IT Governance Analyst

Blue Cross and Blue Shield of North Carolina•Durham, CA

1d•$81,068 - $129,708•Hybrid

About The Position

The IT Governance Analyst assists with developing, maintaining, and improving IT risk management, the IT controls framework, training, related processes, and documentation. The role supports IT audits and tracks open audit findings, test exceptions, and systemic issues, including providing support to internal and external audit teams during engagements as needed. The analyst identifies and assesses organizational risks, particularly those involving IT, security, and key business initiatives. Working with business owners and project teams, the role builds awareness of risks and controls and supports the development, assessment, and monitoring of IT risk mitigation plans. The analyst also provides risk guidance for projects, evaluates control environments, helps strengthen controls or develop mitigation action plans, and maintains accurate documentation consistent with company policies, industry standards, and regulatory requirements. The position develops guidance, processes, and training to improve understanding of IT and security risk management. The role follows Blue Cross NC’s flexible-work approach. Depending on the nature of the work and distance from the Durham headquarters, it may be Hybrid Flex—with at least two office days per week—or Remote Flex, with a few office visits per year. Onsite expectations are discussed during the interview process. The listed annual salary range is $81,068–$129,708. Compensation decisions consider experience, training, specialized skills, licensure, certifications, and organizational needs. The total rewards package includes an annual incentive bonus, 401(k) with employer match, paid time off, health benefits, and wellness programs.

Requirements

Bachelor's degree or advanced degree where required.
At least 3 years of experience in a related field.
In lieu of a degree, at least 5 years of experience in a related field.

Nice To Haves

Experience supporting critical incident or crisis management, including cybersecurity-related incidents.
Knowledge of recovery testing, reporting, and control assessment.
Experience partnering with technology and business teams on recovery preparedness and continuity planning.

Responsibilities

Identify and assess organizational risks, especially IT, security, and risks related to key business initiatives.
Partner with business owners and project teams to build awareness of risks and controls.
Support the development, assessment, and monitoring of IT risk mitigation plans.
Identify, evaluate, and escalate risks that exceed established organizational risk tolerance.
Provide risk consulting and guidance for projects and initiatives.
Evaluate control environments and work with business areas to strengthen controls or develop action plans to mitigate identified risks.
Maintain clear and accurate risk documentation in accordance with company policies, industry standards, and regulatory requirements.
Develop guidance, processes, and training to strengthen awareness and understanding of IT and security risk management.
Assist with developing, maintaining, and improving IT risk management, the IT controls framework, training, associated processes, and documentation.
Assist with IT audits and track open audit findings, test exceptions, and systemic issues.
Support internal and/or external audit teams during audit engagements as needed.