IT Controls Analyst
Career GuideKey Responsibilities
- Assess IT risks and identify key controls that reduce those risks
- Test IT controls and document test results
- Support audits by gathering evidence and responding to auditor requests
- Track remediation plans and confirm issues are resolved on time
- Review user access and segregation of duties to reduce misuse risk
- Validate change management controls for systems and applications
- Evaluate backup and recovery controls and operational readiness
- Partner with IT teams to improve processes and control documentation
- Maintain control inventories, narratives, and evidence standards
- Report control status and risk themes to stakeholders
Top Skills for Success
Risk Assessment
Attention to Detail
Written Communication
Stakeholder Management
Audit Readiness
Control Testing
Evidence Collection
Access Reviews
Segregation of Duties
Change Management Controls
Incident Management Controls
Backup and Recovery Controls
Policy and Procedure Writing
GRC Tooling
Spreadsheet Analysis
Career Progression
Can Lead To
Senior IT Controls Analyst
IT Risk Analyst
IT Audit Senior
GRC Analyst
Security Compliance Analyst
Transition Opportunities
IT Risk Manager
IT Audit Manager
GRC Manager
Security Governance Lead
Internal Controls Manager
Compliance Program Manager
Common Skill Gaps
Often Missing Skills
Control DesignRoot Cause AnalysisIssue Remediation PlanningSQL BasicsCloud Controls KnowledgeIdentity and Access ManagementProcess MappingExecutive Reporting
Development SuggestionsPractice writing clear control descriptions and test steps, learn common access and change management patterns, and build a repeatable approach for documenting evidence. Ask to own a small control area end to end, from risk identification to remediation verification, to accelerate growth.
Salary & Demand
Median Salary Range
Entry LevelUSD 65,000 to 85,000
Mid LevelUSD 85,000 to 115,000
Senior LevelUSD 115,000 to 150,000
Growth Trend
Steady demand driven by regulatory expectations, ongoing audit needs, cloud adoption, and increased focus on access controls and cyber risk.Companies Hiring
Major Employers
DeloitteEYKPMGPwCAccentureBoeingJohnson and JohnsonJPMorgan ChaseWells FargoAmazonMicrosoftUnitedHealth Group
Industry Sectors
Financial ServicesTechnologyHealthcareManufacturingRetailTelecommunicationsInsuranceProfessional ServicesEnergy
Recommended Next Steps
1
Create a portfolio of sanitized work samples such as a control matrix, a test script, and an issue tracker2
Learn one GRC platform commonly used in your target industry and practice building control records and evidence requests3
Strengthen access review skills by learning role based access concepts and common approval workflows4
Build comfort with change management evidence by reviewing sample tickets and release approvals5
Prepare interview stories that show how you handled audit requests, found exceptions, and drove remediation6
Consider a relevant certification based on your path such as CISA, CRISC, or Security plus