IT SOX Scoping and Governance Analyst

Wise; Greater London; On-site; GBP 68,000 - 88,000; Full time

Job summary

Wise is seeking an IT SOX expert to join our Security Controls team in London. You will drive scope rationalization, establish RACMs, and define ITGCs/ITACs for cloud-native applications and platforms, ensuring scalable, reliable controls.

With 3+ years in technology risk or IT audit and hands-on experience with AWS, Terraform, GitHub, Jira, Okta and SailPoint, you will translate technical detail into audit-ready documentation and collaborate with Finance, Risk, Security and Platform to meet SOX

Qualifications

• 3+ years of experience in Technology Risk or IT Audit with a dedicated focus on SOX.
• Experience with first-time SOX audits in cloud-native environments.
• Understanding of CI/CD, Change Management, and IAM in a microservices architecture.
• Ability to translate technical architecture details into audit-ready documentation.

Responsibilities

• Scope Rationalization & Optimization: Analyze and challenge existing IT SOX scope across applications and infrastructure.
• New System Onboarding: Establish RACMs and identify necessary ITGCs and ITACs for newly in-scope SOX applications.
• Dependency & System Mapping: Document and maintain end-to-end dependency maps.
• Controls Testing: Support control testing across cloud infrastructure and SaaS landscape.
• Stakeholder Management: Partner with Finance, Risk, Security, Platform to communicate SOX 404 requirements.

Skills

SOX experience

Cloud-native mindset

CI/CD

Communication skills

Tools

AWS

Terraform

GitHub

Jira

Okta

SailPoint

Job description

• Compensation: GBP 68,000 - GBP 87,500 - yearly

Company Description

Wise is a global technology company, building the best way to move and manage the world’s money.
Min fees. Max ease. Full speed.

Whether people and businesses are sending money to another country, spending abroad, or making and receiving international payments, Wise is on a mission to make their lives easier and save them money.

As part of our team, you will be helping us create an entirely new network for the world's money.
For everyone, everywhere.

We are looking for an IT SOX expert to join our mission and help us build a global platform that’s scalable, reliable, and secure. The Security Controls team plays a vital role in safeguarding Wise’s complex IT landscape. We specialise in the comprehensive testing, assessment, and continuous improvement of technology-related controls. This role will require you to drive scope rationalization, dependency mapping, and control optimization.

Your Mission

Scope Rationalization & Optimization: Analyze and challenge existing IT SOX scope across applications and infrastructure. Identify duplicate, redundant, or over-engineered ITGCs/ITACs and propose enhancements.

New System Onboarding: Establish RACMs (Risk and Control Matrices) and identify necessary ITGCs and ITACs for newly in-scope SOX applications and platforms.

Dependency & System Mapping: Document and maintain end-to-end dependency maps (upstream/downstream data flows, infrastructure ties, and automated interfaces) for management review.

Controls Testing: Where needed, support control testing (Design & Operating Effectiveness) across our cloud infrastructure and SaaS landscape.

Stakeholder Management: Partner with key stakeholders across Finance, Risk, Security, Platform to effectively communicate SOX 404 requirements and expectations.

Qualifications

A bit about you:

SOX Experience: You have 3+ years of experience in Technology Risk or IT Audit, with a dedicated focus on SOX. You possess deep knowledge of SOX 404 requirements, COSO framework, and IT control frameworks (NIST, ISO27001).

SOX Implementation: You have demonstrable experience with first-time SOX audits in cloud-native environments. You understand how compliance frameworks map to dynamic infrastructures.

Cloud-Native Mindset: You understand how Change Management works in a CI/CD pipeline and how Access Management works in a microservices architecture. Experience with AWS, Terraform, GitHub, Jira, Okta, and SailPoint is preferred.

Scope & RACM Quality: You know what a good RACM looks like and and can look at a system architecture diagram or control framework and spot where coverage is either missing or excessively duplicative.

Clear Communicator: You can translate technical architecture details into audit-ready documentation while explaining compliance "whys" clearly to engineers.

Additional Information

For everyone, everywhere. We're people building money without borders — without judgement or prejudice, too. We believe teams are strongest when they are diverse, equitable and inclusive.

We're proud to have a truly international team, and we celebrate our differences.
Inclusive teams help us live our values and make sure every Wiser feels respected, empowered to contribute towards our mission and able to progress in their careers.