Senior Governance Analyst / Technology Audit

Motion Recruitment; Boston (MA); On-site; USD 110,000 - 150,000; Full time

Job summary

Motion Recruitment seeks a Senior Governance Analyst for a contract or full-time role focusing on enterprise technology governance, risk management, and compliance. You will develop, implement, and maintain IT governance frameworks across large-scale systems, collaborating with Engineering, Information Security, and Audit teams.

The ideal candidate will apply expertise in NIST, ISO/IEC 27001, COBIT, and ITIL to drive policy development, risk mitigation, and audit readiness while bridging

Qualifications

• 5-8 years in IT governance, IT risk, security or audits.
• BS/MS in CS/IS/Cybersecurity or related field.
• Knowledge of NIST, ISO/IEC 27001, COBIT, ITIL.

Responsibilities

• Draft, review, and maintain IT policies and governance docs.
• Manage end-to-end technology lifecycle (ITAM, SAM, CMDB).
• Partner with Security and Risk teams for controls and risk mitigation.
• Coordinate internal and external IT audits and evidence collection.

Skills

IT governance

IT risk management

Information security

Audit readiness

Policy development

Education

Bachelor's or Master's in CS, IS, Cybersecurity

Tools

ServiceNow

Jira

Flexera

Job description

We are seeking an experienced Senior Governance Analyst for a contract or FTE opportunity with an organization focused on enterprise technology, information security, and regulatory compliance. This role will support the development and implementation of IT governance frameworks, technology lifecycle management, risk mitigation, and audit readiness across enterprise systems and infrastructure. The ideal candidate will have expertise in NIST, ISO/IEC 27001, COBIT, ITIL, and technology management tools such as ServiceNow, Jira, and Flexera.

This is an excellent opportunity for a technology governance professional to make a meaningful impact by strengthening enterprise security, improving compliance processes, and ensuring technology assets are managed effectively throughout their lifecycle. The organization is looking for a detail-oriented analyst who can bridge the gap between technical teams and compliance stakeholders, drive governance improvements, and help maintain a secure and resilient technology environment. You will collaborate with Engineering, Information Security, Enterprise Risk, Finance, Vendor Risk Management, and Internal Audit teams, providing opportunities to expand your expertise in technology risk, security governance, audit management, and enterprise-wide process improvement.

Contract Duration: To be determined

Required Skills & Experience

• 5-8 years of experience in IT governance, technology audit, information security, or IT risk management.
• Bachelor's or Master's degree in Computer Science, Information Systems, Cybersecurity, or a related field.
• Strong knowledge of NIST, ISO/IEC 27001, COBIT, and ITIL frameworks.
• Experience developing, reviewing, and maintaining IT policies, procedures, technical standards, and governance documentation.
• Hands-on experience with IT Asset Management (ITAM), Software Asset Management (SAM), IT Service Management (ITSM), and Configuration Management Database (CMDB) processes.
• Experience conducting technology risk assessments, validating controls, identifying compliance gaps, and developing risk mitigation plans.
• Understanding of internal and external technology audits, audit evidence collection, control testing, and remediation tracking.
• Experience supporting access management processes and periodic reviews of user, service, and operational accounts.
• Knowledge of Secure Software Development Lifecycle (SSDLC) governance, review and approval processes, and CI/CD pipeline controls.
• Excellent written and verbal communication skills, with the ability to translate complex technical concepts into clear policies and procedures.
• Strong analytical, organizational, problem-solving, and stakeholder management skills.

Desired Skills & Experience

• Certifications such as Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), or Certified Information Systems Security Professional (CISSP).
• Experience with ServiceNow, Jira, Flexera, or similar ITAM, ITSM, and governance platforms.
• Experience managing technology assets from procurement through retirement, including upgrades, migrations, and decommissioning.
• Familiarity with vulnerability management, security baselines, data protection requirements, and regulatory compliance.
• Experience maintaining risk registers, documenting risk acceptance criteria, and tracking mitigation plans through closure.
• Experience coordinating with Engineering, Finance, Information Security, Enterprise Risk, Vendor Risk Management, and Internal Audit teams.
• Knowledge of automated compliance monitoring, control validation, and security approval workflows integrated into CI/CD pipelines.
• Experience with vendor relationship management, technology obsolescence planning, and legacy system remediation.

What You Will Be Doing Tech Breakdown

• 30% IT Governance, Standards, Policies & Compliance
• 25% Technology Lifecycle Management, ITAM, SAM & CMDB
• 20% Technology Risk Management & Information Security
• 15% Technology Audit, Control Testing & Remediation
• 10% Access Management & SSDLC Governance

Daily Responsibilities

• 45% Hands-On Governance, Risk Assessments & Compliance Activities
• 20% Governance Planning, Documentation & Process Improvement
• 35% Team Collaboration & Stakeholder Management

Key Responsibilities

Standards, Policies & Procedures

• Draft, review, and maintain IT policies, procedures, technical standards, and governance documentation.
• Align technology governance processes with NIST, ISO/IEC 27001, COBIT, ITIL, and applicable regulatory requirements.
• Drive organization-wide adoption of technology standards through documentation, training, and stakeholder engagement.
• Evaluate existing governance and compliance processes to identify gaps, inefficiencies, and opportunities for improvement.

Technology Lifecycle Management

• Manage the end-to-end lifecycle of hardware, software, and enterprise applications, from procurement through retirement.
• Maintain accurate software asset inventories and hardware configuration records within SAM and CMDB platforms.
• Monitor asset health, support status, end-of-life dates, and obsolescence risks to prevent operational disruptions.
• Collaborate with Engineering, Finance, and Vendor Risk Management to plan upgrades, migrations, and decommissioning of legacy systems.
• Support vendor relationship management for assigned technology partners.

Technology Risk & Information Security

• Conduct risk assessments for existing infrastructure and proposed technologies.
• Identify vulnerability trends and ensure security baselines are incorporated into technology deployment processes.
• Partner with Information Security to validate compliance with data protection requirements and internal security policies.
• Maintain risk registers, mitigation plans, risk acceptance criteria, periodic reviews, and risk closure documentation in partnership with Enterprise Risk.

Technology & Internal Audit

• Serve as a liaison for internal and external technology audit teams.
• Gather, validate, and organize audit evidence to demonstrate ongoing compliance.
• Track audit findings and remediation plans, ensuring deficiencies are addressed within established timelines.
• Perform pre-audit readiness assessments to proactively identify and resolve compliance gaps.
• Support risk testing and control validation to ensure governance requirements are implemented effectively.

Access Management & SSDLC Governance

• Support access management processes, including maintaining job profiles and responding to access-related requests.
• Assist with periodic access reviews for user accounts and service or operational accounts, ensuring completeness and accuracy.
• Support review and approval processes within the Secure Software Development Lifecycle (SSDLC).
• Help integrate governance requirements, security controls, and automated approval workflows into CI/CD pipelines.

Collaboration & Continuous Improvement

• Build strong relationships with Engineering, Information Security, Enterprise Risk, Finance, Vendor Risk Management, and Internal Audit.
• Communicate technical risks, governance requirements, and remediation expectations clearly to technical and nontechnical stakeholders.
• Identify opportunities to streamline governance workflows, improve control effectiveness, and strengthen enterprise technology risk management.