Senior IT SOX Controls Engineer

Cardinal Health; Lansing (MI); On-site; USD 125,000 - 179,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

401k savings plan

Health savings account (HSA)

Paid time off

Paid parental leave

Disability coverage

Work-Life resources

Job summary

Cardinal Health is seeking a Senior Engineer in Information Security & Risk to define, implement, and evaluate IT SOX controls across the organization. The role reports to the Manager, Information Security & Risk, driving design and remediation efforts and aligning with audit strategies.

You will collaborate with IT and business leaders to sustain risk management, oversee control performance, and support compliance efforts for SOX, HIPAA, GDPR, and other frameworks as needed.

Qualifications

• Bachelor’s degree or equivalent work experience
• 6+ years in IT audit or IT compliance
• Strong knowledge of IT SOX and related frameworks
• Certifications preferred: CISA, CISM, CISSP, CRISC

Responsibilities

• Design and remediation consulting for IT controls
• Perform IT risk assessments and identify control gaps
• Design IT controls to meet SOX goals
• Improve IT controls to increase efficiency and reduce failures
• Monitor and evaluate control effectiveness
• Support due diligence in M&A and third-party certifications

Skills

SOX knowledge

Risk-based judgement

Stakeholder education

Multi-tasking

Analytical thinking

Education

Bachelor's degree in related field

IT audit/compliance experience 6+ years

Tools

Archer

AuditBoard

ServiceNow GRC

SAP

Job description

Cardinal Health is seeking a Senior Engineer in Information Security & Risk to define, implement, and evaluate IT SOX controls across the organization. The role reports to the Manager, Information Security & Risk, driving design and remediation efforts and aligning with audit strategies.

You will collaborate with IT and business leaders to sustain risk management, oversee control performance, and support compliance efforts for SOX, HIPAA, GDPR, and other frameworks as needed.