RISK ANALYST (SOX) - ENTERPRISE RISK MANAGEMENT

FirstBank; San Juan (PR); On-site; USD 60,000 - 90,000; Full time

Job summary

FirstBank is seeking a Risk Analyst (SOX) to support ICFR, document controls, and validate processes across PR, VI, and FL. The role requires strong COSO knowledge and bilingual English/Spanish communication.

You will document narratives, perform walkthroughs, and coordinate with management and external auditors to ensure timely, compliant SOX assessments.

Qualifications

• Bachelor’s degree in Accounting, Finance, Business Administration, or related field.
• 1–2 years of relevant professional experience in internal or external audit, accounting, risk management, compliance, SOX, or ICFR.
• Fully bilingual in English and Spanish, with strong written and verbal proficiency.

Responsibilities

• Documents the understanding of business processes, risks, and controls with narratives, flowcharts, and RCMs.
• Performs walkthroughs of in-scope processes and validates control environments.
• Prepares and maintains process narratives, flowcharts, and RCMs per SOX standards.
• Evaluates controls, identifies gaps, and documents conclusions using professional judgment.
• Applies COSO framework to support evaluation of internal controls over financial reporting.
• Evaluates significant fluctuations in financial reporting and documents drivers and analyses.
• Supports ITGC identification and documentation related to IT controls.
• Coordinates meetings and information requests with management and external auditors.

Skills

SOX

ICFR

COSO framework

Documentation

Process narratives

Flowcharts

RCMs

Analytical thinking

Communication

Bilingual EN/ES

Education

Bachelor's degree in Accounting/Finance/Business Administration

Tools

Microsoft Word

Visio

Excel

PowerPoint

Job description

At FirstBank PR, we strive to be trusted advisors to our clients, and our employees are the ones that ensure we deliver on our promise of excellence in personalized customer service. Our more than 3,100 employees in Puerto Rico, the Virgin Islands and Florida share a passion for excellent customer service. We are proud of our team because they are continuously surpassing our client’s expectations.

Do you have a passion for helping customers, building relationships, and delivering extraordinary, personalized customer service? If your answer is yes, FirstBank is the number one place for you.

A Brief Overview

The Risk Analyst (SOX) supports the Corporation’s compliance with Sections 302 and 404 of the Sarbanes‑Oxley Act through the execution of assigned activities within the SOX Assessment Program. The role includes documenting and evaluating internal controls over financial reporting (“ICFR”); performing walkthroughs and maintaining process narratives, flowcharts, and Risk and Control Matrices (“RCMs”); supporting financial statement scoping, control design assessments, and deficiency evaluations; monitoring remediation activities; assessing the impact of business process, system, and control changes on financial reporting and ICFR; and coordinating documentation and information requests with business areas, Management, and external auditors. The position is accountable for delivering accurate, complete, well-supported, and timely work in accordance with the COSO framework, the Corporation’s established SOX methodology, and applicable governance and reporting requirements.

What you’ll do

• Documents the understanding of business processes, related risks, internal controls, and supporting systems through the preparation and maintenance of process narratives, flowcharts, and Risk and Control Matrices (RCMs), in accordance with established SOX methodology and documentation standards.
• Performs walkthroughs of in-scope business processes and related internal controls through inquiry, review of process documentation, and examination of supporting evidence to validate and document the understanding of the process and control environment.
• Prepares and maintains process narratives, flowcharts, and Risk and Control Matrices (“RCMs”) documenting relevant business processes, financial reporting risks, internal controls, and supporting systems in accordance with established SOX methodology and documentation standards.
• Applies analytical skills and professional judgment to evaluate relevant business processes, financial reporting risks, control objectives, control activities, systems, reports, and supporting evidence; identifies gaps, inconsistencies, unsupported conclusions, and matters requiring clarification; and determines whether the documented understanding is sufficiently comprehensive and reasonable to support control design evaluations and related SOX assessment activities.
• Applies the COSO Internal Control Integrated Framework to support the evaluation of the design of internal controls over financial reporting and related business processes within the scope of the SOX Program.
• Applies financial accounting concepts and analytical procedures to evaluate significant or unusual fluctuations in scoped financial statement line-items, document the underlying drivers and supporting analyses, and identify matters that may warrant consideration in the SOX financial scoping and risk assessment processes.
• Supports the Corporate Risk Manager in SOX materiality assessments, financial statement line-item scoping, and quarterly reassessments through the preparation of supporting analyses and related documentation.
• Executes and monitors assigned activities under the SOX Assessment Program in support of the Corporation's compliance with Sections 302 and 404 of the Sarbanes‑Oxley Act.
• Coordinates meetings, documentation and information requests with business areas, Management and external auditors, and proactively follows up on outstanding matters to support the timely execution of SOX Assessment activities.
• Supports the evaluation and documentation of identified control deficiencies in accordance with the Corporation's established deficiency evaluation framework and related documentation requirements.
• Tracks identified SOX deficiencies and related remediation activities and follows up with responsible business areas to support timely resolution and completion of required remediation activities.
• Collaborates with team members on SOX documentation, assessment, and testing-related activities, as needed, and appropriately escalates significant questions, issues, or matters requiring Management consideration.
• Evaluates changes to internal controls, business processes, and supporting systems within assigned areas to identify and document potential impacts on internal control over financial reporting for Management review.
• Supports the identification of critical applications relevant to financial reporting based on established SOX scoping and assists in documenting the related information Technology General Controls(“ITGCs”).
• Demonstrates a high degree of ownership and accountability for assigned responsibilities and independently manages tasks from initiation through completion with appropriate guidance, exercising due diligence, initiative, professional judgment, and proactive follow-through while escalating issues when appropriate.
• Produces accurate, complete, clearly documented, and appropriately supported work within established deadlines and communicates proactively regarding progress, outstanding matters, potential delays, and issues requiring Management attention.
• Reviews relevant system implementations, enhancements, and procedural changes to identify and document potential impacts on financial reporting processes, internal controls, and the Corporation’s SOX assessment.
• Maintains current knowledge of relevant accounting standards, regulatory requirements, and internal control guidance and developments that may impact the Corporation’s SOX Program and internal controls over financial reporting.
• Working knowledge of the Sarbanes‑Oxley Act of 2002, particularly Sections 302 and 404, internal control over financial reporting (“ICFR”), and the COSO Internal Control Framework.
• Working knowledge of financial accounting concepts and financial statements, with the ability to understand financial reporting risks, significant account activity, and related internal controls.
• Strong analytical and critical-thinking skills, with the ability to evaluate business processes, risks, controls, systems, reports, and supporting evidence; identify gaps or inconsistencies; and exercise sound professional judgment.
• Strong attention to detail and commitment to producing accurate, complete, clearly documented, and appropriately supported work.
• Strong organizational and time-management skills, with the ability to independently manage multiple assignments, priorities, follow-up activities, and deadlines in a fast-paced environment.
• Strong problem-solving skills, with the ability to identify matters requiring additional analysis or clarification and appropriately escalates significant issues or concerns to Management.
• Strong written and verbal communication skills, including the ability to clearly document SOX assessments and effectively communicate with business areas, Management, team members, and external auditors.
• Fully bilingual in English and Spanish, with strong professional written and verbal proficiency in both languages.
• Strong interpersonal and collaboration skills, with the ability to work effectively with cross-functional teams and establish productive working relationships with business and control owners.
• Proficiency in Microsoft Office applications (e.g., Word, Visio, Excel, and PowerPoint).
• Able to support multiple assignments simultaneously while meeting established quality standards and deadlines.
• Demonstrates high standards of professional ethics, integrity, confidentiality, due diligence, and professional responsibility when handling sensitive financial, control, and business information.
• Able to work in a fast-paced environment and is able to deliver within the established deadlines.

What You’ll Need to Succeed

Bachelor’s degree in Accounting, Finance, Business Administration, or a related field is required, with one to two years of relevant professional experience in internal or external audit, accounting, risk management, compliance, SOX, or internal controls over financial reporting (ICFR).

Disclaimer: The above statements describe the general nature and level of work performed by individuals assigned to this position and are not intended to be an exhaustive list of all duties or responsibilities.