Senior IT Internal Controls Analyst

Title:

The Senior IT Internal Controls Analyst serves as Information Technologys primary liaison and coordination point for internal audit external audit Finance controller risk compliance cybersecurity application owners infrastructure teams and third-party service providers. The role supports the design documentation testing monitoring and continuous improvement of IT controls that enable reliable financial reporting and effective technology governance with particular emphasis on Sarbanes-Oxley (SOX) systems and business-process support.

This position coordinates audit requests and evidence evaluates IT general controls and automated/application controls supports remediation of deficiencies and embeds control requirements into key system implementations and significant changes. The analyst provides control-focused oversight across the systems development lifecycle (SDLC) including requirements design security data conversion interfaces testing segregation of duties deployment and post-implementation stabilization. Experience with ServiceNow and Microsoft Dynamics 365 Finance and Operations (FinOps) and Project Operations (Proj Ops) is preferred.

Serve as ITs central liaison for internal audits external audits SOX testing and other assurance reviews involving enterprise applications infrastructure cybersecurity IT operations and technology-enabled business processes.

Coordinate audit planning walkthroughs interviews evidence requests sample selections demonstrations and follow-up activities with control owners and subject-matter experts.

Maintain an organized audit request inventory ownership matrix due dates evidence status open questions and escalation path to support accurate and timely responses.

Perform quality reviews of evidence before submission to confirm completeness accuracy relevance appropriate period coverage and alignment to the control description and test request.

Help translate audit observations into clear technology process risk and business-impact language for IT leaders and control owners.

Build productive working relationships with auditors while protecting data confidentiality maintaining document control and ensuring responses are factual and appropriately approved.

Support the IT SOX program covering financially relevant systems supporting technologies interfaces reports data and business processes.

Coordinate and evaluate IT general controls including security provisioning privileged access user access reviews segregation of duties change management computer operations backup and recovery inter-system interface monitoring and incident management.

Support computerized controls configurable application controls interface controls key reports spreadsheet-dependent controls and information produced by the entity (IPE) used in financial reporting processes.

Facilitate control-owner walkthroughs; maintain process narratives flow diagrams risk and control matrices control procedures evidence standards and testing support documentation.

Assess control design and operating evidence identify gaps or inconsistent execution and work with owners to strengthen sustainable controls without creating unnecessary operational burden.

Monitor control performance exceptions deficiencies compensating controls remediation plans and management actions; escalate overdue or high-risk matters through established governance channels.

Support annual scoping and change-impact assessments for new systems significant enhancements integrations organizational changes vendor transitions and evolving financial processes.

Provide risk and control support for major system implementations upgrades migrations integrations and transformation programs from initiation through post-go-live stabilization.

Participate in project governance and SDLC quality gates to confirm that financial reporting security access privacy data auditability records retention and control requirements are identified and traceable.

Review control-relevant project artifacts including business and technical requirements solution designs role designs segregation-of-duties analyses interface specifications data migration conversion plans user acceptance testing test documentation defect disposition deployment approvals and support-transition documentation.

Assess whether implementation controls address configuration master data opening balances data conversion completeness and accuracy interfaces workflow approvals key reports reconciliations and cutover activities.

Coordinate audit participation in projects and maintain an implementation assurance plan that identifies key risks required evidence decision points owners and readiness criteria.

Support post-implementation reviews and stabilization monitoring to confirm control operation evidence retention ownership transfer and closure of implementation-related risks.

Maintain a consolidated view of control issues audit findings management action plans risk acceptance decisions target dates dependencies and validation evidence.

Facilitate root-cause analysis and development of practical remediation plans that address both the immediate exception and the underlying process or technology weakness.

Independently validate remediation evidence and readiness for auditor retesting; document residual risks and unresolved conditions accurately.

Develop dashboards and concise leadership reporting covering audit readiness evidence timeliness control execution exception trends remediation aging project assurance status and emerging risks.

Identify opportunities to standardize evidence automate recurring control activities improve preventive controls reduce manual effort and increase traceability across platforms and processes.

Promote a control-conscious culture through practical guidance templates training office hours and coaching for control owners and project teams.

Support control design and audit evidence for ServiceNow workflows and records used in change incident problem request configuration access security asset risk compliance and audit-support processes as applicable.

Support control design and audit readiness for Microsoft Dynamics 365 Finance and Operations and Project Operations including security roles segregation of duties workflows financial configuration interfaces data conversion reports batch processing and project accounting processes.

Partner with Finance Accounting project controls application teams cybersecurity identity and access management infrastructure data integration and service-management teams to connect technology controls to end-to-end business processes.

Coordinate with third-party application and service providers to obtain relevant assurance reports control evidence complementary user entity control support and remediation updates.

Strong working knowledge of SOX requirements IT general controls automated and application controls key reports IPE and technology risks affecting financial reporting.

Ability to interpret control objectives assess design evaluate evidence recognize exceptions and communicate deficiencies with precision and sound judgment.

Knowledge of common control and governance frameworks such as COSO COBIT NIST ISO 27001 ITIL or equivalent practices.

Understanding of third-party assurance reports and complementary user entity controls including their relevance to enterprise control environments.

Practical understanding of enterprise applications identity and access management databases operating systems cloud services integrations batch processing interfaces reporting and IT operations.

Strong understanding of SDLC project governance testing release and change management data migration cutover and post-implementation support.

Ability to evaluate role design privileged access segregation of duties approval workflows configuration controls audit trails and control dependencies.

Experience with ServiceNow and Microsoft Dynamics 365 Finance and Operations and Project Operations is preferred; experience with other large ERP GRC ITSM or audit platforms is valuable.

Exceptional organization and follow-through across multiple audits projects deadlines request lists and stakeholders.

Clear concise written and verbal communication including the ability to explain technical risks and controls to business stakeholders and financial-process impacts to technical teams.

Strong facilitation interviewing documentation critical-thinking and problem-solving skills.

Ability to influence without direct authority challenge constructively manage sensitive information and maintain effective relationships in a complex global and matrixed environment.

Detail-oriented and evidence-driven with the judgment to distinguish material control concerns from documentation or process-improvement opportunities.

Bachelors degree in information systems Accounting Finance Computer Science Audit and Assurance or a related discipline.

Equivalent relevant professional experience demonstrating the required knowledge skills and abilities may be considered.

5 years of progressive experience in IT audit IT internal controls technology risk SOX compliance ERP controls or a related field.

Demonstrated experience supporting internal and external audits and coordinating evidence across technical and business stakeholders.

Hands-on experience with ITGCs application controls risk and control documentation walkthroughs testing support deficiency assessment and remediation validation.

Experience supporting major system implementations ERP transformations integrations cloud migrations or significant application changes using structured SDLC or project-governance practices.

Experience in a large global regulated matrixed professional-services engineering or multi-provider environment is preferred.

Certified Information Systems Auditor (CISA).

Certified Public Accountant (CPA) Certified Internal Auditor (CIA) Certified Information Security Manager (CISM) Certified in Risk and Information Systems Control (CRISC) or equivalent.

COBIT COSO ITIL ServiceNow Microsoft Dynamics 365 project management or security-related credentials are advantageous.

IT Financial Controls IT Governance Enterprise Risk Internal Audit External Audit Finance Accounting and Controllership.

Application owners business process owners Cybersecurity Identity and Access Management Infrastructure Service Management Data and Integration teams.

PMO project managers solution architects developers testers Organizational Change Management and implementation partners.

Third-party service providers software vendors and managed-service partners.

Audit requests and evidence are coordinated accurately completely and within agreed timelines.

Control owners understand expectations and consistently retain evidence that demonstrates effective execution.

Control deficiencies and audit findings have clear ownership sustainable remediation plans transparent status and timely validation.

Key projects identify and address control requirements early with complete traceability through design testing deployment and stabilization.

Leadership receives concise reliable visibility into audit readiness control health remediation risk and implementation assurance.

Control activities become more standardized preventive automated and efficient while maintaining appropriate rigor.