Head of SOX and Internal Controls

About Zūm

Zūm is revolutionizing mass mobility with its Connected Mobility Experience (Zūm CMX™) system that connects and coordinates people, vehicles, and operations in real time. In the $50 billion student mobility market — the largest segment of the mass mobility industry — Zūm CMX is transforming a daily source of anxiety and disruption into a reliable, transparent, and efficient mobility experience for students and families.

Today, more than 4,500 schools rely on Zūm CMX. Recognized globally for its innovative approach and operational execution, Zūm has been named to Fast Company’s World’s Most Innovative Companies, CNBC Disruptor 50 and Changemakers, the World Economic Forum, and the Financial Times’ Fastest Growing Companies lists. Zūm is backed by leading investors including Sequoia Capital, GIC, TPG, and Softbank.

As Zūm’s Head of SOX and Internal Controls, you will play a key role in implementing internal controls and periodic testing of internal controls over financial reporting (ICFOR). This role will work closely with our outsourced service provider to coordinate and manage overall SOX compliance including design and operating effectiveness testing. Reporting directly to the VP Corporate Controller you will oversee all aspects of the SOX compliance program.

This role is based at the Company’s headquarters in Redwood Shores, CA and requires you to be onsite 3x/week (Monday, Tuesday, and Thursday). We will only consider candidates already based in the Bay Area.

• Lead Risk Assessments:
  Drive comprehensive risk assessments across key financial and operational processes, including revenue, procure-to-pay (PTP), payroll, accounting, and infrastructure to identify control gaps and emerging risks.
• Design and Implement Control
  
  Activities:
  
  Develop and operationalize a robust internal controls framework for financial reporting, grounded in the COSO model. Design preventive and detective controls that ensure data integrity and reporting accuracy, with a focus on scalability and audit readiness.
• Execute the Controls Program Through Co-Sourced Providers:
  Oversee the day‑to‑day execution of the controls program by managing co‑sourced partners and vendors. Ensure alignment with internal standards, timelines, and quality expectations, while maintaining strong coordination with internal stakeholders and auditors.

• Integrated Monitoring Framework:
  Oversee the health, execution, and ongoing refinement of all internal controls, providing visibility into control performance. Rapidly identify gaps and recommend targeted remediations to establish a high‑quality control environment.
• Regulatory Compliance and Standards Adherence:
  Align control activities with prevailing regulatory requirements and recognized industry frameworks for internal controls, ensuring readiness for public‑company standards or similar large‑scale compliance obligations.
• Controls Readiness:
  Coordinate with cross‑functional teams to redesign or enhance systems and processes to achieve compliance and improve overall control effectiveness. Drive projects focused on addressing control gaps and proactively preparing for future control requirements.

• Cross‑Functional Leadership:
  Collaborate with Finance, Operations, Compliance, and other stakeholders to build consensus on control objectives, adapting processes and policies to meet organizational needs at hyper scale.
• External Audit Liaison:
  Serve as the main point of contact for external auditors on Internal Controls, ensuring efficient handling of audit inquiries and proactive resolution of any findings.
• Evaluate and Map Business Process Flows:
  Conduct detailed mapping and analysis of end‑to‑end business processes, identifying and addressing financial reporting risks in a rapidly evolving environment.
• Educate Stakeholders:
  Provide clear guidance on internal controls and financial risk concepts to diverse audiences, fostering a culture of accountability and continuous improvement around risk management.

• 8+ years of experience with SOX, IT audit, and IPE, preferably…