SOX Risk Architect and Compliance Lead

About the role

This Sarbanes-Oxley (SOX) Risk Architect & Compliance Lead role is accountable for facilitation of IT risk management processes. The position collaborates cross-functionally to mature and execute IT Risk, Security and Compliance processes including governance, risk assessment, risk analysis, risk metrics, risk reporting, supplier monitoring, internal/external audit support, and technology enablement. The role provides leadership for the creation of a SOX Compliance Strategy, project execution and improvement initiatives for IT, and coordinates efforts to ensure compliance with other federal and industry regulations and requirements.

Responsibilities

• Establish and oversee formal risk analysis and risk-assessment programs for various Information Services systems and processes, focusing on SOX-related controls.
• Drive technology enablement to automate the delivery of SOX audit evidence.
• Ensure and monitor compliance with SOX as well as other federal and industry regulations and requirements.
• Liaise with Internal Audit, Internal Controls, external Auditors and BTS application teams/control owners to remediate new and outstanding issues; track compliance-related issues.
• Participate in the overall creation and maintenance of AbbVie’s risk, security & compliance policies, standards, guidelines, and baselines.
• Maintain expertise on governance, risk, security & compliance trends through training, research, and development in order to mitigate potential security exposures.
• Responsible for compliance with applicable Corporate and Divisional Policies and procedures.
• Ensure that all applicable AbbVie IT policies and procedures are followed and review and provide input to improve procedures as applicable.

Qualifications

• Required: Bachelor’s Degree in Information Technology, Computer Science or Computer Engineering with 7 years of experience; or Master’s Degree with 6 years of experience; or PhD with 2 years of experience with IT compliance, IT risk, and/or IT audit.
• In-depth understanding of all aspects of regulatory and contractual compliance, especially Sarbanes-Oxley (SOX).
• Advanced knowledge of risk assessment design and delivery.
• Experience communicating and presenting both verbally and in writing to various audiences, including committees, large groups, senior management, and executive leadership.
• Experience with IT processes, risk, and control frameworks, such as COBIT, ISO 27001, ITIL, Risk IT.
• Requires knowledge of outsourcing methodologies and operating models and working with professional services firms.
• Requires experience overseeing geographically distributed and culturally diverse workgroups.

Preferred

• Experience with Software Development Lifecycle (SDLC) methodologies.
• Professional security management certification: CISSP or CISA preferred.