Senior IT Controls Analyst

Essential Duties & Responsibilities

• Cook up IT audit meetings, walkthroughs, code reviews, remediation, evidence requests and collection in partnership with Internal Audit to facilitate compliance with Sarbanes-Oxley (IT-SOX), including IT General Controls (ITGC), Quarterly Access Reviews (QAR), User Acceptance Testing (UAT), Systems and Organization Control (SOC 1 – SOC 2), and IT Process Narratives.
• Conduct cyber focused audits and/or high-risk controls, in partnership with SBA Internal Audit, and report on the results to SBA stakeholders.
• Maintain and distribute departmental IT security and compliance documentation, including cyber policies, procedures, and process documentation, metrics, attestation reports, and others.
• Administer audit and risk related technologies and communicate to SBA stakeholders the control design and associated risk of all in-scope IT-SOX and cyber general controls.
• Provide information security & compliance metrics to company stakeholders to showcase program return on investment (ROI).
• Participate in ensuring mandated company compliance initiatives are met.
• Manage ITSC SharePoint sites and associated content to ensure accuracy and currency.
• Interact with IT and enterprise teams to minimize risk to the environment.
• Participate in annual audit and incident response and recovery activities.
• Familiarize yourself with GRC concepts and the NIST Cybersecurity and Privacy Frameworks.
• Build understanding and awareness of security issues throughout the organization, must have excellent communication and presentation skills.
• Must be a good team player.
• Review security configurations and updates to ensure software and infrastructure are protected.
• Ensure compliance with all applicable measurements and production reporting and policies.
• Manage IT security projects and ensure their proper transition into production.
• Ensure the complete and proactive protection of all corporate data and systems.
• Ensure complete issue tracking, provide feedback, and report results as accomplished.
• Responsible for the acceptance and delivery of all projects and tasks related to security operations.

Qualifications

• To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required.
• Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
• Education And/or Experience: Bachelor’s degree in MIS, Information Security, Business, or equivalent or pursuing completion of 3 years’ experience providing IT audit, cyber audits, security governance, risk, and compliance services in support of a medium-to-large multi-location organization. 3 years IT auditing experience preferred; “Big 4” background is preferred.
• Demonstrated knowledge working with Internal and External Audit and other IT and Business stakeholders.
• Preferred experience with audit-related technologies (i.e., Audit Board), information security technologies, including Security Awareness, GRC, Data Classification, SIEM, Cyber Threat Intelligence, is preferred.
• Language Skills: Ability to read and interpret documents such as safety rules, operating and maintenance instructions and procedure manuals. Excellent written, verbal, interpersonal, and problem-solving skills with a high degree of integrity and discretion and the ability to multi-task.
• Spanish or Portuguese a plus.
• Mathematical Skills: Ability to add, subtract, multiply, and divide in all units of measure, using whole numbers, common fractions, and decimals.
• Reasoning Ability: Ability to carry out instruction furnished in written, oral or diagram form.
• Certificates, Licenses, Registrations: Valid Driver’s License required.