Sr IT Governance Risk and Controls Analyst

Sr IT Governance Risk and Controls Analyst

Join to apply for the Sr IT Governance Risk and Controls Analyst role at Refresco

1 day ago Be among the first 25 applicants

Get AI-powered advice on this job and more exclusive features.

Make a Difference in YOUR Career!
Our vision is both simple and ambitious: to put our drinks on every table.

This role is responsible for maintaining and improving our IT governance, risk, and compliance (GRC) program, with a focus on SOX compliance, application and data transfer controls, validating the completeness and accuracy of reports, third‑party risk management and disaster recovery.

IT Risk Assessments:

• Conduct comprehensive IT risk assessments, including identifying and analyzing potential threats and vulnerabilities across applications, infrastructure, and data.
• Develop and maintain risk registers, documenting identified risks, their potential impact, and mitigation strategies.
• Collaborate with IT and business stakeholders to prioritize and remediate identified risks.
• Assess impact of IT changes to policies, risks, controls, and governance process (including but not limited to disaster recovery, RCM).

SOX Compliance:

• Maintain and update the Risk and Control Matrix.
• Evaluate the design and monitor the execution of management's SOX controls.
• Participate in business process walkthroughs to identify application controls, reports and ITGC dependencies/risks.
• Review SOC reports and map control deficiencies to relevant IT risks.
• Ensure all control evidence of operating effectiveness is maintained timely, with appropriate detail for all IT controls; own the development, reporting and completion of control remediation plans.

Application and Data Transfer Controls, Report Validation:

• Identify the application controls, interfaces/batch jobs and reports key to supporting SOX business processes.
• Evaluate the design and effectiveness of application controls.
• Evaluate the design and effectiveness of controls intended to mitigate data transfer errors/incompleteness.
• Evaluate the design (completeness and accuracy) of reports used for key controls.

Third‑Party

Risk Management:

• Support the implementation of a third‑party risk management program.
• Monitor and manage risks associated with third‑party relationships.

Disaster Recovery:

• Develop, maintain and test the IT disaster recovery plan, inclusive of supporting audits and requests for understanding and evidence by 3rd parties.

Cyber Security:

• Perform cyber security posture evaluations.
• Design and execute strategies to evaluate the ICFR impact of cyber security incidents.
• Draft the appropriate disclosures regarding cyber security posture and cyber incidents and response as necessary.

Ongoing Regulatory Compliance:

• Ensure compliance with relevant regulations and industry standards (e.g., SOX, NIST).
• Assist with internal and external audits.

• Advanced knowledge of SOX controls and compliance; experience implementing or improving SOX.
• Strong drive and organizational skills inclusive of project and program management.
• Ability to proactively, productively manage diverse stakeholder groups.
• Excellent accounting and analytical skills.
• Technical expertise in ERP system design and operation.
• In‑depth knowledge of IT governance frameworks (e.g., COBIT, ITIL) and risk management methodologies.
• Excellent interpersonal and communication skills, verbal and written.
• Strong understanding of SOX requirements and IT general controls (ITGCs).
• Ability to analyze and solve problems, results oriented.
• Able to prioritize work, and determine when necessary to switch priorities.
• Experience evaluating / governing SAP ITGCs.

• Undergraduate degree in Accounting, Information Technology, Computer Science or related technical degree required.
• Certified Public Accountant (CPA), Certified Internal Auditor (CIA), Certified Information Systems Auditor (CISA), or Certified in Risk and Information Systems Control (CRISC) designation required (two or more preferred).
• 3+ years relevant work experience in public accounting or 4+ years industry required.
• 2+ years working with SOX in the IT domain with or for a…