> Markdown version of [/jobs/ext/4427029-internal-audit-it-sox-consultant](https://www.wearedevelopers.com/jobs/ext/4427029-internal-audit-it-sox-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Internal Audit IT SOX Consultant - **Company:** STP PARTNERS, LTD - **Location:** Fort Worth, TX, United States - **Experience:** Experienced - **Salary:** $145,600.0 - $228,800.0 - **Contract:** Contract - **Skills:** Microsoft Access, Microsoft Excel, Amazon Web Services, Microsoft Azure, Software as a Service, Cloud Computing, Cyber Security, Information Systems, Databases, System Configuration, Data Transmissions, Data Migration, DevOps, Identity and Access Management, Information Technology Audit, Information Technology Operations, Job Scheduling, Python (Programming Language), Netsuite, Oracle (Applications), Azure Active Directory, Smartsuite, SAP (Applications), SQL Databases, User Provisioning Software, IT General Controls (ITGC), Okta, Information Technology, Tools for Reporting, Workday, Servicenow - **Published:** October 6, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=c355def345f37d19 ## About the Role * Bachelor's degree in Information Systems, Accounting, Computer Science, or a related field * 2-4 years in IT audit, IT risk, or SOX compliance, in public accounting (Big 4 or national firm) or an internal audit / SOX PMO function * Hands-on testing of ITGCs across access, change management, and IT operations * Working knowledge of SOX Section 404, the COSO 2013 framework, and PCAOB AS 2201 * Experience testing at least one major ERP (for example SAP, Oracle, NetSuite, or Workday) and its supporting database and OS layers * Ability to read system configurations, user listings, and change logs, and to judge whether evidence is complete and accurate * Clear, precise writing for workpapers, deficiency memos, and control descriptions Preferred qualifications and certifications * CISA (Certified Information Systems Auditor); CISM, CRISC, CIA, or CPA are a plus * Experience with cloud platforms (AWS, Azure, or GCP) and SaaS controls, including identity providers such as Okta or Azure AD * Familiarity with DevOps and CI/CD pipelines and how change controls apply to them * Exposure to SOC 1 / SOC 2 report review and CUEC mapping * Experience with GRC tools (for example AuditBoard, Workiva, or ServiceNow IRM) * Basic data analysis skills (SQL, Excel, or Python) for full-population testing * Experience at a public company or in a pre-IPO SOX readiness program ## Description The SOX ITGC Analyst makes sure the IT controls behind financial reporting are designed well, operate consistently, and hold up under internal and external audit. The role owns the IT general controls (ITGC) portion of the annual SOX 404 program: scoping in-scope systems, documenting and testing controls, managing deficiencies, and coordinating evidence with control owners and the external auditor. In-scope systems typically include the ERP, financial consolidation and reporting tools, key sub-ledgers, and the databases, operating systems, and cloud platforms that support them. Key responsibilities * The analyst covers the four core ITGC domains and runs them through the full SOX cycle. * ITGC domain and What the analyst tests and monitors * Logical access User provisioning and deprovisioning, periodic user access reviews, privileged and admin access, segregation of duties, password and authentication settings, service and generic accounts * Change management Authorization, testing, and approval of application, database, and infrastructure changes; segregation between developers and production; emergency changes; configuration changes in SaaS tools * IT operations Batch job scheduling and monitoring, interface and data transfer controls, backup and recovery, incident and problem management * Program development and System implementations and major upgrades, data migration and conversion, pre-go-live testing and sign-off Across the SOX cycle: * Scoping and risk assessment. Identify in-scope applications and supporting infrastructure, map them to key business processes, and assess IT-dependent risks with the finance SOX team. * Documentation. Maintain ITGC narratives, risk and control matrices (RCMs), and system flow documentation. Keep control descriptions current as systems change. * Walkthroughs and design testing. Perform walkthroughs with control owners and evaluate design effectiveness against risk. * Operating effectiveness testing. Plan and execute interim and year-end testing, select samples, and write clear, re-performable workpapers. * Key reports and IPE. Validate the completeness and accuracy of system-generated reports and information produced by the entity, including report logic and parameters. * Automated controls. Support testing of application controls and configurations, using ITGC reliance to support baseline or benchmarking strategies. * Third-party assurance. Obtain and review SOC 1 Type 2 reports for service providers, assess exceptions and scope gaps, and confirm complementary user entity controls (CUECs) are in place. * Deficiency management. Document exceptions, evaluate severity (deficiency, significant deficiency, material weakness) with management, and track remediation through retest. * Audit coordination. Serve as the day-to-day contact for external auditors on ITGCs, manage evidence requests (PBCs), and support reliance on management's testing. * Continuous improvement. Recommend control rationalization, automation of evidence collection, and better controls for cloud and SaaS environments., * Professional skepticism: questions evidence and confirms report completeness rather than accepting screenshots at face value * Technical translation: explains control requirements to engineers and IT risk to finance and audit * Organization: manages many control owners, deadlines, and evidence requests at once * Judgment: separates real control gaps from documentation issues and sizes deficiencies sensibly * Partnership: improves controls with IT teams instead of only reporting failures Success in the first year looks like: * ITGC testing completed on schedule for interim and year-end * No ITGC-related significant deficiencies or material weaknesses that management did not identify first * External auditors placing reliance on management's ITGC testing where planned * Deficiencies remediated and retested before year-end * Fewer audit evidence requests rejected or reworked, and less time spent per control Reporting line and working relationships * The analyst usually reports to the SOX Program Manager or IT Audit Manager, within Internal Audit, Risk & Compliance, or the Controller's organization. How the analyst works with them * IT control owners (infrastructure, security, application, DevOps teams) and Walkthroughs, evidence collection, deficiency remediation * Finance SOX / business process team Scoping, IPE and key reports, automated control reliance * Works with External auditors with Testing coordination, PBC requests, reliance on management testing * Information Security and IAM Access reviews, privileged access, identity tooling * Third-party risk / procurement and SOC report collection and vendor coverage