IT SOX & Internal Controls Business Analyst

Pay Range: $66.11hr - $71.11hr

Job Overview:

The candidate will accomplish work through the application of technical skills and expertise in developing, planning and evaluating internal audit programs for the organization to ensure compliance with the organization's policies, procedures and standards. The role involves advising and working with leaders to determine proper accountability of assets, auditing accounting records, and preparing reports for management on audit results with recommendations for improvements. Additionally, the candidate will audit information systems applications to ensure appropriate controls exist and information produced is accurate.

Job Overview:

Job duties may include:

• Accomplish work through the application of technical skills and expertise in developing, planning and evaluating internal audit programs for the organization to ensure compliance with the organizations policies, procedures and standards.
• Advise, guide and work with other employees and leaders; determine proper accountability of assets; audit accounting records of contract agreements in which the organization is involved; prepare reports for management on the results of audits, providing recommendations on improvements; interface with and assists outside auditors to expedite their work.
• Audit information systems applications to ensure that appropriate controls exist and that information produced by the system is accurate; advise others on information systems, internal controls and security procedures; prepare reports for management on audit results.
• Education/Experience: Bachelor Degree in applicable profession, business, or technical discipline or an equivalent combination of education, training, and experience.
• Possesses seven to ten years of experience.

Responsibilities:

• The candidate will act as both a business analyst and SOX analyst supporting IT SOX, business controls, quality management, and control documentation activities. The role will partner with business, IT, internal audit, SOX Governance, external auditors, and leadership to develop, assess, document, test, and remediate internal controls across assigned portfolios, including control design and operating effectiveness.
• This includes ITGCs, automated/configurable controls, access controls, change management, SDLC controls, reports/IPE, interface controls, deficiency management, and control evidence.
• The role will also evaluate existing SOX, operational and compliance controls to identify opportunities for automation, simplification, standardization, and improved control efficiency while maintaining audit defensibility.
• Serve as overall lead / project manager / assessor for assigned portfolios; lead control deficiency review for IT SOX controls; lead document management for risk, audit and control matrices (RACMs), and control narratives; support scoping assessments, IT project SDLC control assessment and design, robotic process automation design reviews, scoping memos, remediation plans, governance reporting, and executive-ready status updates.
• Perform business analysis activities, including stakeholder interviews, requirements gathering, current-state and future-state process mapping, gap analysis, action tracking, and translating control needs into process or documentation requirements.
• Evaluate current SOX, operational and compliance controls and related processes for control design, operating effectiveness, automation, simplification, standardization, and documentation improvement opportunities without weakening control effectiveness or audit readiness.
• The organization is looking for a highly skilled internal controls professional who can operate independently, deal with ambiguity, and move work forward without needing step-by-step direction.
• The candidate should be resourceful, proactive, and comfortable working across business, IT, SOX Governance, internal audit, external auditors, and senior leadership. This role will support assigned portfolios, lead IT SOX deficiency reviews, manage RACM and control narrative documentation, and evaluate existing SOX, operational, and compliance controls for control design, operating effectiveness, automation, simplification, and standardization opportunities.
• The candidate must bring strong critical thinking, a learning mindset, and confidence using AI and digital tools to modernize analysis, documentation, reporting, and control execution while maintaining audit defensibility.

Requirements:

• 7+ years of experience implementing internal control policies, processes, controls, and system improvements; strong SOX, regulatory, operational controls, risk management, audit coordination, and business analysis experience; ability to lead cross-functional teams, assess complex problems, develop control documentation, manage RACM and narratives, support control testing, evaluate control design and operating effectiveness, synthesize data/process flows, and communicate clearly with frontline teams through executive leadership.
• Must have strong knowledge of ITGCs and control domains including access, change management, SDLC, automated/configurable controls, reporting, interfaces, control deficiency management, and control evidence.
• Must demonstrate strong critical thinking, sound judgment, learning mindset, resourcefulness, and the ability to deal with ambiguity and challenge existing control designs and processes constructively.
• Must be comfortable using AI and digital tools to modernize work, improve analysis, streamline documentation, and increase efficiency.

Education Requirement:

• Bachelor's degree preferred in business, accounting, finance, information systems, technology, engineering, or a related field; equivalent experience may be considered.
• Minimum Years of Experience: 7+ years.
• Length of Assignment: Up to 18 months, may be extended or converted to permanent depending upon business needs.

Desired Skills/Attributes:

• Experience with large-scale software implementations and/or enterprise business process control environments; utility industry experience; professional training or certifications in audit such as CIA, CISA, CRISC, or equivalent, quality management, controls, risk, or project delivery; experience liaising with internal/external auditors and producing executive-level presentations, SOX status reports, governance materials, control deficiency memos, remediation plans, scoping memos, process flows, control design and operating effectiveness assessments, testing support documentation, issue logs, decision logs, and control narratives.
• Experience identifying opportunities to automate or simplify SOX controls, reduce manual effort, improve evidence quality, and modernize control documentation using AI-enabled or digital productivity tools is strongly preferred.