Compliance Analyst, Navan

• Experience: 4-5+ years of SOX 404 IT General Controls auditing, security governance, risk, and compliance experience
• SOX Expertise: Strong understanding of SOX 404 regulations, IT general controls, and financial systems audit requirements for both on-premise and cloud systems
• Framework Knowledge: In-depth understanding of SOC frameworks, PCI DSS, GDPR, ISO 27001, and relevant regulations
• Cloud Expertise: Strong knowledge of cloud controls and environments, particularly AWS (Azure and Google Cloud experience beneficial)
• Technical Proficiency: Practical understanding of IT security compliance, risk management, access control, network security, and security architecture in cloud environments
• Analytical Skills: Excellent analytical, diagnostic, critical thinking, and project management abilities
• Communication: Ability to clearly articulate technical concepts to both technical and non-technical stakeholders from diverse backgrounds
• Automation Experience: Proficiency in implementing automation for evidence collection and control testing
• Deep technical understanding of SOX IT General Controls and their relationship to other security frameworks
• Proven ability to lead complex compliance projects from planning through execution
• Strong stakeholder engagement skills with both internal teams and external auditors
• Experience staying current with regulatory changes and integrating updates into daily operations
• Detail-oriented approach with ability to manage multiple priorities and deadlines
• Track record of driving automation and process improvements in compliance programs

Desirable

• We are seeking an experienced SOX Compliance & GRC Analyst to lead our SOX IT General Controls program while supporting our broader governance, risk, and compliance initiatives
• The successful candidate will ensure compliance with Sarbanes-Oxley regulations, focusing on IT general controls, while harmonizing controls across our expanding compliance portfolio and supporting various security frameworks
• Lead SOX Compliance Program: Conduct thorough assessments of IT general controls to ensure compliance with SOX 404 requirements
• Control Testing & Management: Perform regular management testing of IT general controls, including access controls, change management, data backup, and recovery processes
• Evidence Collection & Automation: Implement automation for evidence collection and conduct self-review of submitted evidence for access management, change management, segregation of duties, and configuration management controls
• System Onboarding: Lead onboarding of new systems to the SOX control environment, ensuring compliance by design
• Audit Coordination: Manage the flow of audit requests, coordinate scope of external testing, and interface with external auditors to represent our SOX control environment
• Multi-Framework Compliance: Execute external audits and assessments for SOC 1, SOC 2, PCI DSS, ISO 27001, and NIST CSF frameworks
• Cross-Functional Collaboration: Work closely with People Operations, Finance, Legal, IT, and product engineering teams to identify control gaps and integrate control requirements
• Assessment & Testing: Perform periodic assessments and testing of security compliance controls, policies, and standards across multiple frameworks
• Remediation Management: Identify control deficiencies, develop remediation plans, and oversee implementation efforts
• Reporting & Metrics: Prepare detailed reports on compliance status, audit findings, and create metrics to demonstrate compliance progress to senior management
• GRC Tools Implementation: Collaborate on developing and implementing centralized audit evidence repository and GRC tools
• Policy Development: Create and maintain security policies, procedures, and standards
• Training & Education: Develop and deliver training programs on SOX IT control requirements and compliance best practices