Senior Engineer - Information Security & Risk

Cardinal Health is seeking a Senior Engineer, Information Security & Risk to serve as a second line of defense for IT SOX controls. The role designs, implements, evaluates, and remediates IT controls while supporting risk management, audits, compliance reporting, M&A due diligence, and continuous process improvement.

Responsibilities:

• Control design and remediation consulting –
• Perform IT risk assessment for pilot areas, identify control gap, and provide guidance for gap remediation
• Work with IT stakeholders to design effective IT controls to help the IT org achieve SOX compliance goals
• Process improvement of IT controls that increases operational efficiency and reduces the likelihood of control failure
• Evaluate/monitor the execution of IT controls to ensure they are operating effectively
• Support due diligence phase of company's M&A activities
• Provide support for third party certifications (such as SOC1/2) review and issuance
• Align with internal and external audit to understand SOX scope and audit strategy
• Track and drive remediation of IT control issues within our IT risk governance process
• Manage assigned junior staff(s) and contractors to ensure the quality of the work
• Support budgeting of compliance workstream and responsible for proactively communicate budget overruns to key stakeholders
• Support the manager in compliance posture reporting

Requirements:

• Bachelor's degree in related field or equivalent work experience
• Deep knowledge of IT SOX control and audit methodology - 6 + years of experience in related field
• Strong understanding and experience with SOX is a must and knowledge on other compliance requirements/frameworks, such as HIPAA, GDPR, PCI, is a plus
• Strong in educating/influencing of IT stakeholders to raise their awareness/mindset of IT control compliance
• Strong root cause analysis and problem-solving skill is a must
• Pro-level of risk-based judgement in addressing control issues and juggling competing priorities
• Self-motivated to learn new technologies and achieve objectives
• Ability to multi-task with organization, efficiency, accountability, and attention to detail
• Strong knowledge in IT technologies and concepts including networks, databases, middleware, interfaces, and applications
• Strong flowcharting skill is preferred
• 6 + years of experience in related field preferred, such as IT audit and/or IT compliance function preferred
• Knowledge/experience of IT controls for mainstream ERP, such as SAP, is a plus
• Experience with IT risk governance software (i.e., Archer, AuditBoard, ServiceNow GRC) is a plus
• Professional certification preferred: CISA, CPA, CISM, CISSP, CRISC