Senior IT Security & Risk Controls Engineer

Cardinal Health; Denver (CO); On-site; USD 125,000 - 179,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

Paid time off

Health savings account (HSA)

401k savings plan

Access to wages before pay day

Job summary

Cardinal Health seeks a Senior Engineer, Information Security & Risk in the United States to define, implement, and evaluate IT SOX controls. The role reports to the Manager, Information Security & Risk and collaborates with business and IT leaders to sustain risk management processes and continuous control improvement.

The position involves designing controls, assessing IT risks, and supporting external audits, due diligence for M&A, and third-party certifications.

Qualifications

• Deep knowledge of IT SOX control and audit methodology.
• Strong understanding of SOX and related compliance requirements (HIPAA, GDPR, PCI).
• Experience with IT risk governance software (e.g., Archer, AuditBoard, ServiceNow GRC) is a plus.
• Professional certifications preferred: CISA, CPA, CISM, CISSP, CRISC.

Responsibilities

• Define, implement, and evaluate IT SOX controls for risk management.
• Perform IT risk assessments and identify control gaps with remediation guidance.
• Design effective IT controls with IT stakeholders to achieve SOX compliance goals.
• Improve IT controls to increase efficiency and reduce control failure risk.
• Monitor execution of IT controls to ensure effectiveness.
• Support due diligence for M&A activities and third-party certifications (SOC1/2).
• Align with internal/external audits to define SOX scope and strategy.
• Track remediation within IT risk governance processes and manage junior staff.

Skills

IT SOX controls

Risk management

Audits

Incident response

Control design

Root cause analysis

Budgeting

Communication with stakeholders

Education

Bachelor’s degree or equivalent

Job description

Cardinal Health seeks a Senior Engineer, Information Security & Risk in the United States to define, implement, and evaluate IT SOX controls. The role reports to the Manager, Information Security & Risk and collaborates with business and IT leaders to sustain risk management processes and continuous control improvement.

The position involves designing controls, assessing IT risks, and supporting external audits, due diligence for M&A, and third-party certifications.