Job Description
Job Title: Principal Compliance Analyst
Location: Remote
Department: Technology Compliance
Reports To: Tasha Turpin
Senior / Lead Technology Compliance Analyst
Job Summary
The Senior / Lead Technology Compliance Analyst is responsible for leading the design, execution, documentation, and audit delivery of
IT General Controls (ITGCs) and
SOX controls across a complex, hybrid technology environment. This role works directly with
Internal Audit, External Audit, Technology teams, and Business Process Owners to ensure technology controls are well‑designed, operating effectively, and supported by complete, audit‑ready evidence.
This position requires deep experience across
access management, privileged access, change management, authentication, application controls, and job monitoring, as well as the ability to translate technical processes into clear, defensible compliance documentation. The ideal candidate is comfortable operating in
high‑visibility, audit‑intensive environments and partnering across infrastructure, application, security, and business teams.
Key Responsibilities
IT Compliance & SOX Execution
- Serve as a Lead IT Compliance Analyst, partnering with Internal Audit, External Audit, Technology teams, and Business stakeholders to understand, execute, document, and deliver SOX and ITGC controls across the IT landscape.
- Own end‑to‑end execution of ITGC testing activities, including control walkthroughs, evidence coordination, validation, remediation tracking, and audit delivery.
- Act as the primary point of contact for SOX, ITGC, and audit‑related inquiries across assigned technology domains.
IT General Control Domains
- Access Management
- Privileged Access Management
- Change Management
- Authentication & Identity Controls
- Application Controls
- Operations & Job Monitoring
Audit Engagement & Evidence Management
- Lead audit walkthroughs, evidence coordination, and control validation activities.
- Work directly with Internal Audit and External Audit teams during interim and year‑end testing cycles.
- Identify control gaps and partner with control owners on risk‑based remediation plans and sustainable solutions.
Technology Partnership & Evidence Coordination
- Work directly with Windows, Linux, and IBM iSeries infrastructure teams to understand system architecture and control ownership.
- Coordinate and validate audit evidence from on‑premise, hybrid, and SaaS platforms, including but not limited to (i.e Oracle Cloud, ServiceNow/GRC, Jira, etc.:
- Ensure evidence submissions are accurate, complete, timely, and audit‑ready, minimizing rework and audit findings.
Documentation, Risk & Governance
- Develop and maintain clear process narratives, control descriptions, flow diagrams, and evidence artifacts.
- Identify control gaps, assess risk, and partner with control owners on remediation plans and sustainable solutions.
- Support internal control improvements, standardization efforts, and program maturity initiatives.
Qualifications
Required Experience
- 7+ years of experience in IT compliance, IT audit, SOX, or IT risk management within complex enterprise environments.
- Extensive hands‑on experience supporting IT General Controls (ITGCs) across access, change, operations, and security domains.
- Demonstrated experience working directly with Internal Audit and External Audit teams.
- Experience supporting hybrid environments, including on‑premise infrastructure and SaaS platforms.
- Strong understanding of risk‑based controls, evidence standards, and audit expectations.
- Ability to translate technical concepts into clear, auditor‑consumable documentation.
- Strong stakeholder management skills with a proven ability to drive accountability across technical and business teams.
- Proven ability to operate independently in high‑visibility, regulated environments.
Technical & Domain Knowledge
- Identity and access management (IAM), including privileged access concepts
- Change management and SDLC controls
- Infrastructure and application authentication mechanisms
- Enterprise monitoring, job scheduling, and operational controls
- Familiarity with SOX, ITGC, and global compliance expectations
Certifications & Professional Development
- ISACA CISA (Certified Information Systems Auditor) – Required or strongly preferred
- CompTIA Security+ – Preferred
- Ongoing professional development supporting certifications such as:
- CISM, CRISC, CISSP
- Network+, PenTest+, Linux+, CCSP
- Working knowledge of security and compliance frameworks:
- NIST RMF / CSF
- CIS Critical Security Controls
- PCI DSS
- HIPAA
- ISO/IEC 27001/27002
- AWS Cloud Essentials
Key Competencies
- Audit‑ready mindset with strong attention to detail
- Excellent written and verbal communication skills
- Ability to manage multiple audits and deadlines simultaneously
- Strong analytical and problem‑solving skills
- Comfortable operating in regulated, fast‑moving environments
Qualifications
Bachelor's degree
Range Of Year Experience-Min Year
7
Range Of Year Experience-Max Year
10
