during salary negotiation. Employers in regulated industries pay a measurable premium for credentialed analysts over non-certified peers.
IT Risk Analyst Jobs: Frequently Asked Questions
Which companies are hiring the most it risk analysts?
The companies hiring the most it risk analysts right now include Baker Tilly Canada, Grant Thornton, and Luxoft, with the largest share of openings in Texas, California, and New York, based on current listings on Migrate Mate as of November 2026. Financial services firms, federal contractors, and large health systems consistently account for the highest volume of postings.
How many it risk analyst jobs are remote?
About 85% of it risk analyst openings are fully remote or hybrid as of November 2026, reflecting strong demand from employers comfortable with distributed risk and compliance teams. GRC advisory roles and third-party risk positions tend to be the most remote-friendly, while roles tied to on-site audits or regulated infrastructure are more likely to require in-person presence.
How do you become a it risk analyst?
Start with a foundation in information systems, cybersecurity, or a related field, then build hands-on experience through audit support, compliance work, or an IT security role. Earning a recognized certification like CRISC or CISA signals readiness for a dedicated risk analyst position. From there, focus on developing your skills in risk assessment methodology, control testing, and executive-level risk reporting to advance into senior roles.
How do you get hired as an it risk analyst with little experience?
Entry points into it risk analyst roles typically come through IT audit, helpdesk security, or compliance analyst positions where you gain exposure to control frameworks and risk documentation. Earning a foundational certification like CompTIA Security+ or beginning the CISA study path demonstrates commitment. Candidates who can show they've contributed to a risk register, supported a SOC 2 audit, or documented control gaps stand out even without a full analyst title on their resume.
What does the it risk analyst interview process look like?
Most it risk analyst interviews run across two to four rounds. An initial screening covers your background and familiarity with risk frameworks, followed by a technical interview where you may be asked to walk through a risk assessment scenario or explain how you'd rate and treat a specific threat. Some employers include a written exercise or case study. Final rounds typically involve a conversation with a risk manager or CISO focused on your judgment and communication approach.
Where can I find and apply to it risk analyst jobs?
You can find and apply to it risk analyst jobs on Migrate Mate, which lists current openings from employers across the United States. Search the roles available, find the ones that match your background and target level, and apply directly to each listing without leaving the platform.
See All 96 IT Risk Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find IT Risk Analyst Jobs