Internal Audit IT SOX Consultant STP Fort Worth, TX Job Details Full-time $70 - $110 an hour 12 hours ago Benefits Health insurance Dental insurance 401(k) Paid time off 401(k) matching Retirement plan Qualifications Cloud identity and access management (IAM) Internal controls Operating systems Authorization controls implementation Computer Science IT user and group management Technical documentation SOX Technical report writing AWS Bachelor's degree Data access controls implementation IT control testing Sarbanes-Oxley (SOX) compliance documentation Access control management Log analysis Information security auditing Python Full Job Description SOX IT General Controls Analyst — Role Description Role summary The

SOX ITGC

Analyst makes sure the IT controls behind financial reporting are designed well, operate consistently, and hold up under internal and external audit. The role owns the IT general controls (ITGC) portion of the annual SOX 404 program: scoping in-scope systems, documenting and testing controls, managing deficiencies, and coordinating evidence with control owners and the external auditor. In-scope systems typically include the ERP, financial consolidation and reporting tools, key sub-ledgers, and the databases, operating systems, and cloud platforms that support them. Key responsibilities The analyst covers the four core ITGC domains and runs them through the full SOX cycle. ITGC domain and What the analyst tests and monitors Logical access User provisioning and deprovisioning, periodic user access reviews, privileged and admin access, segregation of duties, password and authentication settings, service and generic accounts Change management Authorization, testing, and approval of application, database, and infrastructure changes; segregation between developers and production; emergency changes; configuration changes in SaaS tools IT operations Batch job scheduling and monitoring, interface and data transfer controls, backup and recovery, incident and problem management Program development and System implementations and major upgrades, data migration and conversion, pre-go-live testing and sign-off Across the SOX cycle: Scoping and risk assessment. Identify in-scope applications and supporting infrastructure, map them to key business processes, and assess IT-dependent risks with the finance SOX team. Documentation. Maintain ITGC narratives, risk and control matrices (RCMs), and system flow documentation. Keep control descriptions current as systems change. Walkthroughs and design testing. Perform walkthroughs with control owners and evaluate design effectiveness against risk. Operating effectiveness testing. Plan and execute interim and year-end testing, select samples, and write clear, re-performable workpapers. Key reports and IPE. Validate the completeness and accuracy of system-generated reports and information produced by the entity, including report logic and parameters. Automated controls. Support testing of application controls and configurations, using ITGC reliance to support baseline or benchmarking strategies. Third-party assurance. Obtain and review SOC 1 Type 2 reports for service providers, assess exceptions and scope gaps, and confirm complementary user entity controls (CUECs) are in place. Deficiency management. Document exceptions, evaluate severity (deficiency, significant deficiency, material weakness) with management, and track remediation through retest. Audit coordination. Serve as the day-to-day contact for external auditors on ITGCs, manage evidence requests (PBCs), and support reliance on management's testing. Continuous improvement. Recommend control rationalization, automation of evidence collection, and better controls for cloud and SaaS environments. Required qualifications Bachelor's degree in Information Systems, Accounting, Computer Science, or a related field 2-4 years in IT audit, IT risk, or SOX compliance, in public accounting (Big 4 or national firm) or an internal audit / SOX PMO function Hands-on testing of ITGCs across access, change management, and IT operations Working knowledge of SOX Section 404, the

COSO 2013

framework, and

PCAOB AS 2201

Experience testing at least one major ERP (for example SAP, Oracle, NetSuite, or Workday) and its supporting database and OS layers Ability to read system configurations, user listings, and change logs, and to judge whether evidence is complete and accurate Clear, precise writing for workpapers, deficiency memos, and control descriptions Preferred qualifications and certifications CISA (Certified Information Systems Auditor); CISM, CRISC, CIA, or CPA are a plus Experience with cloud platforms (AWS, Azure, or GCP) and SaaS controls, including identity providers such as Okta or Azure AD Familiarity with DevOps and CI/CD pipelines and how change controls apply to them Exposure to

SOC 1 / SOC 2

report review and CUEC mapping Experience with GRC tools (for example AuditBoard, Workiva, or ServiceNow IRM) Basic data analysis skills (SQL, Excel, or Python) for full-population testing Experience at a public company or in a pre-IPO SOX readiness program Core competencies and success measures Professional skepticism: questions evidence and confirms report completeness rather than accepting screenshots at face value Technical translation: explains control requirements to engineers and IT risk to finance and audit

Organization:

manages many control owners, deadlines, and evidence requests at once

Judgment:

separates real control gaps from documentation issues and sizes deficiencies sensibly

Partnership:

improves controls with IT teams instead of only reporting failures Success in the first year looks like: ITGC testing completed on schedule for interim and year-end No ITGC-related significant deficiencies or material weaknesses that management did not identify first External auditors placing reliance on management's ITGC testing where planned Deficiencies remediated and retested before year-end Fewer audit evidence requests rejected or reworked, and less time spent per control Reporting line and working relationships The analyst usually reports to the SOX Program Manager or IT Audit Manager, within Internal Audit, Risk & Compliance, or the Controller's organization. How the analyst works with them IT control owners (infrastructure, security, application, DevOps teams) and Walkthroughs, evidence collection, deficiency remediation Finance SOX / business process team Scoping, IPE and key reports, automated control reliance Works with External auditors with Testing coordination, PBC requests, reliance on management testing Information Security and IAM Access reviews, privileged access, identity tooling Third-party risk / procurement and SOC report collection and vendor coverage

Pay:

$70.00 - $110.00 per hour

Benefits:

401(k) 401(k) matching Dental insurance Health insurance Paid time off Retirement plan

Work Location:

Hybrid remote in Fort Worth, TX 76104