Senior IT Risk & SOX Controls Engineer

Cardinal Health; United States; On-site; USD 125,000 - 179,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

Paid time off

Health savings account (HSA)

401k savings plan

Flex spending accounts (FSAs)

Disability coverage

Work-Life resources

Paid parental leave

Healthy lifestyle programs

Job summary

Cardinal Health seeks a Senior Engineer, Information Security & Risk to define, implement, and evaluate IT SOX controls. You will partner with business and IT leaders to support ongoing risk management and continuous control improvement, driving remediation and alignment with internal/external audits.

You will lead control design, assess risks, and guide remediation efforts while mentoring junior staff and coordinating with risk governance processes.

Qualifications

• Bachelor’s degree in related field or equivalent work experience.
• Deep knowledge of IT SOX control and audit methodology - 6 + years of experience in related field preferred, such as IT audit and/or IT compliance function preferred.
• Strong understanding and experience with SOX is a must and knowledge on other compliance requirements/frameworks, such as HIPAA, GDPR, PCI, is a plus
• Strong in educating/influencing IT stakeholders to raise their awareness/mindset of IT control compliance
• Strong root cause analysis and problem-solving skill is a must
• Pro-level of risk-based judgement in addressing control issues and juggling competing priorities
• Self-motivated to learn new technologies and achieve objectives
• Ability to multi-task with organization, efficiency, accountability, and attention to detail
• Strong knowledge in IT technologies and concepts including networks, databases, middleware, interfaces, and applications. Knowledge/experience of IT controls for mainstream ERP, such as SAP, is a plus
• Strong flowcharting skill is preferred
• Experience with IT risk governance software (i.e., Archer, AuditBoard, ServiceNow GRC) is a plus
• Professional certification preferred: CISA, CPA, CISM, CISSP, CRISC

Responsibilities

• Control design and remediation consulting –
• Perform IT risk assessment for pilot areas, identify control gap, and provide guidance for gap remediation
• Work with IT stakeholders to design effective IT controls to help the IT org achieve SOX compliance goals
• Process improvement of IT controls that increases operational efficiency and reduces the likelihood of control failure
• Evaluate/monitor the execution of IT controls to ensure they are operating effectively
• Support due diligence phase of company's M&A activities
• Provide support for third party certifications (such as SOC1/2) review and issuance
• Align with internal and external audit to understand SOX scope and audit strategy
• Track and drive remediation of IT control issues within our IT risk governance process
• Manage assigned junior staff(s) and contractors to ensure the quality of the work
• Support budgeting of compliance workstream and responsible for proactively communicate budget overruns to key stakeholders
• Support the manager in compliance posture reporting

Skills

SOX controls

IT risk management

stakeholder education

root cause analysis

problem solving

risk-based judgement

learning mindset

multi-tasking

IT systems knowledge

ERP / SAP familiarity

flowcharts

GRC tools

Education

Bachelor's degree in related field

CISA

CPA

CISM

CISSP

CRISC

Tools

Archer

AuditBoard

ServiceNow GRC

Job description

Cardinal Health seeks a Senior Engineer, Information Security & Risk to define, implement, and evaluate IT SOX controls. You will partner with business and IT leaders to support ongoing risk management and continuous control improvement, driving remediation and alignment with internal/external audits.

You will lead control design, assess risks, and guide remediation efforts while mentoring junior staff and coordinating with risk governance processes.