IT – Compliance

Responsibility:

• Lead the system-wide information security compliance program, ensuring IT activities, processes, and procedures meet defined requirements, policies and regulations.
• Manage the governance, planning and risk management functions and ensures appropriate policies and controls are in place for effective service delivery. Manage all areas related to Release and Change Management.
• Execute strategy for dealing with increasing number of audits, compliance checks and external assessment processes for internal/external auditors.
• Establish and develop appropriate policies, procedures and practices in relations to governance and planning functions
• Communicate the governance activities, policies and decisions with the IT Management and Business Leadership and keep them informed of IT governance decisions that will affect IT services and projects.
• Ensure and Monitor effective implementations of the policies and procedures
• Monitors open audit issues and conducts post-audit follow-up to evaluate the adequacy of remediation efforts
• Prepares other ad-hoc reports and assists in special projects as required or requested by supervisor
• Ensure necessary awareness for the IT policies and procedures
• Assess and monitor the IT control environment to identify IT control objectives, risks, applications, third-party suppliers, and controls relevant to compliance with SOX.
• Evaluate the impact of IT related process changes on financial reporting risk, SOX compliance objectives, and the SOX control testing scope.
• Coordinate/Work effectively in the Internal Audit program with the Auditors.
• Prepare and maintain required documentation to a high standard of quality.
• Communicate IT SOX testing requirements, control gaps, and control deficiencies.
• Work with the Controllership Governance leader to define and prioritize data driven process monitoring, analysis, and automated testing goals.
• Keep abreast of regulatory developments within or outside of the company as well as evolving best practices in compliance control
• Prepare reports for senior management and external regulatory bodies as appropriate

Impact You'll Make:

Experience and Skills

• Bachelor's degree in Computer Science, Information Management, Finance, Accounting, or a related field.
• Minimum 7-8 years of experience in audit or SOX requiring knowledge of auditing principles, auditing standards, IIA standards, PCAOB, and SOX requirements.
• Experience in IT General Computer/Application controls and understanding of IT platforms, applications and related technology.
• Experience with the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework and its supplement the Control Objectives for Information and related Technology (COBIT) framework for IT controls.
• Recognized certification in Information Security such as: Certified Information System Auditor [CISA], Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP)
•  Practical experience in the implementation or use of document and/or records management systems such as SharePoint or similar technology.
•  ITIL V3 Foundation as a minimum; ITIL advanced practitioner qualifications would be desirable
• - ISO 27001:2013 or ISO 27001:2023 certification
• Knowledge of statistics and experience using statistical packages for analyzing datasets (Excel, SPSS, SAS etc

Essential Competencies

Ability to build trusting relationships - across all levels and in the immediate / extended team internationally, should be known and regarded as a trusted competent advisor.

Driving innovation – A believer in continuous improvement of services, processes and operational efficiency. Demonstrates curiosity and critical thinking.

Business Acumen – Spends time to ensure understanding of the business and aligns accordingly.

Change agent – Ability to diagnose correctly, design and execute interventions. Ensures communication through appropriate channels in a concise and proactive manner.

Execution champion – Focuses and ensures closure without compromising on quality of the output. Raises / flags issues as necessary and moves forward with a solutioning approach