IT Controls Manager - Remote ON (Canada) (Ontario, Canada)

Aurora Cannabis; Canada; Remote; CAD 111,000 - 137,000; Full time

Job summary

Aurora Cannabis Inc. is seeking an IT Controls Manager to lead the design, execution, and ongoing governance of the company’s IT control environment across Canada, Europe, and Australia.

You will own ITGCs, coordinate with IT and business teams, and ensure controls are properly documented and evidenced for SOX and regulatory audits. The role requires practical experience with IT risk assessment, change management, user access controls, and ERP security, including Sage X3.

Qualifications

• Experience designing, implementing and operating ITGCs and IT control documentation.
• Proven ability to coordinate IT and business stakeholders for audits and remediation.
• Knowledge of SOX requirements and regulatory IT control standards.

Responsibilities

• Execute and oversee IT General Controls (ITGCs) across regions; ensure controls are designed, executed, and evidenced.
• Coordinate IT control activities with IT teams, application owners, and auditors; maintain control matrices and narratives.
• Support SOX ITGC activities, maintain evidence in ServiceNow GRC, and drive remediation efforts.

Skills

IT controls

SOX compliance

ITGCs

Risk assessment

Audit coordination

Documentation

Tools

Sage X3 ERP

ServiceNow GRC

Job description

IT Controls Manager Division: IT Location: Remote Ontario (Canada) Hours: 40 hours per week, Monday to Friday Employment type: Permanent Salary: $111,000 - $137,000

A little about us

Aurora is proud to be a global leader in the cannabis industry. With a smart strategy, unmatched talent and focus on our long-term success, we believe we have a bright future. At Aurora, we're passionate about helping patients improve their lives through high-quality premium medical cannabis under brands they can trust and rely on. Our products, available across Canada, Europe, Australia, and New Zealand, include leading brands like Pedanios, IndiMed, San Raf, Whistler, Greybeard and CraftPlant. Our diverse team works passionately across various roles, from manufacturing to corporate positions, and many more, united by our purpose: Opening the World to Cannabis . Enabled by science and empowered by people, for patients and consumers. We collaborate globally, embrace change with courage, stay agile, and treat everyone with compassion. We live our values daily, making a meaningful impact on patients, communities, and our A-Team.

Job Summary

The IT Controls Manager is responsible for the execution, oversight, governance, and continuous improvement of the organization's IT control environment across Canada, Europe, and Australia. The role is accountable for assigned IT General Controls (ITGCs) and coordinates control activities across IT and business application teams to ensure controls are appropriately designed, consistently executed, adequately documented, monitored, and maintained in accordance with organizational policies, SOX requirements, and applicable regulatory standards. Responsibilities include maintaining control documentation, evaluating control effectiveness, identifying risks and deficiencies, coordinating remediation activities, and ensuring appropriate evidence is retained to support internal and external audits. The position works closely with IT leadership, Business Application Owners, Information Security, Internal Audit, and external auditors to support compliance objectives, strengthen IT governance, and promote consistent control practices across regions. The role also supports the assessment of IT risks associated with system changes, new applications, third‑party services, and evolving business processes, while identifying opportunities to improve control efficiency, standardization, and automation. Practical knowledge of Sage X3 ERP is essential to assess and oversee application‑related security, user access, segregation of duties, change management, and operational controls. The position collaborates with technical and functional teams to address control gaps, implement sustainable improvements, and maintain an effective, audit‑ready IT control environment.

Interesting? Here is a little more...

As an IT Controls Manager you will...

IT Control Ownership & Governance

Execute and oversee assigned IT General Controls (ITGCs), ensuring controls are appropriately designed, consistently performed, documented, and supported by sufficient evidence. Coordinate control activities with IT teams, Business Application Owners, and other stakeholders to ensure timely execution and compliance with established requirements. Maintain and update IT risk and control matrices, control narratives, inventories, procedures, and supporting documentation to reflect changes in systems, processes, and regulatory requirements. Establish and maintain control execution schedules, evidence requirements, accountability, and escalation procedures to support consistent control practices across regions.

Assess control design and operating effectiveness, identify control gaps and deficiencies, and recommend appropriate corrective actions. Review third‑party SOC reports, assess relevant control gaps and complementary user entity controls, and coordinate implementation of mitigating or compensating controls where required. Support the consistent application of IT control standards and governance practices across Canada, Europe, and Australia.

SOX & Regulatory Compliance

Coordinate and perform SOX ITGC activities across in‑scope applications, infrastructure, identity and access management, change management, and IT operations. Maintain accurate and complete control evidence, assessments, attestations, exceptions, and remediation records within ServiceNow GRC. Conduct IT control walkthroughs and coordinate audit requests, evidence submissions, and follow‑up activities with Internal Audit and external auditors. Monitor control execution and effectiveness, identify overdue or ineffective controls, and elevate compliance issues to appropriate stakeholders.

Assess control deficiencies, evaluate associated risks, coordinate corrective action plans, and validate the effectiveness of remediation activities prior to closure. Support internal and external audit activities, including audit planning, testing, issue resolution, and ongoing audit readin