IT Governance Analyst

AAON, Inc.•Tulsa, OK

About The Position

The IT Governance Analyst contributes to governance, risk management, and compliance functions within the Information Services organization. The role develops and implements policies, procedures, controls, and governance strategies to support compliance with regulatory requirements and industry standards. It also helps maintain a secure enterprise environment across AAON’s technical landscape and ensures alignment with organizational goals and applicable requirements. The analyst evaluates organizational and technology risks, oversees and conducts technology program and project audits, and communicates audit status and risk to business stakeholders. The work includes audits focused on SOX, IT General Controls, and other frameworks; independent cybersecurity audits of applications, networks, and systems; and assessment of procurement and supply-chain risks. The analyst also coordinates remediation of due diligence gaps and works with internal IT teams and third-party vendors to track risk-assessment findings through resolution. Additional responsibilities include monitoring compliance and risk-management outcomes, developing mitigation plans and employee compliance training, maintaining information-security policies and procedures, and collaborating with IT and security teams on data protection and cybersecurity. The role involves communicating with audiences with varying levels of technical and process knowledge and performing in a high-pressure, collaborative, matrixed environment. Other duties may be assigned, and responsibilities may change.

Requirements

Minimum of 5 years of experience in business process analysis.
Strong knowledge of regulatory requirements and industry standards, such as ISO 27001, GDPR, and SOX.
Strong analytical, problem-solving, and decision-making skills.
Strong communication and interpersonal skills.
Strong writing skills.
Ability to perform the essential functions of the position satisfactorily; reasonable accommodations may be made upon request, absent undue hardship.

Nice To Haves

Bachelor’s degree in Business Administration, Risk Management, Information Security, or a related field (preferred but not required).
Professional certification such as CISSP, CISM, CRISC, or similar.

Responsibilities

Develop risk, compliance, and assurance monitoring and measurement strategies.
Oversee and conduct technology program and project audits, and communicate status and risk to business stakeholders.
Determine operational and business risk impacts of cybersecurity lapses.
Assess whether procurement activities adequately address supply-chain risks and recommend improvements to meet cybersecurity requirements.
Conduct IT audits focused on Sarbanes-Oxley (SOX), IT General Controls (ITGC), and other frameworks.
Develop and implement independent cybersecurity audit processes for application software, networks, and systems.
Coordinate and track remediation of gaps identified during the Due Diligence (DD) process.
Work with internal IT teams and third-party vendors to track risk-assessment findings from discovery through remediation.
Help maintain a secure enterprise environment across AAON’s technical landscape.
Ensure alignment with organizational goals and regulatory requirements.
Facilitate the development and implementation of corporate governance strategies.
Identify, assess, and prioritize organizational risks.
Develop risk-mitigation strategies and action plans.
Monitor and report on risk-management activities and outcomes.
Ensure compliance with relevant laws, regulations, and industry standards.
Conduct regular compliance audits and assessments.
Develop and deliver compliance training programs for employees.
Collaborate with IT and security teams to support data protection and cybersecurity measures.
Monitor and respond to security incidents and breaches.
Maintain and update information-security policies and procedures.
Communicate clearly, diplomatically, and effectively across the organization to audiences with varying levels of process and technical knowledge.
Perform tasks in a high-pressure environment and multitask in a team-oriented, matrixed, collaborative setting.
Perform other duties as assigned.