Senior Analyst, IT Internal Controls & SOX

At HUB International, we are a team of entrepreneurs. We believe in protecting and supporting the aspirations of individuals, families, and businesses. We help our clients evaluate their risks and develop solutions tailored to their needs. We believe in empowering our employees to learn, grow, and make a difference. Our structure enables our teams to maintain their own unique, regional culture while leveraging support and resources from our corporate centers of excellence.

HUB is a global insurance and employee benefits broker, providing a boundaryless array of business insurance, employee benefits, risk services, personal insurance, retirement, and private wealth management products and services. With over $5 billion in revenue and almost 20,000 employees in 600 offices throughout North America, HUB has grown substantially, in part due to our industry leading success in mergers and acquisitions

We are seeking a skilled and motivated Senior Analyst, IT Internal Controls & SOX who brings more than technical SOX expertise — someone who understands both IT infrastructure and the business it supports, and can translate that understanding into practical, valuable insights. Reporting to the Sr. Manager IT Internal Controls & SOX, you will assist in the design, implementation, and monitoring of IT controls to ensure regulatory compliance and operational.

This role requires strong technical fluency across ITGC Domains, cloud platforms, sound business judgment, and the confidence to raise concerns and offer perspective, not just execute tasks.

• Support the overall IT SOX program including but not limited to controls and key report testing
• Apply working knowledge of cloud infrastructure (AWS, Azure, GCP) to assess controls related to cloud security, access management, change management, computer operations
• Support internal initiatives and look for process improvements
• Proactively identify and evaluate opportunities to apply AI in streamlining controls testing and reporting processes
• Maintain a comprehensive RCM including ITGC, ITAC, as a part of the overall SOX program
• Evaluate IT control processes to identify risk gaps
• Document, track and report identified issues
• Provide remediation guidance, track and log the action plans in Workiva
• Collaborate with external auditors and IT/business stakeholders, providing documentation, context, and support as needed
• Assist in delivering IT-specific internal control training for different teams / business units
• Contribute to IT risk assessments and SOX scoping activities, helping prioritize key risk areas across cloud different systems/applications/tools
• Manage the overall Workiva (GRC) platform and act as a system administrator
• Proactively communicate observations, risks, and recommendations to management, speaking up when something doesn't look right rather than waiting to be asked

• Bachelor's degree in Information Systems, Accounting, Finance, or a related field
• 2–4 years of experience in IT internal controls, IT auditing, or a similar role in a public company or accounting firm. Big 4 and consulting experience is a plus
• Solid understanding of SOX regulations and the COSO framework, paired with broader knowledge of IT general controls, business processes, and how technology supports the organization
• Practical knowledge of ITGC domains such as Change Management, Access Management, Computer Ops, SLDC, etc
• Experience with IT Application Controls, Key Reports (plus)
• Working knowledge of cloud platforms — AWS, Azure, and/or GCP — including familiarity with cloud security and access controls
• Strong analytical and problem-solving skills with the ability to connect technical findings to business impact
• Excellent communication and interpersonal skills; comfortable engaging with stakeholders at all levels and confident enough to voice concerns, ask hard questions, and offer independent perspective
• A collaborative, proactive mindset — someone who contributes ideas rather than simply following process
• Certifications such as CISA, CISM, CRISC, CC (Certified in Cybersecurity), CISSP, or cloud certifications (AWS Certified, Google Cloud…