How to get hired as a data governance analyst in 2026-27

What a data governance analyst actually owns

A data governance analyst makes an organisation's data findable, understood, trusted and appropriately restricted, and does it mostly through other people. You are not usually the person who builds the pipeline or writes the transformation. You are the person who decides what the thing is called, which copy is authoritative, who is accountable for it, what quality threshold it has to clear, who may see it, how long it is kept, and what happens when any of that fails. The output of the job is agreements, records and enforced rules, not tables.

In day-to-day terms the work splits into a handful of recurring deliverables. A business glossary and a data catalogue, populated with definitions and owners rather than left as an empty tool nobody opens. A register of critical data elements, the short list of fields the company genuinely cannot get wrong, with rules and thresholds attached. Data quality monitoring and an issue log, with remediation tracked to a close date and a person. Classification and handling: what counts as confidential, restricted, personal or special category, and what each tier means in practice for storage, sharing and masking. Access and entitlement reviews. Retention schedules and defensible disposal. Lineage, at least for reporting that someone external relies on. And a governance forum of some kind, a council or working group, which you prepare the material for and chase the actions out of.

The part that surprises people entering the role is how much of it is writing and persuasion. You will draft standards that an auditor has to accept and a working engineer has to be able to follow, which are different audiences. You will sit between two teams who each insist their definition of "active customer" is the real one, and your job is to land one definition, publish it, and keep it from quietly forking again six months later. You have influence rather than authority almost everywhere, which is why interview panels probe how you handle a business owner who will not engage far more than they probe your framework recall.

One distinction worth having straight before you interview: governance sets the rules and holds accountability; stewardship applies them inside a business area; data management and engineering implement them in systems. A good shop has all three and does not confuse them. A bad shop hires one governance analyst, hands them a catalogue licence, and expects the data to become trustworthy. Ask which you are walking into.

• Business glossary and data catalogue: definitions, owners, stewards, certification status, and the deprecation of duplicates.
• Critical data element register: the short list of fields that must be right, with rules, thresholds and escalation attached.
• Data quality: profiling, rule authoring, monitoring, an issue log with owners and dates, and root cause write-ups.
• Classification and handling standards: tiers, what each tier requires, and the exception process.
• Access and entitlement reviews, including service accounts and, increasingly, agent identities.
• Retention schedules, legal holds and defensible disposal.
• Lineage for regulated or externally reported figures.
• Governance forum operation: agenda, decision log, actions chased to closure.
• Data sharing and third party assessments, often shared with privacy and vendor risk.
• Data set and model inventory entries where the company trains or fine-tunes on its own data.

The five jobs hiding inside the title, and how to read the posting

"Data governance analyst" is not one job. The same title covers at least five materially different roles with different skills, different interview panels and different pay bands. Applying to all of them with one resume is the most common reason a qualified person gets no replies.

Read the verbs and the named tools in the posting, not the title. If the posting lists a catalogue platform and talks about onboarding domains, it is a metadata job. If it lists data quality tooling and talks about remediation, it is a quality job. If it names a regulation and talks about evidence and audit, it is a control job and will be screened partly by risk or compliance people. If it names master data, golden records or survivorship, it is an MDM stewardship job and the day looks like resolving duplicate customer records. If it names Purview, sensitivity labels, DLP, oversharing or Copilot readiness, it is an information protection job sitting closer to security than to analytics.

The practical move is to pick one lane, write a resume for it, and keep the other versions in a folder. A hiring manager in a quality lane does not care that you have read the whole DMBOK. They care that you have written a rule, watched it fire, and chased the fix.

• Metadata and catalogue lane: populate and curate a catalogue and glossary, onboard domains, certify assets, drive adoption. Measured on coverage and usage. Tools named: Collibra, Alation, Atlan, Informatica Cloud Data Governance and Catalog, Microsoft Purview, data.world, Select Star, Secoda, OpenMetadata, DataHub, Unity Catalog, Snowflake Horizon.
• Data quality lane: profile sources, author rules, run the issue log, write root cause analyses, report to a forum. Tools named: Collibra Data Quality, Informatica Data Quality, Ataccama, Soda, Great Expectations, Anomalo, Bigeye, Monte Carlo, dbt tests.
• Regulatory and control lane: map a regime to controls, gather evidence, support internal audit and examiners. Banking shops talk about risk data aggregation and reporting; pharmaceutical and medical device shops talk about data integrity and validated systems; healthcare talks about protected health information; education talks about student records. Measured on whether an auditor accepts your evidence.
• Master data and reference data lane: stewardship of customer, product, supplier, location or employee masters, match and merge rules, survivorship, reference code sets. Tools named: Informatica MDM, Reltio, Stibo, SAP MDG, Semarchy.
• Information protection and AI readiness lane: classification at scale, sensitivity labels, DLP policy, permission remediation before a copilot is switched on, data set approval for training. Tools named: Microsoft Purview, BigID, Securiti, OneTrust, Immuta, Privacera, Varonis.

What gates the job: no licence, and which credentials actually move a screen

Nothing licenses this role. There is no registration, no mandatory exam, no protected title, and no required degree, which is both good news and the reason the field is crowded with people whose only evidence is a course certificate. Because there is no licence, the filtering happens in two places: a recruiter keyword screen, and a hiring manager looking for proof you have done the work inside a real organisation with real politics.

CDMP, from DAMA International, is the credential most likely to be named in a posting and most likely to be searched by a recruiter. It is examined against the DMBOK, the Data Management Body of Knowledge, which is also the vocabulary most governance teams use internally, so studying for it has a second benefit: you stop guessing at terms like reference data, data lineage, data architecture and stewardship, and start using them the way the panel uses them. The entry point is the Data Management Fundamentals exam, and the higher tiers add specialist exams and experience requirements. Treat the published scheme as the only authority on current structure, pass marks, fees and experience rules, because they have changed before and the rules on a blog post from a few years ago are not reliable.

AIGP, IAPP's AI governance credential, has become genuinely relevant to this role rather than adjacent to it. If an employer is building or fine-tuning models on its own data, the person who maintains the data set inventory, records provenance and licensing, and signs off that a data set may be used for training is often the data governance analyst. A posting that mentions model inventories, AI use case registers, or an AI management system is a posting where AIGP will be read as on-point. CIPM or CIPP/E matter when the seat is bolted to privacy, which it frequently is in European organisations. CDPSE matters where governance reports into IT risk.

Platform certifications are cheap, fast and narrow. A Collibra, Alation, Atlan, Informatica or Microsoft information protection credential will not persuade anybody that you can govern data, but it reliably gets you past a filter for a shop standardised on that platform, and it removes the "would need training on the tool" objection. Take the one your target employers name. Taking three is a waste of a month.

What does not gate the job, despite being endlessly recommended: a master's degree, a general cloud architecture certification, and a scrum credential. None of them appear as a requirement in a typical governance posting and none of them answer the question the panel is actually asking.

• Pick one body-of-knowledge credential (CDMP for most people) and one platform credential matched to your target employers. Stop there.
• Add AIGP only if you are aiming at a shop governing AI data, where it is on-point rather than decorative.
• Verify every exam rule on the issuing body's own site. Do not plan a route around a secondhand description of eligibility.
• A credential never substitutes for one real artefact. If you have to choose where the next sixty hours go, build the artefact.

The regulation and framework knowledge you are expected to operate, not recite

Interviews for this role test regulation differently from compliance interviews. Nobody asks you to recite an article number. They ask what you would actually do, and they can tell within two answers whether you have operated a rule or only read about it. The useful preparation is to take the two or three regimes that apply to your target sector and be able to describe the artefact each one makes you produce.

Under European data protection law you should be able to describe a record of processing activities and what goes in one, what a lawful basis is and why it constrains reuse of data you already hold, what purpose limitation and storage limitation mean for a retention schedule, and how a data subject access or erasure request actually gets executed across a warehouse, a backup and twelve SaaS tools. Under US state privacy law the equivalents are a data inventory, a deletion and opt-out workflow, and sensitive data handling. In healthcare it is protected health information, minimum necessary access, and the difference between de-identification and pseudonymisation. In banking the big one is risk data aggregation and reporting, where supervisors expect documented lineage, ownership and quality controls for the data behind risk reporting, and where governance teams are judged on whether that documentation survives an examination. In pharmaceutical and medical device manufacturing it is data integrity: records that are attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available, in validated systems with audit trails.

On AI regulation, be careful and be accurate, because this is where candidates damage themselves. The EU AI Act imposes data governance obligations on high-risk systems, covering the quality, relevance and representativeness of training, validation and test data sets, examination for bias, and documentation of data provenance and preparation choices. That substance is stable and worth knowing. The timetable is not: obligations have been phased, and the phasing has been amended since the Act was adopted. Say what the obligation is and say that the applicable date should be checked against the current text, which is both honest and exactly what a governance professional should instinctively do. A candidate who confidently states a wrong compliance date in an interview has demonstrated the single most dangerous habit in the profession.

For frameworks, know the shape of the ones your market uses rather than memorising all of them. DAMA-DMBOK gives you the knowledge areas and the common vocabulary. DCAM and CDMC, from the EDM Council, are capability assessment models that large financial institutions use to score themselves, and if a posting names one you will be asked about assessment and evidence. ISO 27001 governs the information security management system your classification tiers plug into. ISO/IEC 42001 defines an AI management system, and NIST's AI Risk Management Framework is the voluntary framework most US organisations map to. The data quality dimensions (completeness, accuracy, validity, consistency, timeliness and uniqueness, sometimes with others added) are the language you will write rules in, so be able to give a concrete rule for each one on a table you have actually seen.

• Be able to name the artefact a regime produces, not the article number: a processing record, a retention schedule, a lineage pack, an audit trail, a data set approval.
• Know your sector's one big regime cold and the others at the level of "what it would make me produce".
• State AI data obligations without stating a deadline, or name the date and say it must be checked. Both are correct. Guessing is not.
• Map every framework claim to something you did. "We ran a DCAM assessment and scored 1.8 on data quality, and my remediation plan moved two capabilities" beats "familiar with DCAM".

How hiring for this role actually works in 2026-27

The seat is usually posted by a central data office, sometimes by risk or compliance, occasionally by IT. That matters, because whoever owns the requisition sets the panel and the vocabulary. A data office panel probes adoption and definitions. A risk panel probes evidence and controls. An IT panel probes tooling and access models. Read the reporting line in the posting and prepare for the panel it implies.

The loop is short compared with engineering hiring and heavily weighted towards writing and conversation. A recruiter screen checks the obvious: the lane, the platform, authorisation to work, the salary range, whether you can pass a background check. Then the data governance lead or data management manager, which is the real screen and usually the longest conversation of the process. Then an exercise. Then a stakeholder panel. Sometimes a short skip-level.

The exercise is the stage people underprepare for, and it comes in four recognisable shapes. First, a glossary or catalogue exercise: here are three overlapping definitions of a term from three teams, produce one definition and tell us how you would get it accepted. Second, a data quality triage: here is a profile of a table, or a ten-row extract full of problems, tell us what is wrong, which problems matter, what rules you would write and at what threshold, and what you would do first. Third, a policy or standard writing task: draft a one-page classification standard or a retention standard for a named data domain. Fourth, a scenario: personal data has been found in a place it should not be, or a report has gone out with a wrong number, and you are asked to walk through containment, root cause, remediation and prevention. Expect two to four hours of work for a take-home and forty-five minutes for a live case.

The stakeholder panel is the stage that decides offers, and it is deliberately adversarial in a mild way. One member is typically from a business line and does not report to the data office. Their test, stated or not, is whether talking to you would feel like help or like an audit. Candidates who talk about enforcement, control and compliance in that conversation lose it. Candidates who talk about what the business line gets (faster answers, fewer arguments about numbers, less rework, an owner who can actually decide) win it.

Timelines diverge sharply by sector. A commercial technology or retail employer can run this in two to five weeks. Banks, insurers, hospital systems, universities and government move in six to fourteen weeks, with approval chains, panel scheduling and background checks dominating. If a public sector posting lists a grade and step, the pay is not negotiable in the usual sense; the negotiation is about step placement and about the grade the position is classified at.

• Stage 1: recruiter screen. Lane, platform, range, background check, work authorisation.
• Stage 2: the governance lead. Your artefacts, your worst governance failure, how you handled a non-cooperative owner.
• Stage 3: exercise. Glossary arbitration, quality triage, policy drafting, or an incident scenario.
• Stage 4: stakeholder panel including a business line representative, usually plus privacy or legal and a platform engineer.
• Stage 5 (sometimes): CDO or head of data, on how you would sequence the first ninety days.
• Background check and, in the public sector, clearance or public trust processing can add weeks after the offer. Ask about it early so you can plan your notice period.

What a data governance analyst has to know about AI in 2026-27

Start with the honest version, because an inflated one will be visible in the room. AI has not automated the core of this job, and the core is not in much danger. The hard parts are getting a named human to accept accountability for a data element, landing one definition when two departments want different ones, writing a standard an auditor accepts and an engineer can follow, and chasing remediation to a close date. None of that is a machine learning problem. What AI did was increase demand for the role, enlarge its scope, and change the balance of the work from producing metadata to reviewing machine-produced metadata.

What actually changed, in order of how much it affects your week. First, classification and metadata generation got cheap. Catalogue and security platforms now auto-detect personal and sensitive data, infer lineage from query logs, suggest glossary descriptions, and let people search metadata in natural language. The bottleneck moved from producing those entries to confirming them. False positives are the dominant cost: an aggressive classifier that labels every numeric column a potential identifier generates work and destroys trust in the tool. Being able to talk about how you tuned a classifier, sampled its output, measured precision on a known set, and decided what gets auto-applied versus what requires human confirmation is now one of the most differentiating things you can say in a 2026 interview.

Second, and this is the biggest practical change: retrieval assistants turned permissions into a correctness problem. When a company switches on an enterprise copilot over its documents, the assistant surfaces anything the user is technically permitted to open, including the years of over-shared folders, "anyone in the organisation" links and stale group memberships nobody ever cleaned up. The result is a workstream that did not exist a few years ago: find the oversharing, remediate it, apply labels, set retention, and only then enable the assistant. Many data governance analyst postings in 2026 are really this job. If you have done permission remediation before a copilot rollout, put it on the resume in those words, because it is being hired for directly.

Third, agents and assistants now query warehouses and SaaS systems themselves, through connectors and server interfaces, using service identities rather than human logins. That makes non-human identity part of governance: which agent can read which tables, under whose authority, with what masking applied, logged where, reviewed by whom, and revoked when the project ends. Access reviews that only cover employees are now incomplete. Row-level security, dynamic masking and purpose-based access policies stopped being advanced topics and became the baseline a governance analyst is expected to understand well enough to specify, even if a platform engineer implements them.

Fourth, training data became a governed asset. If your employer fine-tunes, builds retrieval systems over internal content, or sends data to a model provider, somebody has to record what data set was used, where it came from, what licence or contract permits that use, whether consent or lawful basis covers it, whether personal data was removed and how, and what the data set is approved for. That record is a governance deliverable, close kin to the record of processing you already know how to build. Documentation practices from the research world (data set documentation describing composition, collection method, intended uses and known limitations) have become normal enterprise artefacts. Expect to be asked how you would decide whether a given data set may be used for training, and expect the good answer to involve a named approver and a written record, not a personal opinion about risk.

Fifth, the metadata layer became the thing that determines whether the company's AI answers correctly. A conversational analytics tool or an agent asking questions of the warehouse is only as right as the definitions, descriptions, certification status and metric logic underneath it. Governance work that used to be filed under housekeeping now visibly changes whether an executive gets a correct number from a chatbot. This is the single best argument a governance analyst has ever had for funding, and you should be able to make it in two sentences without overselling it.

What is not being automated, stated plainly for the interview: deciding which of two systems is authoritative; getting an owner named and accountable; arbitrating a contested definition; judging whether a quality threshold is strict enough to be useful and loose enough to be survivable; deciding retention against a legal hold; writing an exception with an expiry; persuading a director to fund remediation. Machine output in this field is a candidate list that a human confirms. Say that, and say it without either dismissing the tooling or pretending the job is now mostly technical.

Finally, the thing to avoid saying. Do not claim AI has transformed data governance into a technical discipline, and do not claim that generative tooling has solved data quality. Neither is true, and both are easy for a panel to puncture. The defensible position is the accurate one: AI raised the stakes and the budget for governance, automated the production of candidate metadata, created two genuinely new workstreams (permission remediation before assistant rollout, and data set and model inventory), and left the political core of the job exactly where it was.

• Be able to describe tuning an auto-classifier: sample, measure, decide what auto-applies, decide what a human confirms.
• Be able to describe permission and oversharing remediation ahead of an enterprise assistant rollout, in those words.
• Be able to specify access control for a non-human identity: scope, masking, logging, review cadence, revocation.
• Be able to produce a data set approval record: source, licence or contract, lawful basis, personal data handling, approved uses, approver, expiry.
• Be able to connect metadata quality to the accuracy of AI answers, in two sentences, without hype.
• Be able to say clearly what has not changed, and why that part is the job.

The resume: what lands, and what gets skipped entirely

Governance resumes fail in a specific way. They read as a list of responsibilities and frameworks, with no evidence that anything changed. "Responsible for data governance activities including stewardship, data quality and metadata management" tells a hiring manager nothing, because every applicant wrote some version of it. The fix is to replace responsibility language with artefacts, scope numbers and outcomes.

Scope numbers are the cheapest credibility you can buy, and almost nobody includes them. How many systems or domains were in scope. How many critical data elements you had rules on. How many data owners and stewards you onboarded, and out of how many you were supposed to. Catalogue coverage and, more importantly, catalogue usage, because coverage without usage is shelfware and a good manager knows it. Number of open quality issues when you arrived and when you left, and the median age of an open issue, which is the number that actually reveals whether a governance programme functions. None of these require you to disclose anything confidential.

Name tools precisely, because recruiter screens are keyword screens, but anchor each one to a verb. "Collibra: onboarded four domains, authored 180 glossary terms, built the certification workflow" survives a hiring manager's eye. "Collibra, Alation, Purview, Informatica, Atlan" in a skills block reads as a tool tour and invites a question you will not enjoy. Include SQL explicitly. A surprising number of governance candidates leave it off and get filtered out by managers who have been burned by hiring someone who could not read a profile.

What gets skipped: a long frameworks list with no application, a summary paragraph of adjectives, non-specific certifications in unrelated areas, and any claim of "led enterprise data governance" from someone whose scope was one team and three reports. Panels check that one, and the gap between claim and scope is unrecoverable once found. Also skip anything that reads as policing. "Enforced compliance across business units" makes the business line panel member nervous; "worked with four business units to agree definitions that ended a recurring reporting dispute" makes them want you.

Two more practical points. If you have worked in a regulated sector, say which regime and what you produced for it, because that is the fastest way to be shortlisted for a same-sector role, and same-sector hiring is how most governance moves happen. And keep one line, no more, on the governance forum you ran: how often it met, who sat on it, how many decisions it closed. Running a forum badly is extremely common, so running one well is a differentiator you can state in fifteen words.

• Lead with artefacts you produced: a glossary, a critical data element register, a quality rule set, a classification standard, a retention schedule, an access review, a data set approval record.
• Attach scope: systems, domains, elements, owners onboarded, issues opened and closed, median issue age.
• Report usage, not only coverage. Monthly active catalogue users, or search volume, is the number that proves the programme is alive.
• Name the regime and the artefact you produced for it if you have regulated-sector experience.
• State SQL explicitly, with what you used it for (profiling, rule authoring, reconciliation).
• Cut adjective summaries, framework lists without application, and any phrasing that reads as enforcement rather than help.

The interview, question by question

Governance interviews repeat a small set of questions with high reliability, because the failure modes of the role are well known. Prepare the six below properly and you will be prepared for most of the loop.

"Two teams define active customer differently. What do you do?" The weak answer picks one. The strong answer establishes why each definition exists (almost always because each team is measured on something different), checks whether both uses are legitimate, and then either lands one canonical definition with the other published as a named variant, or escalates to a decision maker with a written recommendation and the consequence of each option. Say out loud that you publish the outcome and set a review date, because the real failure is not the initial argument, it is the silent fork six months later.

"A business owner will not engage. What now?" This is the question that decides whether a panel believes you have actually done the job. The weak answer escalates immediately. The strong answer finds out why: usually the owner has no capacity, sees no benefit, or was never told they were an owner. Then it reduces the ask to something small and concrete with a date, offers to do the drafting, demonstrates a benefit they care about, and only then escalates, with evidence of attempts and a specific decision requested rather than a complaint. Mention that you would never surprise someone with an escalation.

"Here is a table profile. What is wrong and what would you do first?" Expect NULLs in a field that should be mandatory, duplicates against a key you were told was unique, a date in the future, a free-text field holding four spellings of the same country, a numeric field with a sentinel value, and a foreign key with orphans. Triage out loud by consequence rather than by severity of the anomaly: which of these changes a number someone external relies on, which merely annoys an analyst. Propose rules with thresholds and say why the threshold is not one hundred percent, because a rule that always fails gets switched off.

"Walk me through a governance failure you owned." Have one ready, with the mechanism and the correction. A definition that forked. A retention rule that was never implemented because no one owned the system. An access review that passed while a shared service account held standing production access. The panel is testing whether you can describe a failure without blaming a department, and whether your correction had a mechanism rather than a promise to communicate better.

"How would you spend your first ninety days?" The answer that fails proposes an enterprise-wide programme, a full catalogue rollout and a policy suite. The answer that works is narrow: pick one domain with a real pain and a willing owner, inventory what exists, agree a handful of critical data elements, instrument them, publish the result where people already look, and use that as the reference case to fund the next domain. Say explicitly that you would not try to govern everything, because restraint is the senior signal in this role.

"How do you measure whether governance is working?" Weak answers count artefacts. Strong answers name outcomes with mechanisms behind them: time to find and understand a data set, the number of reporting disputes that reach a forum, median age of open quality issues, the proportion of critical data elements with a named owner and an active rule, access review exceptions closed on time, and the number of duplicate data sets retired. Mention at least one metric that can get worse, because a dashboard of only increasing numbers is a sign nobody is being honest.

Expect also a short regulation question matched to the sector, one scenario about personal data in the wrong place, and a question about where your authority ends. On the last one, the correct answer is that you own the records and the recommendation, the business owns the decision and the risk, and your job is to make the choice visible and documented rather than to make it yourself.

• Rehearse the contested definition question with a real example, including how you published the outcome.
• Rehearse the non-cooperative owner question with diagnosis before escalation.
• Practise profiling out loud on a messy table, triaging by consequence and proposing thresholds with reasons.
• Prepare one real governance failure, with a mechanism as the correction.
• Prepare a deliberately narrow ninety-day plan and say out loud what you would not do.
• Have metrics that can move in both directions.

Pay: where the number comes from, and what actually moves it

Be sceptical of any single band quoted for this title, including bands in aggregator articles, because the role has no dedicated occupational classification and the title spans a trainee stewardship seat and a programme lead. In US federal statistics the closest OES occupations are Computer Systems Analysts (15-1211), Database Architects (15-1243), Data Scientists (15-2051) and Compliance Officers (13-1041), and a given governance analyst may genuinely belong to any of them depending on what the work is. Look up those codes, including the metropolitan area tables, for a defensible floor and spread rather than a headline number.

The sources that will actually tell you what a specific job pays, in order of usefulness. Pay-transparency postings: several US states require a range in the posting, so search current postings in those states for your target lane and seniority and read the ranges directly, which also tells you how a given employer bands the role. Public sector and university postings: these publish a grade, a step and often the whole table, so the number is exact and the negotiation is about classification and step placement rather than the band. Your own target employer's other postings: if their data engineer and their governance analyst postings are both visible, you learn which ladder governance sits on, which is the biggest single driver of the number. Union scale does not generally apply to this role, and salary surveys from recruitment firms are directional at best.

What moves the number, in rough order of effect. Which ladder the role sits on: a governance analyst placed on a technology or data ladder is usually paid more than the same work placed on a compliance or operations ladder, and that choice is made by the organisation before you arrive. Sector: financial services, insurance and large technology employers pay above healthcare systems, higher education, non-profits and most of the public sector, where the compensation case is stability, pension and predictable hours. Regulated scope: being accountable for data behind regulatory reporting or for a regime with examination risk commands more than internal analytics governance. Platform depth in the tool that employer runs. And the ability to run the forum and own the relationships, which is what separates an analyst from a lead and is usually a full band step.

One negotiation point specific to this role: ask early whether the seat has a budget and an executive sponsor, or whether you are expected to generate authority from nothing. Both jobs exist under the same title and the same band. The second is much harder, and if you take it, the thing to negotiate is not only money but access: a named sponsor, a standing forum, and a written mandate. Without those, the role becomes documentation nobody reads, which is also the reason this title has high turnover.

• No dedicated SOC code exists. Triangulate across 15-1211, 15-1243, 15-2051 and 13-1041 rather than trusting one quoted band.
• Read live pay-transparency postings in states that require a range. That is the most honest market data available to a candidate.
• In public sector and university roles, the grade and step table is published. Negotiate classification and step, not band.
• Ask which ladder the role is on. It affects pay more than your experience does.
• Negotiate sponsor, mandate and a standing forum alongside salary. Without them the role cannot succeed at any pay.

Getting in without the title, and where these jobs are actually posted

Most data governance analysts did not start as one. The common entries are from data or business analysis (you already know the systems and the SQL), compliance or audit (you already know evidence and control language), records and information management (you already know retention and classification), privacy operations (you already know inventories and subject requests), master data stewardship (you already know definitional arguments), and database or platform administration (you already know access and lineage). Each of those is a legitimate story if you tell it as a lane rather than as a career change.

The fastest route inside your current employer is to do a piece of the job before you have the title. Pick one painful data set that your own team argues about. Write the definitions down. Find out who actually owns the source. Profile it and write three quality rules with thresholds. Publish the result where your team already looks, not in a new wiki nobody will open. Then bring the before and after to your manager. That single exercise produces exactly the artefact the interview asks for, demonstrates that you can drive a definition to agreement, and is visible enough to be the reason you are considered when a governance requisition opens, which is how a large share of these seats are filled.

If you are outside, build the same artefact on data you can legally obtain. A public open data portal with genuinely messy fields works fine: profile it, document a classification and retention stance for it, write rules, and write a one-page critical data element record. Then write up the judgment calls, because the judgment is the product. A short, specific write-up of three decisions you made and why beats a certificate, and it gives an interviewer something to argue with you about, which is the most useful thing you can hand them.

On where to look: a meaningful share of these jobs are posted under other titles. Search data steward, data quality analyst, metadata analyst, data management analyst, information governance analyst, information management officer, master data analyst, data controls analyst, reference data analyst, and data governance specialist alongside the main title. Large banks, insurers, hospital systems, pharmaceutical manufacturers, universities, utilities and government agencies are the highest-volume employers, and many of them post only on their own careers site and on sector job boards. Consultancies and the catalogue vendors themselves hire governance people continuously and are a fast way to see twenty organisations in two years, at the cost of travel and billable hours.

A final word on expectations. This role is slow in a way that frustrates people who come from delivery work. A definition can take six weeks to agree. A retention schedule can take a year to implement because it depends on systems other people own. The practitioners who last are the ones who treat a signed-off definition and a closed issue as the win, keep a visible record so progress is legible to people who were not in the room, and do not try to govern everything at once. Panels are listening for that temperament, and it is reasonable to show it rather than claim it.

• Do a slice of the job in your current seat on one painful data set, and publish it where people already look.
• Outside a company, build the same artefact on messy open data and write up the judgment calls.
• Search the adjacent titles: data steward, data quality analyst, metadata analyst, data management analyst, information governance analyst, master data analyst, data controls analyst.
• Target sector by sector. Same-sector experience is the strongest shortlisting signal in this field.
• Apply to the catalogue vendors and consultancies for volume exposure if you can take the pace.

What a screen is looking for

These are the terms that a resume screen, human or automated, is matching against for this role. Use the ones that are true of you, in the words the posting uses.

• Data governance
• Data stewardship
• Data governance framework
• DAMA-DMBOK
• CDMP
• DCAM
• CDMC
• Business glossary
• Data catalogue
• Data catalog
• Metadata management
• Technical metadata
• Business metadata
• Critical data elements
• Data ownership
• Data owner
• Data steward
• Data governance council
• Data governance operating model
• Data quality
• Data quality rules
• Data profiling
• Data quality dimensions
• Completeness
• Accuracy
• Validity
• Consistency
• Timeliness
• Uniqueness
• Root cause analysis
• Issue log
• Remediation tracking
• Data quality dashboard
• Data lineage
• Impact analysis
• Reference data
• Master data management
• MDM
• Golden record
• Match and merge
• Survivorship
• Data classification
• Sensitivity labels
• Data loss prevention
• DLP
• Access review
• Entitlement review
• Role-based access control
• Row-level security
• Dynamic data masking
• Purpose-based access
• Least privilege
• Data sharing agreement
• Retention schedule
• Records management
• Defensible disposal
• Legal hold
• Information governance
• Data privacy
• GDPR
• Record of processing activities
• Lawful basis
• Purpose limitation
• Data subject access request
• CCPA
• CPRA
• HIPAA
• PHI
• PII
• De-identification
• Pseudonymisation
• Risk data aggregation
• Regulatory reporting
• SOX
• Data integrity
• ALCOA+
• GxP
• FERPA
• GLBA
• AI governance
• AIGP
• EU AI Act
• ISO/IEC 42001
• NIST AI Risk Management Framework
• Model inventory
• AI use case register
• Training data provenance
• Data set documentation
• Responsible AI
• Collibra
• Alation
• Atlan
• Informatica
• Microsoft Purview
• Unity Catalog
• Snowflake Horizon
• OpenMetadata
• DataHub
• Select Star
• Secoda
• data.world
• Collibra Data Quality
• Informatica Data Quality
• Ataccama
• Soda
• Great Expectations
• Anomalo
• Bigeye
• Monte Carlo
• dbt tests
• OneTrust
• BigID
• Securiti
• Immuta
• Privacera
• Varonis
• Reltio
• Stibo
• Semarchy
• SQL
• Data modelling
• Snowflake
• Databricks
• BigQuery
• Power BI
• Tableau
• Python
• Jira
• ServiceNow
• Confluence
• Policy writing
• Standards
• Control design
• Audit evidence
• Internal audit support
• Stakeholder management
• Change management
• Data literacy
• Training and enablement
• CIPM
• CIPP/E
• CDPSE
• ISO 27001

Mistakes that cost people this job

Questions people ask