IT SOX Auditor

We are seeking an experienced IT SOX Compliance Auditor to support and strengthen the organization's Sarbanes-Oxley (SOX) compliance program, with a primary focus on IT General Controls (ITGCs), financial application controls, and internal controls over financial reporting (ICFR). This role will support SOX audits, internal control assessments, control testing, remediation activities, and ongoing audit readiness initiatives.

The ideal candidate will have hands-on experience evaluating the design and operating effectiveness of IT controls, developing and maintaining Risk Control Matrices (RCMs), performing Test of Design (TOD) and Test of Operating Effectiveness (TOE), and coordinating with business, IT, and external audit stakeholders.

The position will also provide secondary support for FISMA-related assessments and broader information security compliance activities, as needed.

Position Responsibilities

· Support the organization's SOX compliance program, including annual SOX audits, ITassessments, and internal control reviews.

· Evaluate the design and operating effectiveness of IT General Controls across financial systems, applications, infrastructure, and supporting IT processes.

· Perform and document Test of Design (TOD) and Test of Operating Effectiveness (TOE) for key SOX controls, identifying control deficiencies and recommending corrective actions.

· Develop, maintain, and update Risk Control Matrices (RCMs), control narratives, process documentation, and SOX testing workpapers.

· Assess IT controls supporting financial reporting, including user access management, change management, IT operations, and segregation of duties.

· Review SOC 1 and SOC 2 reports, evaluate complementary user entity controls (CUECs), identify potential control gaps, and assess their impact on SOX compliance.

· Partner with process owners, IT teams, and business stakeholders to address control deficiencies, monitor remediation plans, and strengthen the overall internal control environment.

· Coordinate with external auditors and internal audit teams to facilitate SOX testing, provide audit evidence, and support timely resolution of audit findings.

· Support continuous improvement of SOX governance, risk, and compliance (GRC) processes, tools, documentation, and reporting.

· Maintain SOX policies, procedures, control standards, and audit documentation to ensure ongoing compliance and audit readiness.

· Provide secondary support for FISMA assessments, information security control reviews, and related regulatory compliance initiatives.

· Prepare periodic audit reports and provide management updates on SOX testing progress, control deficiencies, remediation activities, risks, and outstanding issues.

Position Qualifications

· At least 5 years of progressively responsible IT experience in IT auditing, SOX compliance, internal controls, information security, IT management, or related disciplines.

· Hands-on experience with SOX compliance, IT General Controls (ITGCs), and internal controls over financial reporting (ICFR).

· Demonstrated experience performing control assessments, Test of Design (TOD), and Test of Operating Effectiveness (TOE), including identifying and evaluating control deficiencies.

· Experience developing and maintaining Risk Control Matrices (RCMs), control narratives, audit workpapers, and remediation documentation.

· Strong understanding of key ITdomains, including user access management, change management, IT operations, and segregation of duties.

· Experience reviewing SOC 1 and SOC 2 reports and assessing their relevance to SOX compliance and financial reporting controls.

· Knowledge of SOX requirements, COSO, COBIT, and IT audit methodologies.

· Familiarity with FISMA, FISCAM, NIST frameworks, and federal information security compliance requirements is desirable.

· Experience with financial applications, ERP systems, and enterprise business systems.

· Ability to independently manage multiple audit assignments, coordinate with cross-functional stakeholders, and meet deadlines in a matrixed environment.

· CISA or CISSP certification strongly preferred.

___________________________________________________________________________

No Phone calls Please

Please apply with your resume in a word file including all your contact details