IT Manager - SOX Audit & Compliance

About the role

The IT Manager - SOX, Audit, and Compliance position at Ash Grove Cement is responsible for designing, implementing, and overseeing the ongoing operating effectiveness of the company's IT compliance program. This includes leading all IT Sarbanes-Oxley (SOX) compliance activities, managing the full IT audit lifecycle, and driving continuous improvement of IT General Controls (ITGCs) and IT Application Controls (ITACs) across the enterprise.

Responsibilities

• Promote and follow all plant safety guidelines.
• Own and manage the end-to-end IT SOX compliance program, including annual risk assessments, scoping, control mapping, and documentation of Risk and Control Matrices (RCMs) and process narratives for all in-scope systems.
• Identify, assess, and test IT General Controls (ITGCs) covering logical access, change management, computer operations, and data backup/recovery across complex ERP and business-critical applications.
• Identify and assess IT Application Controls (ITACs) for in-scope financial systems, including ERP platforms and supporting reporting tools.
• Review and refresh the annual SOX scope; identify opportunities for control rationalization, automation, and testing approach improvements.
• Partner with control owners to maintain and update process narratives, flowcharts, and standard operating procedures annually and following control changes.
• Serve as the primary point of contact and liaison between IT and internal/external auditors for all IT audit and compliance activities.
• Coordinate and facilitate audit walkthroughs, evidence collection, control testing, and stakeholder interviews across all audit cycles.
• Manage external audit requests in a timely and organized manner; track and report on audit deliverable status to IT and finance leadership.
• Evaluate ITGCs and ITACs against applicable regulatory frameworks, including SOX/COSO, COBIT, NIST CSF, and ISO 27001; identify control gaps and design risk-based mitigation strategies.
• Evaluate ITGCs and ITACs against applicable regulatory frameworks, including SOX/COSO, COBIT, NIST CSF, and ISO 27001; identify control gaps and design risk-based mitigation strategies.
• Evaluate ITGCs and ITACs against applicable regulatory frameworks, including SOX/COSO, COBIT, NIST CSF, and ISO 27001; identify control gaps and design risk-based mitigation strategies.
• Research and assess control deficiencies; collaborate with management and process owners to design practical remediation plans and track progress through to verified resolution.
• Maintain a current, comprehensive inventory of IT controls, compliance activities, deficiency status, and remediation tracking; deliver regular reporting to IT and executive leadership.
• Provide proactive, risk-based guidance on control design for new system deployments, ERP upgrades, application changes, and cloud migrations.
• Develop, implement, and maintain IT compliance policies and procedures aligned with SOX, applicable regulations, and organizational risk appetite.
• Design and deliver targeted compliance training and awareness programs for IT staff, control owners, and other stakeholders.
• Maintain clear, accurate, and audit-ready documentation of IT controls, policies, testing results, and audit findings at all times.
• Leverage GRC tools (e.g., AuditBoard, Workiva) and data analytics to enhance control monitoring, automate evidence collection, and improve audit efficiency.
• Benchmark the company's IT compliance program against industry peers and leading practices; recommend enhancements to the Director.

Requirements

• Minimum 4 Year / Bachelor's Degree in information technology, management information systems (MIS), computer science, accounting or a related field.
• Minimum 5 years of progressive experience in IT SOX compliance, IT audit, IT risk management, or a combined IT audit capacity.
• Hands-on experience with ERP platforms used in industrial and manufacturing environments — specifically JD Edwards (EnterpriseOne), SAP S/4HANA or ECC, or Oracle Fusion — including knowledge of their ITGC and ITAC control structures.
• Experience with cloud infrastructure security and controls in AWS or Azure environments, particularly for SOX in-scope applications.
• Working knowledge of database platforms (SQL Server, Oracle) and operating systems (Windows Server, Linux/UNIX) from a controls and audit perspective.
• Experience with data analytics tools (Power BI, ACL/Galvanize, Tableau) for audit testing and continuous monitoring.
• Experience in manufacturing, building materials, cement, or heavy industrial IT environments.
• PMP certification or demonstrated project management experience supporting compliance program delivery.
• Demonstrated hands-on experience assessing and testing ITGCs and ITACs for complex ERP and enterprise applications in support of SOX 404 audits.
• Direct experience coordinating with external auditors (including Big 4 firms) and supporting PCAOB-compliant SOX testing programs.
• Strong working knowledge of IT governance and compliance frameworks: SOX/COSO, COBIT, NIST CSF, and/or ISO 27001.
• Experience with GRC or audit management platforms (AuditBoard, ServiceNow, Workiva, or equivalent).
• Excellent verbal and written communication skills; ability to present technical findings clearly to non-technical stakeholders and senior leadership.
• Ability to work independently and collaboratively, manage multiple concurrent workstreams, and meet strict audit deadlines.

Qualifications

• Domestic travel up to 25%.

Skills

• Knowledge of IT governance and compliance frameworks: SOX/COSO, COBIT, NIST CSF, and/or ISO 27001.
• Experience with ERP platforms used in industrial and manufacturing environments — specifically JD Edwards (EnterpriseOne), SAP S/4HANA or ECC, or Oracle Fusion.
• Experience with cloud infrastructure security and controls in AWS or Azure environments, particularly for SOX in-scope applications.
• Experience with data analytics tools (Power BI, ACL/Galvanize, Tableau) for audit testing and continuous monitoring.
• Experience in manufacturing, building materials, cement, or heavy industrial IT environments.
• Project management experience supporting compliance program delivery.
• Strong verbal and written communication skills.
• Ability to work independently and collaboratively, manage multiple concurrent workstreams, and meet strict audit deadlines.

Benefits

• Company Benefits
• Medical/Dental/Vision/Prescription
• Generous Paid Time Off
• 11 Paid Holidays per year
• 401k with 5% company match & profit sharing
• Opportunities for Internal Mobility
• Professional Development Opportunities
• Tuition Reimbursement Program
• Employee Assistance Program
• Company Paid Life Insurance
• Short- & Long-Term Disability
• Company Discounts on products, goods, services, electronics, automotive, travel & more!
• Opportunities for Community Engagement
• Potential Relocation Packages