IT SOX Controls Tester

Job description

We are looking for an IT SOX Controls Tester to join our mission and help us build a global platform that’s scalable, reliable, and secure. The Security Controls team plays a vital role in safeguarding Wise’s complex IT landscape. We specialise in the comprehensive testing, assessment, and continuous improvement of technology-related controls. This role requires experience in testing controls in a cloud-native environment as opposed to legacy IT systems.

Your Mission

Perform control testing (Design & Operating Effectiveness) for Access Management, Change Management, and IT application controls across our cloud infrastructure and SaaS landscape. Partner with key stakeholders across Finance, Risk, Security, Platform to effectively communicate SOX 404 requirements and expectations. Support control owners on their journey to mature our risk and control environment. Leverage data analytics and automation to assess control design and operating effectiveness.

Maintain a high standard of quality in documentation, ensuring that testing methods are in compliance with SOX 404 requirements.

Qualifications

You possess deep knowledge of SOX 404 requirements, COSO framework, and IT control frameworks (NIST, ISO27001). You understand how compliance frameworks map to dynamic infrastructures. You have 3+ years of experience in Technology Risk or IT Audit, with a dedicated focus on SOX. You have demonstrable experience with first-time SOX audits in cloud-native environments. You understand how Change Management works in a CI/CD pipeline and how Access Management works in a microservices architecture.

Experience with AWS, Terraform, GitHub, Jira, Okta, and SailPoint is preferred. You are driven to modernize testing methodologies, utilizing data analytics and automation to reduce reliance on manual processes and enhance control coverage. You work well in a cross-functional environment. You can articulate complex control findings to engineers and explain complex technical risks to finance stakeholders.