Senior InfoSec & Risk Controls Engineer

Cardinal Health; Raleigh (NC); On-site; USD 125,000 - 179,000; Full time

Benefits offered by this job

Medical, dental and vision

401k savings plan

Paid time off

HSA

Flexible FSAs

Disability coverage

Work-Life resources

Paid parental leave

Healthy lifestyle programs

Job summary

Cardinal Health is seeking a Senior Engineer, Information Security & Risk to join our second line of defense. You will define, implement, and evaluate IT SOX controls, partnering with IT and business leaders to strengthen risk management and compliance programs.

Reporting to the Manager, Information Security & Risk, you will lead control design, remediation guidance, and ongoing monitoring, while coordinating with internal and external audits and supporting M&A-related risk activities.

Qualifications

• Bachelor’s degree in related field or equivalent work experience.
• 6+ years of IT SOX/audit/compliance experience preferred.
• Strong knowledge of SOX and related frameworks (HIPAA, GDPR, PCI a plus).
• Ability to educate IT stakeholders on IT controls and compliance.

Responsibilities

• Define, implement, and evaluate IT SOX controls.
• Perform IT risk assessments and identify control gaps.
• Design effective IT controls with IT stakeholders to meet SOX goals.
• Improve IT controls to increase efficiency and reduce failures.
• Monitor and report on the execution of IT controls and remediation efforts.
• Support due diligence for M&A activities and third-party certifications.

Skills

IT SOX controls

Audit methodology

Risk-based judgement

Root cause analysis

Stakeholder management

Multi-tasking

IT technologies basics

Education

Bachelor’s degree or equivalent

Tools

Archer

AuditBoard

ServiceNow GRC

Job description

Cardinal Health is seeking a Senior Engineer, Information Security & Risk to join our second line of defense. You will define, implement, and evaluate IT SOX controls, partnering with IT and business leaders to strengthen risk management and compliance programs.

Reporting to the Manager, Information Security & Risk, you will lead control design, remediation guidance, and ongoing monitoring, while coordinating with internal and external audits and supporting M&A-related risk activities.