Senior IT Security & Risk Engineer – SOX Controls Lead

Cardinal Health; Concord (NH); On-site; USD 125,000 - 179,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

Paid time off

Health savings account (HSA)

401k savings plan

Flexible spending accounts (FSAs)

Disability coverage

Work-Life resources

Paid parental leave

Healthy lifestyle programs

Job summary

Cardinal Health seeks a Senior Engineer, Information Security & Risk to join our IT security function and strengthen our risk controls. This senior role defines and evaluates IT SOX controls, aligning with business leaders to protect technology assets and maintain regulatory compliance.

Reporting to the Manager, Information Security & Risk, you will design controls with IT stakeholders, perform risk assessments, and support SOX, HIPAA, GDPR and PCI programs while coordinating with

Qualifications

• Bachelor’s degree or equivalent experience
• 6+ years in IT SOX controls, IT audit or IT compliance preferred
• Strong knowledge of SOX and other frameworks (HIPAA, GDPR, PCI) a plus
• Ability to educate IT stakeholders on control compliance and drive remediation
• Strong root cause analysis and problem-solving skills
• Risk-based judgment with ability to balance priorities
• Experience with ERP controls such as SAP is a plus
• Professional certifications preferred: CISA, CPA, CISM, CISSP, CRISC

Responsibilities

• Define, implement and evaluate IT SOX controls
• Perform IT risk assessments for pilot areas and guide remediation
• Collaborate with IT stakeholders to design effective IT controls
• Improve IT controls to enhance efficiency and reduce failures
• Monitor execution of IT controls for effectiveness
• Support due diligence in M&A activities
• Assist with third-party certifications (SOC1/2) review and issuance
• Coordinate with internal/external audits on SOX scope and strategy
• Track remediation within IT risk governance process
• Supervise junior staff and contractors
• Assist budgeting for compliance workstream and communicate budget issues
• Support compliance posture reporting

Skills

IT SOX controls

IT risk assessment

IT audit

Compliance frameworks

Root cause analysis

Stakeholder management

SOX compliance

Education

Bachelor’s degree in related field or equivalent work experience

CISA

CPA

CISM

CISSP

CRISC

Tools

Archer

AuditBoard

ServiceNow GRC

Job description

Cardinal Health seeks a Senior Engineer, Information Security & Risk to join our IT security function and strengthen our risk controls. This senior role defines and evaluates IT SOX controls, aligning with business leaders to protect technology assets and maintain regulatory compliance.

Reporting to the Manager, Information Security & Risk, you will design controls with IT stakeholders, perform risk assessments, and support SOX, HIPAA, GDPR and PCI programs while coordinating with