Director, SOX Compliance & Internal Controls

Fivetran•Oakland, CA

2d•Hybrid

About The Position

Fivetran is building its SOX Compliance function from the ground up. Reporting directly to the Chief Accounting Officer, the Director, SOX Compliance & Internal Controls will design and establish the company’s internal controls program using the COSO framework. The role will develop risk and control matrices, narratives, and test plans for business-process controls and IT application/general controls, and will own relationships with third-party control-testing providers and the external audit team as Fivetran advances through SOX readiness and 404(a) compliance. This highly visible build-phase role has significant latitude and accountability to shape the company’s control environment, tooling, and governance model. The Director will partner across Accounting, India CoE, FP&A, Legal, HROps, Revenue, IT/Engineering, Security, and control owners throughout the business. The position is full-time and hybrid, based in the Oakland, California office, with one in-office day each week. The Director will lead the end-to-end SOX program, including risk assessment and scoping, documentation of financial processes and controls, control testing and remediation, external-audit coordination, and reporting to senior management and the Audit Committee. The role will also advise technical teams on IT controls, develop segregation-of-duties monitoring, build an AI-enabled SOX/GRC workflow tool, train control owners, and incorporate controls into new processes, systems, and M&A integrations.

Requirements

At least 10 years of progressive experience in internal audit, SOX/internal controls, or external audit.
Meaningful experience in public accounting at a Big 4 or large national firm, focused on SOX/ICFR, IT audit, or integrated audit.
Deep, hands-on knowledge of the COSO Internal Control Integrated Framework and PCAOB auditing standards.
Strong command of business-process controls, including O2C, P2P, R2R, payroll and equity, treasury, and tax, as well as ITGC/ITAC concepts.
Ability to discuss system architecture and control design credibly with engineers as well as accountants.
Direct experience managing or co-sourcing control testing with third-party providers.
Experience owning the day-to-day relationship with a Big 4 external audit team.

Nice To Haves

Experience taking a company through IPO/SOX readiness and a first-year 404(b) audit, or leading an established public-company SOX program in the technology/SaaS industry; strongly preferred.
Bachelor’s degree in Accounting, Finance, or a related field.
CPA, CIA, and/or CISA certification.
Experience with NetSuite or a comparable ERP, Salesforce, and modern data/billing stacks used by usage-based businesses.
Prior experience as the first or founding SOX hire at a pre-IPO company, building the function from zero.
Familiarity with SOC 1 Type II report evaluation and vendor/subservice-organization risk.
Project-management skills; PMP/PMO exposure is a plus.

Responsibilities

Design, build, and lead the end-to-end SOX 404 compliance program in accordance with the COSO 2013 framework and 404(b) integrated audit standards.
Lead risk assessment and scoping of significant accounts, processes, and locations in partnership with external auditors.
Build and maintain risk and control matrices, process narratives, and flowcharts for key financial processes, including revenue, procure-to-pay, payroll and equity compensation, treasury, financial close and reporting, tax, and entity-level controls.
Design and document efficient, right-sized, audit-ready preventive and detective controls, both manual and automated.
Build an AI-enabled SOX/GRC workflow tool to manage controls, testing, issues, and evidence.
Partner with Engineering, IT, and Security to design and test IT general controls and IT application controls across in-scope systems.
Build segregation-of-duties analysis and monitoring across key financial systems.
Advise technical teams on control design for new systems, integrations, and process changes; evaluate key vendors’ SOC 1/SOC 2 reports and determine reliance.
Develop design and operating-effectiveness test plans and strategies for all in-scope business-process and ITGC/ITAC controls.
Manage third-party co-source/outsource providers performing SOX testing, including engagement scoping, workpaper-quality standards, and review of results.
Own the primary relationship with KPMG on SOX/ICFR matters; coordinate walkthroughs, manage PBC requests, present testing results and evidence, and resolve open items.
Track and drive remediation of control deficiencies through closure, including root-cause analysis and retesting; assess and present deficiency severity to management.
Prepare periodic SOX program status, testing-results, and open-issues reporting for the CAO, CFO, and Audit Committee.
Train and coach control owners on their responsibilities, control execution, and evidence standards.
Embed controls into new processes, systems, and M&A integrations, favoring automation and preventive controls.
Monitor business changes, including products, systems, revenue streams, and acquisitions, for control impacts and update scoping and documentation.
Establish the program’s long-term operating rhythm, including quarterly control self-assessments, quarterly sales questionnaires, and related-party certifications.