What you'll be doing

Analyze and optimize existing IT SOX scope across applications and infrastructure by identifying duplicate, redundant, or over-engineered ITGCs/ITACs.
Establish Risk and Control Matrices (RACMs) and identify necessary controls for newly in-scope SOX applications and platforms.
Document and maintain end-to-end dependency maps, including data flows, infrastructure connections, and automated interfaces.
Support control testing (Design & Operating Effectiveness) across cloud infrastructure and SaaS platforms as needed.
Collaborate with stakeholders in Finance, Risk, Security, and Platform teams to communicate SOX 404 requirements and expectations effectively.

Requirements

3+ years of experience in Technology Risk or IT Audit with a focus on SOX.
Deep knowledge of SOX 404 requirements, COSO framework, and IT control frameworks such as NIST and ISO27001.
Experience with first-time SOX audits in cloud-native environments.
Understanding of compliance framework mapping to dynamic infrastructures.
Ability to assess the quality of RACMs and recognize missing or duplicative control coverage in system architecture diagrams and control frameworks.
Strong communication skills to translate technical details into audit-ready documentation and explain compliance rationale clearly to engineers.