Senior Manager of IT Regulatory Compliance

Company / Location Information

A.O. Smith is a global leader applying innovative technologies and energy-efficient solutions to products manufactured and marketed worldwide. The company is one of the world's leading manufacturers of residential and commercial water heating equipment and boilers, as well as a manufacturer of water treatment products for residential and light commercial applications.

A. O. Smith is headquartered in Milwaukee, Wisconsin, with approximately 12,000 employees at operations in the United States, Canada, China, India, Mexico, the Netherlands, and the United Kingdom.

Please Note
:
At this time, we are unable to provide visa sponsorship for this role. Candidates must be authorized to work in the United States without sponsorship now or in the future.

As a Senior Manager, IT Regulatory Compliance, you will be a member of the Business Technology Solutions (IT) leadership team, reporting directly to the CISO. The team is responsible for proactively planning and executing focused strategies to establish and maintain operational, financial, and regulatory controls globally.

The Senior Manager, IT Regulatory Compliance leads the company's second-line oversight of technology risk, controls, and regulatory compliance. This role has primary accountability for SOX IT compliance(ITGCs/ITACs/SoD), global IT control standardization/governance, and enterprise alignment with industry cybersecurity frameworks (e.g., NIST, COSO). In addition, this position helps shape and drive the technology and security aspects of global privacy and data protection compliance programs (e.g., GDPR, India's DPDP Act, China's PIPL, CCPA/CPRA, and other applicable regional regulations), partnering closely with Legal/Privacy, Information Security, IT, Finance/Controllership, Internal Audit, and global business leaders.

Success in the role means ensuring technology and data risks are appropriately identified, controlled, and monitored across the enterprise-covering ERP platforms (SAP), supporting financial applications, infrastructure, hosted/cloud environments, third parties, and new system implementations-while enabling compliant handling of personal data. As Senior Manager, you will set the vision and roadmap for scalable controls and governance, drive audit and regulatory readiness, and act as a thought leader who influences stakeholders and delivers measurable program outcomes.

• Thought Leadership and Executive Influence - Serve as a visible thought leader for technology risk and regulatory compliance, translating evolving requirements into practical strategy, roadmaps, and decisions. Communicate risk posture, control health, key issues, and program outcomes to the CISO and senior leadership with clear, business-focused insights.
• Program Governance, Metrics, and Continuous Improvement - Promote a culture of accountability, transparency, and continuous improvement. Define and monitor program KPIs/KRIs (e.g., control effectiveness, remediation aging, regulatory obligations tracking), identify trends and emerging risks, and drive control optimization and automation initiatives.
• Lead 2nd-Line SOX IT Compliance Oversight - Own governance and oversight of SOX, ensuring compliance with ICFR requirements and consistent execution across ERPs and supporting technologies (e.g., ITGCs, ITACs, SoD), including control design standards, evidence quality, and remediation governance.
• Establish and Maintain Global Technology and Privacy Control Standards - Design, standardize, and maintain global control frameworks and evidence standards spanning IT controls (SOX/ICFR) and technology-enabled privacy requirements (e.g., access, logging, encryption, retention/deletion, third-party controls) to drive consistency, scalability, and audit/regulatory readiness across regions and systems.
• Align Controls with Leading Frameworks and Regulatory Requirements - Partner closely with Information Security and Legal/Privacy leadership to ensure alignment with applicable frameworks and regulations (e.g., NIST, COSO, ISO 27001/27701 as applicable, GDPR, India DPDP, China PIPL, CCPA/CPRA), and translate obligations into clear, testable control requirements.
• Security-by-Design Oversight across SDLC and Implementations - Provide 2ndline oversight across SDLC phases and major system implementations ensuring controls are designed and executed to appropriately mitigate risk, procedures are executed in alignment with internal policies, and security and privacy requirements are appropriately embedded.
• Serve as Primary Audit and Regulatory Liaison (Technology Controls) - Serve as a key technology risk and compliance contact for Internal Audit, external auditors, and (as applicable) regulatory inquiries related to technology controls and technology-enabled privacy requirements. Partner with Internal Audit to ensure audits and SOX procedures are planned, performed, and executed timely. Support consistent…