SOX / Internal Controls Functional Lead (GenAI Controls Automation)

Quantum Integrators; Illinois; On-site; USD 150,000 - 230,000; Full time

Job summary

Quantum Integrators is seeking a SOX / Internal Controls Functional Lead to bridge business processes with the GenAI development team. You will translate RCM controls into functional requirements for AI-driven testing, review evidence, and ensure audit readiness.

The role requires 8+ years in SOX or related risk advisory, strong COSO knowledge, and experience working with Big 4 auditors on reliance and PBC. Collaboration across Finance, IT, and Audit is essential.

Qualifications

• 8+ years of experience in SOX, internal controls, internal audit or Big 4 risk advisory.
• Strong knowledge of the COSO 2013 framework, assertions, key vs non-key controls, and preventive vs detective controls.
• Experience working directly with Big 4 external auditors on reliance and PBC.
• Good understanding of IPE / key report testing and ITGC concepts.
• Exposure to financial systems such as SAP, HFM, BlackLine, Model N, Workday, Nakisa and Longview.
• Able to write clear functional requirements and work in Agile with technical teams.

Responsibilities

• Own the functional understanding of the RCM across about 300 key controls, covering Finance, ITGC, ITAC, Entity Level (COSO) and SOC 1 controls.
• Work with control owners, functional controllers and BU SOX leads in Record to Report, Order to Cash (rebates, pricing, contract management, AR reserves), Payroll (pension, stock transactions), Tax, Treasury, Business Combinations and Leases.
• Act as the main point of contact for external auditors: walkthroughs, PBC requests, sample selection, evidence packages and reliance discussions on EY Reliance vs Non-reliance controls.
• Translate control descriptions, control attributes and testing steps into user stories, prompts, acceptance criteria and test cases for the GenAI developers.
• Define IPE validation logic (completeness and accuracy, cover pages and checklists, key reports) so it can be automated and audited.
• Review AI-generated test results, evidence summaries and deficiency write-ups for accuracy before they go to the business or the auditors.
• Support design and operating effectiveness testing for Transactional, Monthly, Quarterly, Semi-annual and Annual controls, including Management Review Controls.
• Support ITGC access recertification, access provisioning, change management and SOC 1 report reviews (CUEC mapping and bridge letters).
• Identify which controls are best suited to GenAI automation, set priorities with the business, and track benefits and time savings.
• Run UAT with control owners and keep AI governance, documentation and audit trails in place.
• Report status, risks and deficiencies to Internal Controls leadership.

Skills

SOX 404 experience

RCM / risk controls

COSO framework

Big 4 experience with PBC

ITGC / ITAC concepts

GenAI governance

Stakeholder management

Agile / requirements writing

Tools

SAP

HFM

BlackLine

Model N

Workday

Nakisa

Longview

Job description

Position - SOX / Internal Controls Functional Lead (GenAI Controls Automation)

Duration - Long-term

Job Description

Experience: 8+ years in SOX, internal controls, internal audit or Big 4 risk advisory

Role Summary

The SOX Functional Lead acts as the liaison between Business Process Owners, the Internal Controls CoE, external SOX auditors and the GenAI development team. The role turns the Risk Control Matrix (RCM) into clear functional requirements for AI-driven control testing, evidence review and documentation. It also makes sure every AI output meets audit reliance standards.

Key Responsibilities

• Own the functional understanding of the RCM across about 300 key controls, covering Finance, ITGC, ITAC, Entity Level (COSO) and SOC 1 controls.
• Work with control owners, functional controllers and BU SOX leads in Record to Report, Order to Cash (rebates, pricing, contract management, AR reserves), Payroll (pension, stock transactions), Tax, Treasury, Business Combinations and Leases.
• Act as the main point of contact for external auditors: walkthroughs, PBC requests, sample selection, evidence packages and reliance discussions on EY Reliance vs Non-reliance controls.
• Translate control descriptions, control attributes and testing steps into user stories, prompts, acceptance criteria and test cases for the GenAI developers.
• Define IPE validation logic (completeness and accuracy, cover pages and checklists, key reports) so it can be automated and audited.
• Review AI-generated test results, evidence summaries and deficiency write-ups for accuracy before they go to the business or the auditors.
• Support design and operating effectiveness testing for Transactional, Monthly, Quarterly, Semi-annual and Annual controls, including Management Review Controls.
• Support ITGC access recertification, access provisioning, change management and SOC 1 report reviews (CUEC mapping and bridge letters).
• Identify which controls are best suited to GenAI automation, set priorities with the business, and track benefits and time savings.
• Run UAT with control owners and keep AI governance, documentation and audit trails in place.
• Report status, risks and deficiencies to Internal Controls leadership.

Required Skills

• Strong hands-on SOX 404 experience: RCMs, walkthroughs, TOD/TOE testing, deficiency evaluation and remediation.
• Solid knowledge of the COSO 2013 framework, assertions, key vs non-key controls, and preventive vs detective controls.
• Experience working directly with Big 4 external auditors on reliance and PBC.
• Good understanding of IPE / key report testing and ITGC concepts.
• Exposure to financial systems such as SAP, HFM, BlackLine, Model N, Workday, Nakisa and Longview.
• Able to write clear functional requirements and work in Agile with technical teams.
• Strong communication and stakeholder management skills across Finance, IT and Audit.

Preferred

• CPA, CIA, CISA or CA certification.
• Pharma / Life Sciences industry experience.
• Exposure to GenAI or automation in audit (LLM-based evidence review, prompt design, AuditBoard/Workiva or similar GRC tools).