Platform SOX Risk Analyst

Role & responsibilities The role partners with platform leaders, control owners, control performers, Internal Controls, Finance, audit teams, and cybersecurity stakeholders to evaluate control design and operating effectiveness, enforce evidence and execution requirements, identify and communicate deficiencies, and drive timely, sustainable remediation Analyze and monitor compliance with SOX 404 requirements for assigned IT processes, applications, platforms, and Process 20 General IT Controls Evaluate whether assigned controls are appropriately designed to mitigate identified financial-reporting risk and whether controls operate as designed Assess local application of global control designs; review control performance, evidence, test results, and documentation for completeness, accuracy, and supportability to third parties Apply appropriate testing methods and population and sampling concepts; analyze results and identify design or operating deficiencies Preferred candidate profileDemonstrated experience applying Sarbanes-Oxley Section 404 requirements to information technology processes, systems, applications, or technology-dependent financial controls. Demonstrated experience evaluating the design and operating effectiveness of General IT Controls, including controls relevant to access, change management, technology operations, interfaces, automated processing, or other assigned SOX-IT control areas. Practical experience performing or reviewing SOX control assessments using inquiry, observation, inspection, and limited re-performance, with inquiry supplemented by corroborating evidence. Demonstrated ability to evaluate control populations, sampling approaches, test procedures, evidence, exceptions, and conclusions for completeness, accuracy, consistency, and audit supportability. SOX and internal-control knowledge: Working knowledge of SOX 404, internal control over financial reporting, COSO principles, and the relationship between technology controls and reliable financial reporting. IT control analysis: Ability to determine whether an IT control is appropriately designed to address the assigned risk and whether the control is operating consistently as designed.