Principal Technology Risk Analyst

Principal Technology Risk Analyst page is loaded## Principal Technology Risk Analyst locations:
Boston, MAtime type:
Full time posted on:
Posted Todaytime left to apply:
End Date:
April 21, 2026 (30+ days left to apply) job requisition :
2125619## ##

Job Description:

** Position Description**:
* Applicants are permitted to work remotely from an at-home worksite anywhere in the United States.

* Facilitates all external audit activity related to financial reporting, independent controls attestation, and compliance with regulatory requirements. Performs proactive risk assessments and develops control strategies for emerging technologies, including AI, Machine Learning, and Snowflake data services. Runs external audits and technology risk support for inquiries from technology and operational stakeholders. Supports systems and technology for external audit activity, including attestation and financial statement audits.
*
* Primary Responsibilities:

*** Enhances the external audit program activities focused on key technology areas, including Dev Ops, Cloud, and Technology Operations.
* Coordinates external auditor readiness engagements and readiness assessments, and provides timely status updates to management.
* Plans and coordinates audit cycles with external auditors and internal stakeholders.
* Facilitates requests from external auditor and monitors the progress to ensure timely completion.
* Performs technology risk assessments and develops control strategies; including documenting controls, identifying potential gaps and inconsistencies, and making recommendations for improvement and mitigation.
* Provides technical assistance on risk related systems issues.
* Serves as a liaison with technology and risk teams to track external audit findings and perform issues follow-up.
* Consults with other team members to generate action plans and resolve technical issues.
* Assesses the various information technology risks that the business faces in its operations and implements action plans, policy, and procedural changes for risk avoidance and mitigation.
* Evaluates control maturity by performing control design and operating effectiveness reviews andpeer reviews.
* Assists with conducting Cloud Risk assessments and readiness reviews for applications and workloads migrating to the public Cloud environment.
** Education and Experience**:

Bachelor’s degree in Computer Science, Engineering, Information Technology, Information Systems, Management Information Systems, or a closely related field (or foreign education equivalent) and five (5) years of experience as a Principal Technology Risk Analyst (or closely related occupation) performing Information Technology (IT) audits, risk assessments, and cybersecurity control reviews.

Or, alternatively, Master’s degree in Computer Science, Engineering, Information Technology, Information Systems, Management Information Systems,  or a closely related field (or foreign education equivalent) and three (3) years of experience as a Principal Technology Risk Analyst (or closely related occupation) performing Information Technology (IT) audits, risk assessments, and cybersecurity control reviews.
** Skills and Knowledge**:

Candidate must also possess:
* Demonstrated Expertise (“DE”) performing or coordinating external audit engagements (SOC 1, SOC 2, SOC 3, controls attestation reports, financial audits, ISO 27001, or COBIT external IT audit programs) in distributed environments; and maintaining in-scope IT General Control (ITGCs) and IT Application (ITAC) documentation and procedures.
* DE performing an IT controls assurance program -- identifying and designing new controls, evaluating control procedures and evidence documentation, and conducting control assessments through formal design and operating effectiveness reviews; and establishing control maturity and control/process enhancements using industry control frameworks – AICPA Trust Service Criteria, HiTRUST, ISO 27001 certification standard, or NIST Cybersecurity frameworks.
* DE performing risk management and IT audits, and implementing ITGC or cybersecurity controls for large-scale, complex IT infrastructures, including mainframe,…