SOX ITGC Controls & SOX Key Reports

Amgen; India; In loco; INR 1.500.000 - 2.500.000; Tempo pieno

Descrizione del lavoro

Amgen India is seeking a Specialist in the GRC team within Cybersecurity and Digital Trust (CDT) to support the SOX compliance program for ITGCs and key reports. The role involves partnering with IT SOX leadership, system owners, engineers, and audit teams to design, test, and improve SOX controls and reporting accuracy, covering SAP GRC and related technologies.

The candidate will analyze report logic, data flows, and queries, ensure proper documentation, and participate in remediation and

Competenze

• Strong understanding of IT controls and SOX program requirements.
• Ability to analyze systems, report logic, data flows and supporting technologies.

Mansioni

• Support ITGC SOX Controls execution and compliance program.
• Coordinate SOX certification activities with control owners and stakeholders.
• Review control documentation and evidence to assess execution and gaps.
• Strengthen control design, documentation, and evidence quality.
• Participate in SOX walkthroughs with owners and stakeholders.
• Support audit requests, testing inquiries, and remediation activities.
• Review CMDB for SOX applicability and components.
• Assist in SAP GRC SOX ITGC controls deployment and lifecycle.

Conoscenze

SOX compliance

ITGC controls

SQL analysis

SAP GRC

Documentation

Strumenti

SQL

CMDB review

SAP ABAP

ERP reporting tools

Descrizione del lavoro

Career CategoryEngineeringJob DescriptionJob DescriptionThe Specialist role is a key member of the Governance, Risk and Compliance (GRC) team within Cybersecurity and Digital Trust (CDT). The position is responsible for supporting Amgen's Information Technology Sarbanes‑Oxley (SOX) Compliance program, with primary responsibilities across SOX IT General Controls (ITGCs) and SOX Key Reports.

The Specialist will partner with IT SOX Compliance leadership, system and service owners, engineers, developers, Finance, Compliance, Corporate Audit, and Internal and External Audit teams to support the design, execution, monitoring, validation, and continuous improvement of SOX IT controls and key reports.

The role requires a strong understanding of IT controls combined with the technical ability to analyze systems, applications, report logic, data flows, queries, and supporting technologies to ensure SOX controls and reports are appropriately designed, documented, operated, and supported.

Key Responsibilities

SOX ITGC Controls

• Support the execution and ongoing management of the ITGC SOX Controls and Compliance program.
• Coordinate and support quarterly and annual SOX certification activities with control owners, process owners, system owners, and other stakeholders.
• Review control documentation and supporting evidence to assess control execution, identify potential gaps, and ensure SOX requirements are appropriately addressed.
• Partner with control owners to strengthen control design, documentation, evidence quality, and operational effectiveness.
• Participate in SOX walkthroughs with system, service, process, and control owners.
• Support Internal and External Audit evidence requests, testing inquiries, walkthroughs, and remediation activities.
• Review SOX systems and applications within the Configuration Management Database (CMDB) to assess SOX applicability and ensure relevant system components and dependencies are appropriately identified.
• Assess IT audit findings, identify relevant mitigating controls, support root cause analysis, and coordinate remediation activities through completion.
• Support the design, implementation, and effectiveness of SAP GRC SOX ITGC controls, including Logical Access, Segregation of Duties (SoD), and Emergency Access.
• Support SAP GRC processes such as Access Request, Risk Analysis, Role Management, user access lifecycle activities, and Emergency Access.
• Support key access controls including role reviews, privileged access monitoring, access governance, and related issue remediation.
• Partner with IT Security, SAP Basis, application teams, and other technology stakeholders to ensure appropriate implementation and operation of controls across SAP ECC, S/4HANA, and integrated systems.
• Develop and maintain SOX guidance, procedures, training materials, and educational resources to support control and process owners.
• Promote compliance by design by partnering with IT teams to embed appropriate controls within technology processes and solutions.

SOX Key Reports Analysis & Validation

• Serve as a key contributor to the SOX Key Reports program for system-generated reports relied upon in the execution of SOX controls.
• Perform technical analysis of report logic, including application code, queries, scripts, calculations, configurations, data transformations, and report parameters.
• Validate the completeness and accuracy of SOX Key Reports by reconciling report outputs to source systems and underlying data.
• Review custom-developed and configurable report logic, including technologies such as SAP ABAP, SQL, ERP reporting tools, and other financial applications.
• Analyze and interpret technical artifacts including SQL queries, stored procedures, ETL logic, interfaces, application code, and data transformations.
• Recreate or independently generate report outputs, where applicable, using reviewed queries, application logic, or ERP report code to validate report accuracy.
• Perform report tie-outs between reports provided by Process Owners and independently generated outputs.
• Reconcile record counts, key data fields, financial totals, parameters, and reporting periods between source data and report outputs.
• Confirm report parameters, filters, date ranges, calculations, and report logic align with the intended SOX control objective.
• Verify whether manual manipulation or post-extraction adjustments have been applied to system-generated reports and assess their impact.
• Investigate and document variances identified during report validation and ensure explanations and resolutions are appropriately supported.
• Identify potential gaps, defects, or risks associated with report logic, data integrity, interfaces, system changes, or report generation.
• Support remediation and re-testing when key report logic, documentation, or report outputs do not meet SOX requirements.
• Partner with system owners, developers, Process Owners, Finance, Compliance, and Audit teams to unde