Sr. Manager, IT Control, Assurance & SOX

This role leads the design, execution, and continuous improvement of DePuy Synthes' IT controls, assurance, and (SOX) program within the Governance & Risk function of Cybersecurity. The Sr. Manager will own the enterprise IT SOX control framework, IT general controls (ITGCs), automated application controls, and IT-related assurance activities across financially relevant systems, cloud platforms, and third-party services. This position partners closely with Finance, Internal Audit, External Auditors, Application Owners, and Infrastructure teams to ensure a strong control environment, timely remediation of deficiencies, and audit-ready operations as the company stands up as an independent, publicly traded entity. 

Key Responsibilities 

IT Controls & Assurance  

• Own the enterprise IT control framework — including ITGCs (access, change, operations), automated application controls, and IT-dependent business controls — aligned to COBIT, COSO, NIST CSF, and internal policies  

• Lead design and operating effectiveness assessments of IT controls across ERP, cloud, SaaS, and infrastructure platforms, and drive remediation of identified gaps  

• Partner with application, cloud, and infrastructure teams to embed preventive and detective controls by design in the SDLC, DevOps pipelines, and cloud landing zones  

• Extend the assurance program to third parties and managed service providers, including review of SOC 1/SOC 2 reports, complementary user entity controls (CUECs), and bridge letters  

• Serve as the primary IT liaison for Internal Audit, External Auditors, and regulatory examiners — coordinating walkthroughs, evidence, testing, and management responses  

• Advance continuous controls monitoring (CCM), analytics, and automation to expand control coverage and reduce manual testing effort  

SOX  

• Own the end-to-end IT SOX program — scoping, risk assessment, control design, management testing, deficiency evaluation, and reporting across in-scope financial systems and supporting IT infrastructure  

• Define the annual IT SOX plan in partnership with Finance, Internal Audit, and External Auditors, including in-scope applications, ITGCs, key reports, and automated controls  

• Lead management testing of ITGCs and IT-dependent business controls, ensuring timely completion, quality of evidence, and consistent workpaper standards  

• Drive deficiency evaluation, root cause analysis, remediation planning, and status reporting to leadership and the Audit Committee  

• Stand up and operate the first-year SOX program for the standalone DePuy Synthes entity, including RCMs, narratives, and control ownership across the new operating model  

• Modernize the SOX program through GRC tooling (e.g., ServiceNow IRM, AuditBoard, Archer), risk-based sampling, and automated evidence collection  

Compliance  

• Lead IT compliance activities across applicable regulatory, contractual, and internal policy requirements — including SOX, SEC, GxP, HIPAA, GDPR, and other data protection and industry regulations  

• Maintain an integrated IT policy, standard, and control library, and drive alignment across Cybersecurity, IT, Legal, Privacy, and Compliance functions  

• Track regulatory change, assess IT impact, and update controls, policies, and evidence to keep the environment continuously compliant  

• Coordinate IT responses to customer, partner, and regulator due diligence requests, security questionnaires, and certification programs (e.g., ISO 27001, HITRUST where applicable)  

• Assess compliance implications of emerging technologies (cloud, AI/ML, GenAI, automation) and update the control and compliance framework accordingly  

• Provide training, guidance, and clear escalation paths to IT and business control owners to reinforce a strong compliance culture  

Governance, Reporting & Team Leadership  

• Provide regular reporting to the CISO, Director of Governance & Risk, Finance leadership, and the Audit Committee on IT controls, SOX status, and compliance posture  

• Support Day-1 readiness and post-separation BAU operations for controls, assurance, SOX, and compliance across the standalone DePuy Synthes environment  

• Build, lead, and develop a global team across the US and the GCC in India, and manage co-source/outsourced testing partners for quality, consistency, and efficiency  

• Coach and mentor team members, fostering technical depth, audit acumen, and strong business partnership skills 

Qualifications 

Education: 

• Bachelor's degree in Computer Science, Information Security, Business, Engineering, or a related field (required). 

• Master's degree in Cybersecurity, Information Systems, or Business Administration (preferred). 

Experience and Skills: 

Required: 

• 10+ years of experience in IT audit, IT controls, SOX, or IT compliance, including experience in a Big 4 or large public company environment  

• Deep expertise across all three capability areas: IT Controls & Assurance, SOX (ITGCs and IT-dependent business controls), and IT Compliance  

• Strong working knowledge of control and compliance frameworks — COBIT, COSO, NIST CSF, ISO 27001, and SOC 1/SOC 2  

• Proven experience coordinating with External Auditors, Internal Audit, and business process owners on complex, multi-entity audits  

• Demonstrated ability to evaluate control deficiencies, drive remediation, and communicate risk and compliance status to executive stakeholders  

• Experience assessing IT controls and compliance in cloud environments (AWS, Azure, GCP) and across ERP and SaaS platforms  

• Strong leadership, stakeholder management, and cross-functional collaboration skills, including managing global and co-sourced teams 

Preferred: 

• Experience supporting a separation, spin-off, IPO, or standalone company standing up its first-year SOX and compliance program  

• Familiarity with SAP S/4HANA, Workday, Oracle, or other ERP platforms and their control configurations  

• Experience with GRC platforms (e.g., ServiceNow IRM, AuditBoard, Archer) and continuous controls monitoring / audit analytics  

• Background in healthcare, MedTech, pharmaceuticals, or other highly regulated industries  

• Familiarity with regulatory and privacy requirements relevant to IT — SOX, SEC, GxP, HIPAA, GDPR, and emerging AI regulations 

Other: 

• Language: English proficiency required  

• Travel: Up to 15% domestic and international travel  

• Certifications (preferred): CISA, CPA, CIA, CISSP, or equivalent 

For more information on how we support the whole health of our employees throughout their wellness, career and life journey, please visit www.careers.jnj.com.