Senior Director Internal Audit and SOX

About The Role

We are scaling fast and building the financial infrastructure to match. Backed by Thoma Bravo, we are a high‑growth SaaS company operating with the urgency of a startup and the financial rigor expected by a sophisticated institutional investor. Our private equity sponsors are active, numbers‑driven, and expect a control environment that will hold up under the most demanding scrutiny. So do we.

As our Senior Director of Internal Audit and SOX, you will build and lead the internal audit function from the ground up at a pivotal moment in our trajectory. We are on the path to an initial public offering or strategic exit, and the control environment you design, test, and operate will be the one that goes in front of the Securities and Exchange Commission, the Public Company Accounting Oversight Board, and our Big 4 external auditors.

This is not an audit coordination role. You will own the risk assessment, write the audit plan, build the team, run the audits, remediate the findings, and report directly to the Audit Committee. You will partner with the Chief Accounting Officer, the Chief Financial Officer, and every function that touches financial reporting, information technology, and operations. Role located in Englewood, CO (Hybrid).

• Own the end‑to‑end Sarbanes‑Oxley Section 404(b) readiness program, from scoping and risk assessment through control documentation, testing, deficiency evaluation, and remediation tracking.
• Define the scope of the Sarbanes‑Oxley program across all in‑scope legal entities, processes, and information technology systems, and defend that scope to external auditors and the Audit Committee.
• Build and maintain a complete internal control over financial reporting framework with documented control objectives, control descriptions, risk ratings, and testing evidence for every key control.
• Design and operate walkthroughs, effectiveness testing, and operating effectiveness testing across financial close and reporting, procure‑to‑pay, order‑to‑cash, treasury, payroll, and information technology general controls.
• Evaluate control deficiencies against materiality thresholds, classify deficiencies as control deficiencies, significant deficiencies or material weaknesses, and manage remediation plans to closure before the external audit window.
• Serve as the primary internal liaison to the external audit team on internal control over financial reporting matters, owning the prepared‑by‑client list, managing fieldwork timelines, and ensuring zero repeat findings.
• Build the integrated audit model in which internal audit testing and external auditor reliance are coordinated to reduce total audit burden on the business.
• Build and execute a risk‑based annual internal audit plan approved by the Audit Committee, covering financial, operational, compliance, and information technology risks.
• Conduct the enterprise risk assessment annually and update it dynamically as the business adds legal entities, products, geographies, or completes acquisitions.
• Lead or supervise all internal audit engagements from planning through fieldwork, findings, management response, and final report issuance.
• Audit high‑risk areas including revenue recognition, commissions, procurement and vendor management, equity administration, treasury operations, and payroll.
• Issue clear, actionable audit reports with findings rated by severity, root cause identified, and management response and remediation timeline documented.
• Track open audit findings and remediation commitments to closure, escalating overdue or unresolved items to the Chief Accounting Officer and Audit Committee.
• Maintain the internal audit charter and ensure the function operates in accordance with the Institute of Internal Auditors International Professional Practices Framework.
• Own the information technology general controls program across all in‑scope systems, including Oracle ERP, Coupa, Navan, Salesforce, and other financially significant applications.
• Test and document information technology general controls covering logical access, user provisioning and deprovisioning, segregation of duties enforcement, change management, and…