IT SOX Controls Tester

We are looking for an IT SOX Controls Tester to join our mission and help us build a global platform that's scalable, reliable, and secure. The Security Controls team plays a vital role in safeguarding Wise's complex IT landscape. We specialise in the comprehensive testing, assessment, and continuous improvement of technology-related controls. This role requires experience in testing controls in a cloud-native environment as opposed to legacy IT systems.

What will you be working on?:

• Perform control testing (Design & Operating Effectiveness) for Access Management, Change Management, and IT application controls across our cloud infrastructure and SaaS landscape.
• Partner with key stakeholders across Finance, Risk, Security, Platform to effectively communicate SOX 404 requirements and expectations.
• Support control owners on their journey to mature our risk and control environment.
• Leverage data analytics and automation to assess control design and operating effectiveness.
• Maintain a high standard of quality in documentation, ensuring that testing methods are in compliance with SOX 404 requirements.

Do you have experience in Terraform?, * You possess deep knowledge of SOX 404 requirements, COSO framework, and IT control frameworks (NIST, ISO27001). You understand how compliance frameworks map to dynamic infrastructures.

• You have 3+ years of experience in Technology Risk or IT Audit, with a dedicated focus on SOX.
• You have demonstrable experience with first-time SOX audits in cloud-native environments.
• You understand how Change Management works in a CI/CD pipeline and how Access Management works in a microservices architecture.
• Experience with AWS, Terraform, GitHub, Jira, Okta, and SailPoint is preferred.
• You are driven to modernize testing methodologies, utilizing data analytics and automation to reduce reliance on manual processes and enhance control coverage.
• You work well in a cross-functional environment. You can articulate complex control findings to engineers and explain complex technical risks to finance stakeholders.