Senior IT Security & Risk Engineer - SOX Controls Lead

Cardinal Health; Salt Lake City (UT); On-site; USD 125,000 - 179,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

Paid time off

401k savings plan

HSA

MyFlexPay wage access

FSAs

Disability coverage

Work-Life resources

Paid parental leave

Healthy lifestyle programs

Job summary

Cardinal Health is seeking a Senior Engineer, Information Security & Risk to lead IT SOX control design and evaluation within a second line of defense. The role reports to the Manager, Information Security & Risk and collaborates with IT leaders to sustain risk management and continuous control improvements.

The incumbent will drive risk assessments, guide remediation, and align with audit strategies to ensure SOX compliance and robust IT governance across systems such as SAP.

Qualifications

• Bachelor’s degree in related field or equivalent work experience.
• 6+ years of experience in IT SOX, IT audit or IT compliance.
• Strong SOX knowledge; familiarity with HIPAA, GDPR, PCI considered a plus.
• Ability to educate IT stakeholders on IT control compliance.
• Strong root cause analysis and problem-solving skills.
• Risk-based judgement and ability to manage priorities.

Responsibilities

• Define, implement, and evaluate IT SOX controls.
• Perform IT risk assessments for pilot areas and guide remediation.
• Design effective IT controls with IT stakeholders to meet SOX goals.
• Drive process improvements to increase efficiency and reduce control failures.
• Monitor execution of IT controls to ensure effectiveness.
• Support due diligence in M&A activities.
• Assist in third-party certifications (SOC1/2) reviews and issuance.
• Coordinate with internal/external audits on SOX scope and strategy.
• Track remediation within IT risk governance processes.
• Manage junior staff and contractors to ensure quality.
• Assist budgeting for compliance workstream and communicate overruns.
• Support compliance posture reporting.

Skills

SOX controls

IT risk assessment

Stakeholder communication

Root cause analysis

Problem solving

Multitasking

Attention to detail

Education

Bachelor’s degree or equivalent

Tools

Archer

AuditBoard

ServiceNow GRC

Job description

Cardinal Health is seeking a Senior Engineer, Information Security & Risk to lead IT SOX control design and evaluation within a second line of defense. The role reports to the Manager, Information Security & Risk and collaborates with IT leaders to sustain risk management and continuous control improvements.

The incumbent will drive risk assessments, guide remediation, and align with audit strategies to ensure SOX compliance and robust IT governance across systems such as SAP.