Senior IT Controls Engineer – AI-Driven ERP & SOX

Gusto

San Francisco (CA)

Hybrid

USD 245,000 - 265,000

Full time

14 days+

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Benefits offered by this job

Equity (RSUs)

Job summary

Gusto is seeking an IT Controls Engineer to own ITGC design across NetSuite, Workday, Salesforce, and adjacent platforms, ensuring SOX 404 compliance and audit readiness. You will partner with Internal Audit, IT, Security, and Finance to scale a risk-aware controls program and leverage AI to accelerate testing.

In this senior role, you will lead 1st-line control activities, manage access governance and change management, and drive continuous improvement through automation while aligning with

Qualifications

10+ years in IT controls/audit governing ERP systems.
SOX 404, COSO/COBIT, SoD design across ERP/HRIS/CRM.
Experience with external audit engagements and IT risk.

Responsibilities

Design and operate ITGCs across enterprise apps.
Lead 1st-line control environment with owners and engineers.
Drive SoD strategy across ERP/HRIS/CRM; monitor tooling.
Manage audit lifecycle as liaison with Internal/External Audit and SOX PMO.
Build AI-native continuous controls monitoring and evidence collection.
Own controls posture for internal AI/automation portfolio.
Lead access governance and provisioning workflows.
Govern application change management and release evidence.
Mature controls program via consolidation and automation.

Skills

ITGCs

SOX 404

Audit liaison

ERP controls

AI-augmented controls

Access governance

Change management

Education

CISA, CISSP, CIA, CPA certifications

Tools

Pathlock

SailPoint

Saviynt

IGA platform

Job description

AI/IT Controls Engineer, Enterprise Applications

Denver, CO - Hybrid; New York, NY - Hybrid; San Francisco, CA - Hybrid

About Gusto

At Gusto, we're on a mission to grow the small business economy. We handle the hard stuff — payroll, health insurance, 401(k)s, and HR — so owners can focus on their craft and their customers. With teams in Denver, San Francisco, and New York, we support more than 500,000 small businesses nationwide and are building a workplace that reflects the people we serve.

All full-time employees receive competitive base pay, benefits, and equity (RSUs) — because everyone who helps build Gusto should share in its success. Offer amounts are determined by role, level, and location. Learn more about our Total Rewards philosophy .

AI is a fundamental part of how work gets done at Gusto. We expect all team members to actively engage with AI tools relevant to their role and grow their fluency as the technology evolves. AI experience requirements vary by role and will be assessed during the interview process.

About the Role:

As the IT Controls Engineer you will own, evolve, and scale IT General Controls (ITGCs) across Gusto's enterprise application ecosystem including NetSuite, Workday, Salesforce, and adjacent platforms, serving as the single point of accountability for ITGC design, testing, remediation, and audit readiness. Sitting within the Enterprise Applications organization, you will partner closely with Internal Audit, IT, Security, and Finance to ensure Gusto meets SOX 404 compliance requirements while strengthening our broader risk posture. You will not only maintain a best-in-class controls environment, but will also pioneer the use of AI and automation to make controls testing faster, smarter, and more continuous, transforming assurance from a periodic, manual exercise into a scalable, intelligent capability. In line with Gusto's enterprise risk management strategy, you will reduce manual effort across the compliance lifecycle while raising the bar on control precision and coverage as the company scales. This is a senior, high-impact individual contributor role that blends deep IT controls expertise with a forward-looking vision for AI-augmented assurance, combining technical rigor, cross-functional partnership, and strategic systems thinking to build a controls function that is both audit-ready and future-proof.

About the Team:

This role will report to the Enterprise AIT team, a group focused on driving the intelligent transformation of Gusto’s enterprise systems. The Enterprise AIT team is responsible for integrating AI, automation, and advanced analytics across our internal applications ecosystem to improve scalability, efficiency, and decision-making. Partnering closely with Finance, Business Ops, IT, and Security, the team enables Gusto’s enterprise systems to become smarter, more predictive, and more adaptive. This is a new role, designed to expand the team’s capacity to operationalize AI within enterprise workflows and support Gusto’s broader Enterprise Systems strategy.

Here’s what you’ll do day-to-day:

Own ITGC design and operation across enterprise applications — including logical access, change management, SDLC, computer operations, and segregation of duties (SoD).
Lead the 1st-line control environment for in-scope enterprise applications, partnering with application owners and engineering leads to embed controls into operational workflows rather than bolting them on.
Drive SoD strategy across ERP, HRIS, and CRM — including role design reviews, conflict remediation, mitigating control design, and ongoing monitoring tooling (e.g., Pathlock, SailPoint, Saviynt, native role analyzers).
Manage the audit lifecycle as the primary 1st-line liaison with Internal Audit, External Audit, and the SOX PMO — walkthroughs, evidence collection, deficiency remediation, and management responses.
Build AI-native continuous controls monitoring — including LLM-based evidence review, agentic control testing, and automated anomaly surveillance — to eliminate manual evidence collection, shift controls left, and surface exceptions in near real time. Treat AI agents as control operators with the same evidence and validation expectations as human operators.
Own the controls posture for Gusto's internal AI and automation portfolio. Partner with AI-builder teams across the company (Finance & BizOps, GRC, Engineering) to review internal AI use cases, classify by risk category, and ensure controls, evidence trails, and validation travel with the build — not bolted on after launch. Be the senior 1st-line owner for "do our internal AI builds meet our control standards?
Lead access governance including provisioning/deprovisioning workflows, periodic user access reviews (UARs), privileged access management, and integration with the IGA platform.
Govern application change management for in-scope systems — approvals, segregation between developers and production, emergency change handling, and release evidence.
Mature the controls program by leading rationalization initiatives, control consolidation, and the adoption of automated/preventive controls over manual/detective ones.
Partner cross-functionally with Security/GRC, Legal, Finance/Accounting, People Operations, and Revenue Operations to ensure controls support — rather than impede — the business.

Here’s what we're looking for:

10+ years of experience in IT controls, audit, or enterprise applications governance, with a strong hands-on background operating in the 1st line of defense as a control owner across NetSuite, Workday, and/or Salesforce.
Deep expertise in SOX 404, COSO, COBIT, and ITGC frameworks, including segregation of duties (SoD) design and remediation across ERP, HRIS, and CRM environments.
Proven track record leading external audit engagements (Big 4 or equivalent) as the management-side owner, with public company or IPO readiness experience preferred.
Demonstrated experience building and deploying AI-augmented controls work including agents, LLM-based reviewers, or automated anomaly detection, with the ability to design controls both for and with AI systems.
Strong judgment on AI risk, including model risk, prompt injection, output validation, and audit trail design, with hands-on familiarity with agentic tooling such as Claude Code, MCPs, or LLM-based evidence pipelines.
Excellent communicator who can translate complex control concepts for executives, auditors, and engineers, with experience in continuous controls monitoring (CCM) and data-driven assurance approaches.
Relevant certifications (CISA, CISSP, CIA, CPA, or equivalent) and familiarity with adjacent frameworks including SOC 1/2, ISO 27001, NIST CSF, and PCI DSS are a plus.

Our cash compensation amount for this role is targeted at $205,000-$220,000 /yr in Denver & most remote locations, and $245,000-$265,000 /yr for San Francisco, Seattle & New York. Final offer amounts are determined by multiple factors, including candidate experience and expertise, and may vary from the amounts listed above.

At Gusto, we don't use titles the traditional way, as a signal of rank or hierarchy. Instead, our titles describe two things at once — your craft (what you do, e.g. Engineering, Design) and your scope of ownership (what you're accountable for) — which is why you'll see something like "Head of X" instead of a rank word like "Director" that tells you neither. Because of this, the title on this posting may look different from what you'd expect based on the scope and seniority of the role, and from how similar roles are typically titled elsewhere. If you have questions about how this role compares to your current title or level, your recruiter can help translate.

Gusto has physical office spaces in Denver, San Francisco, and New York City. Employees who are based in those locations will be expected to work from the office on designated days approximately 2-3 days per week (or more depending on role). The same office expectations apply to all Symmetry roles, Gusto's subsidiary, whose physical office is in Scottsdale.

Note: The San Francisco office expectations encompass both the San Francisco and San Jose metro areas.

When approved to work from a location other than a Gusto office, a secure, reliable, and consistent internet connection is required. This includes non-office days for hybrid employees.

Reliable, consistent presence: We expect regular and predictable attendance, whether you're working in-office, hybrid, or fully remote, so that you stay closely connected to your team, customers, and stakeholders in real time and ensure colleagues and customers receive the timely support and responsiveness they deserve.

Our customers come from all walks of life and so do we. We hire great people from a wide variety of backgrounds, not just because it's the right thing to do, but because it makes our company stronger. If you share our values and our enthusiasm for small businesses, you will find a home at Gusto.

Gusto is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Gusto considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Gusto is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. We want to see our candidates perform to the best of their ability. If you require a medical or religious accommodation at any time throughout your candidate journey, please fill out this form and a member of our team will get in touch with you.

Interested in building your career at Gusto, Inc.? Get future opportunities sent straight to your email.

Accepted file types: pdf, doc, docx, txt, rtf

Enter manually

Accepted file types: pdf, doc, docx, txt, rtf

Zip Code / Postal Code (Non-U.S. based candidates, please enter "00000") *

LinkedIn Profile *

How did you hear about this opportunity? (select all that apply) *

Indeed

Facebook

News Article

Conference or Meetup

Company Blog

Company Employee

Company Website

Are you legally authorized to work in the country where you are applying? * Select...

Will you now or in the future require visa sponsorship for employment? * Select...

If you’ll require this employer to commence, i.e., “sponsor,” an immigration or work permit case in order to employ you, either now or at some point in the future, then you should answer yes. An example of an immigration or work permit case that may require sponsorship now or in the future would be an H-1B or other employment-based work permit sponsorship.

Have you ever, or are you currently working at Gusto or Symmetry in any capacity (ie: employee or contingent worker)? * Select...

Voluntary Self-Identification

Our customers come from all walks of life and so do we. We hire people from a wide variety of backgrounds, not just because it’s the right thing to do, but because it helps us to build better products, better serve our customers, and makes our company stronger.

In addition to the information required to consider your application, below is a set of demographic questions that help us identify areas for improvement in our process and further support the development and execution of our diversity efforts and programs as well as to create a more inclusive environment for all employees.

Your responses to these questions will be recorded and maintained in a confidential file. Your responses, or your wish not to answer, will not be associated with your specific application, will not be shared with hiring managers, and will not in any way be used in making any employment decisions, including hiring decisions.

Please use this as a reference while completing the disability self-identification:

You are considered to have a disability if you have a physical or mental impairment or medical condition that substantially limits a major life activity, or if you have a history or record of such an impairment or medical condition. Disabilities include, but are not limited to: