Senior IT Controls Analyst

• 401(k) retirement savings plan with a company match of a percentage of employee contributions and profit sharing, where applicable
• Equity opportunities, including participation in company equity stock plans, where applicable

• Medical, dental, and vision insurance with employer contributions toward coverage
• Paid parental leave and company-paid life insurance and short-term and long-term disability (STD/LTD), where eligible
• Wellness programs and resources, including an employee assistance program and well-being initiatives

• Paid time off and company-paid holidays
• Flexible work arrangements, including an allotment of remote workdays per year, depending on the role
• Education assistance and professional development and certification or licensing support, where eligible
• Performance-based bonus or incentive compensation, which may be available depending on the role

• Coordinate IT audit meetings, walkthroughs, code reviews, remediation, evidence requests and collection in partnership with Internal Audit to facilitate compliance with Sarbanes-Oxley (IT-SOX), including IT General Controls (ITGC), Quarterly Access Reviews (QAR), User Acceptance Testing (UAT), Systems and Organization Control (SOC 1 – SOC 2), and IT Process Narratives.
• Conduct cyber focused audits and/or high-risk controls, in partnership with SBA Internal Audit, and report on the results to SBA stakeholders.
• Maintain and distribute departmental IT security and compliance documentation, including cyber policies, procedures, and process documentation, metrics, attestation reports, and others.
• Administer audit and risk related technologies and communicate to SBA stakeholders the control design and associated risk of all in-scope IT-SOX and cyber general controls.
• Provide information security & compliance metrics to company stakeholders to showcase program return on investment (ROI).
• Participate in ensuring mandated company compliance initiatives are met.
• Manage ITSC SharePoint sites and associated content to ensure accuracy and currency.
• Interact with IT and enterprise teams to minimize risk to the environment.
• Participate in annual audit and incident response and recovery activities.
• Familiarity with GRC concepts and the NIST Cybersecurity and Privacy Frameworks.
• Build understanding and awareness of security issues throughout the organization, must have excellent communication and presentation skills.
• Must be a good team player.
• Review security configurations and updates to ensure software and infrastructure are protected.
• Ensure compliance with all applicable measurements and production reporting and policies.
• Work with other teams to manage the proper transition of security projects into production.
• Ensure the complete and proactive protection of all corporate data and systems.
• Ensure complete issue tracking, provide feedback, and report results as accomplished.
• Responsible for the acceptance and delivery of all projects and tasks related to security operations.
• Other projects and duties as assigned.

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Bachelor’s degree in MIS, Information Security, Business, or equivalent or pursuing completion of
• 3 years’ experience providing IT audit, cyber audits, security governance, risk, and compliance services in support of a medium-to-large multi-location organization.
• 3 years IT auditing experience preferred; “Big 4” background is preferred.
• Demonstrated knowledge working with Internal and External Audit and other IT and Business stakeholders.
• Preferred experience with audit-related technologies (i.e., Audit Board), information security technologies, including Security Awareness, GRC, Data Classification, SIEM, Cyber Threat Intelligence, is preferred.

Language Skills: 

• Ability to read and interpret documents such as safety rules, operating and maintenance instructions and procedure manuals.
• Excellent written, verbal, interpersonal, and problem-solving skills with a high degree of integrity and discretion and the ability to multi-task.
• Spanish or Portuguese a plus.

Mathematical Skills:   

Ability to add, subtract, multiply, and divide in all units of measure, using whole numbers, common fractions, and decimals.

#LI-DJ1

• Ability to carry out instruction furnished in written, oral or diagram form.

Certificates, Licenses, Registrations:

• Valid Driver’s License required.

Physical Demands:

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Ability to hear, understand, and respond appropriately to verbal requests made in person and over the telephone.
• Visual ability correctable to 20/20.
• Sitting sixty percent of the day.        
• Ability to respond verbally in an understandable, professional manner in person and over the telephone.
• Manual dexterity to input data into the computer.
• Ability to stoop and bend.
• Ability to lift up to 50 lbs.
• Ability to travel up to 10% of the time.
• Ability to travel by airplane and motor vehicle.

Work Environment:

The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Able to work a flexible schedule.
• Moderate noise level.