Senior IT SOX Controls Engineer — Risk & Compliance

Cardinal Health; Madison (WI); On-site; USD 125,000 - 179,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

Paid time off plan

Health savings account (HSA)

401k savings plan

Access to wages before pay day with my

Flexible spending accounts (FSAs)

Short- and long-term disability

Work-Life resources

Paid parental leave

Healthy lifestyle programs

Job summary

Cardinal Health seeks a Senior Engineer, Information Security & Risk to define and implement IT SOX controls. You will work with IT and business leaders to assess risk, design controls, and drive remediation while ensuring compliance with SOX and related frameworks.

You will collaborate on audit strategy, support M&A due diligence, and lead remediation efforts with a focus on risk reduction and process improvement within the IT risk governance framework.

Qualifications

• Bachelor’s degree in related field or equivalent work experience.
• 6+ years of IT SOX, IT audit or IT compliance experience preferred.
• Strong knowledge of SOX and other frameworks (HIPAA, GDPR, PCI) is a plus.
• Proven ability to educate IT stakeholders on control compliance.
• Strong root-cause analysis and problem-solving skills.
• Proficient in risk-based judgment and managing competing priorities.
• Knowledge of ERP controls, SAP experience is a plus.
• Familiarity with IT risk governance software (Archer, AuditBoard, ServiceNow GRC) is preferred.
• Professional certifications: CISA, CPA, CISM, CISSP, CRISC.

Responsibilities

• Define, implement, and evaluate IT SOX controls.
• Perform IT risk assessments and identify control gaps.
• Design effective IT controls with IT stakeholders.
• Improve IT controls to boost efficiency and reduce failure risk.
• Monitor control execution to ensure effectiveness.
• Support due diligence in M&A activities.
• Assist third-party certifications reviews (SOC1/2).
• Coordinate with internal/external audits on SOX scope and strategy.
• Track remediation and manage budget for compliance workstream.
• Lead and mentor junior staff and contractors.

Skills

IT SOX

Risk assessment

IT controls

SOX compliance

Audit methodology

Stakeholder education

Root cause analysis

ERP SAP

IT risk governance

CISA

CISM

CISSP

CRISC

Education

Bachelor’s degree or equivalent

Tools

Archer

AuditBoard

ServiceNow GRC

Job description

Cardinal Health seeks a Senior Engineer, Information Security & Risk to define and implement IT SOX controls. You will work with IT and business leaders to assess risk, design controls, and drive remediation while ensuring compliance with SOX and related frameworks.

You will collaborate on audit strategy, support M&A due diligence, and lead remediation efforts with a focus on risk reduction and process improvement within the IT risk governance framework.