IT Controls Analyst

Career Guide

An IT Controls Analyst helps an organization reduce technology risk by checking that key IT processes are well controlled, well documented, and consistently followed. The role supports internal and external audits, improves control design, and helps teams meet compliance expectations for financial reporting and data security.

Browse All Roles

Key Responsibilities

Assess IT risks and identify key controls that reduce those risks
Test IT controls and document test results
Support audits by gathering evidence and responding to auditor requests
Track remediation plans and confirm issues are resolved on time
Review user access and segregation of duties to reduce misuse risk
Validate change management controls for systems and applications
Evaluate backup and recovery controls and operational readiness
Partner with IT teams to improve processes and control documentation
Maintain control inventories, narratives, and evidence standards
Report control status and risk themes to stakeholders

Top Skills for Success

Risk Assessment

Attention to Detail

Written Communication

Stakeholder Management

Audit Readiness

Control Testing

Evidence Collection

Access Reviews

Segregation of Duties

Change Management Controls

Incident Management Controls

Backup and Recovery Controls

Policy and Procedure Writing

GRC Tooling

Spreadsheet Analysis

Career Progression

Can Lead To

Senior IT Controls Analyst

IT Risk Analyst

IT Audit Senior

GRC Analyst

Security Compliance Analyst

Transition Opportunities

IT Risk Manager

IT Audit Manager

GRC Manager

Security Governance Lead

Internal Controls Manager

Compliance Program Manager

Common Skill Gaps

Often Missing Skills

Control DesignRoot Cause AnalysisIssue Remediation PlanningSQL BasicsCloud Controls KnowledgeIdentity and Access ManagementProcess MappingExecutive Reporting

Development SuggestionsPractice writing clear control descriptions and test steps, learn common access and change management patterns, and build a repeatable approach for documenting evidence. Ask to own a small control area end to end, from risk identification to remediation verification, to accelerate growth.

Salary & Demand

Median Salary Range

Entry LevelUSD 65,000 to 85,000

Mid LevelUSD 85,000 to 115,000

Senior LevelUSD 115,000 to 150,000

Growth Trend

Steady demand driven by regulatory expectations, ongoing audit needs, cloud adoption, and increased focus on access controls and cyber risk.

Companies Hiring

Major Employers

DeloitteEYKPMGPwCAccentureBoeingJohnson and JohnsonJPMorgan ChaseWells FargoAmazonMicrosoftUnitedHealth Group

Industry Sectors

Financial ServicesTechnologyHealthcareManufacturingRetailTelecommunicationsInsuranceProfessional ServicesEnergy

Recommended Next Steps

Create a portfolio of sanitized work samples such as a control matrix, a test script, and an issue tracker

Learn one GRC platform commonly used in your target industry and practice building control records and evidence requests

Strengthen access review skills by learning role based access concepts and common approval workflows

Build comfort with change management evidence by reviewing sample tickets and release approvals

Prepare interview stories that show how you handled audit requests, found exceptions, and drove remediation

Consider a relevant certification based on your path such as CISA, CRISC, or Security plus