Senior Cyber Security Controls Assessor

Senior Cyber Security Controls Assessor

Location: Oakland, CA

Onsite Flexibility: Hybrid 1 day onsite per week (Wednesday)

Contract Details

• Position Type: Contract
• Contract Duration: 4 months
• Pay Rate: $75.00 $80.00 / Hour (USD)
• Equipment: Client laptop will be provided. With prior Manager approval, may submit expense for phone/internet reimbursement at a set amount.
• Interview Process: 2 rounds (1 phone screen followed by an in-person/video interview)
• Work Authorization: Applicants must be authorized to work for ANY employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.

Job Summary

The Sarbanes-Oxley Act (SOX) Information Technology (IT) team within the Internal Audit Organization is responsible for overseeing the effective operation of the Utility's IT internal controls over financial reporting and acts in a consultative capacity as a business partner and IT SOX controls expert to the Utility. This position is focused on internal IT Audits, IT Governance, and the IT SOX Compliance Program. The primary responsibility is to review, test, evaluate, and document IT SOX controls to ensure they are operating effectively and comply with SOX requirements. The selected candidate will support the organization's IT SOX program, primarily focusing on control testing, reviewing documentation, providing feedback, and documenting audit findings. IT SOX Compliance Analysts are responsible for understanding the business environment, determining the SOX IT scope and controls, coordinating IT SOX testing aligning with the Utility's testing cycle, evaluating deficiencies, validating the remediation plans are appropriate, and providing controls guidance for any relevant IT system changes. This position is a temporary backfill for an existing team member who will be going on maternity leave; the duration may extend depending upon funding.

Key Responsibilities

• Provides guidance and acts as a subject matter expert to Technology and Security Compliance personnel, system owners, and business process owners within and outside of the IT organization on the identification, documentation, testing, and remediation of key controls for SOX IT processes.
• Evaluates, develops, and establishes appropriate testing objectives and test plans for the in-scope ITGCs (IT General Controls).
• Performs walkthroughs of medium to complex system processes and identifies gaps in controls.
• Assists in coordinating SOX audit performed by external auditors.
• Coordinates with system owners to monitor the progress of open SOX control deficiencies and remediation efforts.
• Evaluates ITGCs' deficiencies in accordance with the company's framework for evaluating control deficiencies and identifies associated financial statements impact.
• Performs and documents IT entity level controls testing.
• Performs quality assurance reviews on completed SOX IT testing documentation.
• Assists with the preparation of quarterly deliverables for Leadership and Audit Committee.
• Trains new or existing process owners on the internal control compliance processes.
• Manages WDesk SOX module to facilitate the quarterly SOX testing and deliverables.
• Reviews and tests IT SOX controls to ensure compliance and effectiveness.
• Reviews control testing performed by the team and validates the results.
• Provides feedback and guidance on control testing.
• Identifies, evaluates, and documents control deficiencies and audit findings.
• Reviews IT SOX control documentation before it is submitted to the external auditor.
• Ensures proper documentation and evidence are maintained for audit purposes.
• Evaluates IT General Controls (ITGC), particularly access controls, badge processes, and Segregation of Duties (SOD).

Required Skills

• Solid understanding of AS5, COBIT framework, and COSO framework.
• Demonstrates knowledge of: (1) IT systems (applications, operating systems, databases, and middleware), (2) ITGCs, (3) control impact on most IT and business processes, and (4) SOD conflicts with IT access.
• Ability to assess potential impact of deficiencies, provide control advice for moderate to complex processes, and to positively influence system owners on control solutions.
• Ability to prioritize, perform, and communicate necessary SOX activities and communicate SOX findings both in written and verbal form that is cohesive, understandable, and actionable to stakeholders.
• Robust understanding of the SOX regulation, the Utility's standards and procedures, and industry best practices to provide control advice to stakeholders.
• Ability to ask detailed, probing questions, and to utilize research and issue resolution skills.
• Ability to effectively manage multiple diverse tasks and adhere to tight deadlines.
• Ability to initiate system reviews/walkthroughs, identify gaps and recommend appropriate controls with limited guidance.
• Strong SOX IT / ITGC technical expertise and judgment.
• Deep understanding of SOX, ITGCs, application/OS/database controls, access and segregation of duties, COSO, COBIT, and AS5.
• Ability to determine whether a control is properly designed and identify gaps.
• Ability to independently evaluate complex processes and controls; can lead walkthroughs, ask probing questions, understand how systems and business processes connect, identify control gaps, and recommend appropriate controls with limited guidance.
• Ability to go beyond confirming that evidence exists to assess whether the control effectively addresses the underlying risk and whether testing is sufficiently thorough, clear, and well-documented to support the conclusion.
• Strong stakeholder communication and influence; can explain SOX/control issues clearly to system owners, business process owners, leadership, and external auditors.
• Can challenge appropriately, provide practical control advice, coordinate remediation, and turn technical findings into clear, actionable business language.

Preferred Skills

• Previous experience in Big 4 Public Accounting or in the energy or public utility industry.
• Experience with internal/external audits.

Education Requirements

• Bachelor's degree in Management Information System, Computer Science, Accounting/Business, or equivalent experience (required).
• Master's Degree in Management Information System, Computer Science, or job-related discipline or equivalent experience (preferred).
• Certified Information Systems Auditor (CISA) (minimum license/certification required).
• Certified Internal Auditor (CIA) (license/certification required).
• Certified Information Systems Security Professional (CISSP) (license/certification required).
• Certified Public Accountant (CPA) or equivalent (license/certification required).

Required Experience

• 5 years of relevant experience in SOX IT Compliance or other applicable areas, including public accounting experience.
• Conducted IT SOX 404 audits.
• Performed IT General Controls testing.
• Reviewed access management and user provisioning controls.
• Evaluated Segregation of Duties (SOD).
• Tested physical access/badge controls.
• Reviewed audit evidence and identified control deficiencies.
• Prepared audit documentation for external auditors.
• Worked with COSO, COBIT, and AS5 frameworks.

Nice-to-Have Experience

• Previous experience in Big 4 Public Accounting or in the energy or public utility industry.
• Experience with internal/external audits.

Benefits

• Medical, Vision, and Dental Insurance Plans
• 401k Retirement Fund

About the Client

This client is a major utility and energy company headquartered in Oakland, CA, serving millions of customers across a broad regional footprint in the western United States. The organization employs tens of thousands of professionals and ranks among the largest investor-owned utilities in the nation. Their workforce includes IT auditors, SOX compliance analysts, systems analysts, data governance specialists, supply chain professionals, and AI/ML engineers who collaborate across enterprise programs including a significant digital transformation initiative.

About GTT

GTT is an NMSDC-certified Minority Business Enterprise (MBE) headquartered in Portsmouth, New Hampshire. GTT is a subsidiary of Chenega Corporation, an Alaska-based company and one of the largest Alaska Native-owned corporations. An Inc. 5000 honoree and one of SIA's Best Staffing Firms to Work For, GTT connects professionals with Fortune 500 organizations across IT, engineering, construction, utilities, life sciences, financial services, and healthcare throughout the U.S. and Canada. We're committed to diverse, inclusive workplaces and to placing people in roles where they can do their best work.

Job Number: 26-17971 Industry: Engineering

#LI-Hybrid #LI-GTT #gttce