IT Compliance Analyst

Churchill Downs Incorporated•Lyndon, KY

1d•Onsite

About The Position

The IT Compliance Analyst supports the governance and execution of Churchill Downs Incorporated’s IT Sarbanes-Oxley (SOX) compliance program across in-scope systems and environments. The role participates in key phases of the IT SOX lifecycle, including control scoping and design, documentation, walkthroughs, evidence collection, testing coordination, issue management, remediation tracking, and compliance reporting. The analyst partners with IT Control Owners, Finance, Internal Audit, and External Audit to maintain appropriately designed and documented controls aligned with SOX requirements and to support management oversight of the IT control environment. The role also supports other governance, risk, and compliance initiatives, including PCI DSS, security risk management, IT policy governance, and third-party risk management. The position is onsite five days a week at CDI’s headquarters in Louisville, Kentucky. Applicants must be at least 21 years old and able to obtain racing and/or gaming licenses as required in jurisdictions where CDI operates.

Requirements

Bachelor’s degree in Information Technology, Information Systems, Accounting, Finance, Business Administration, or a related field, or equivalent experience.
2–4 years of experience in IT compliance, SOX, IT audit, internal controls, or related GRC work.
Understanding of IT SOX controls, including IT General Controls (ITGCs), IT Application Controls (ITACs), and Information Produced by the Entity (IPE).
Knowledge of key ITGC domains, including access management, change management, computer operations, and the system development lifecycle (SDLC).
Experience supporting SOX walkthroughs, evidence collection, control documentation, and deficiency tracking.
Strong analytical and problem-solving skills.
Ability to interpret technical processes and translate them into clear control documentation.
Effective collaboration and communication skills across technical and non-technical stakeholders.
Ability to work collaboratively and effectively as part of a team and build effective working relationships with control owners, auditors, and other stakeholders.
Strong organizational skills and attention to detail.
Ability to manage multiple priorities in a deadline-driven environment.
Accountability and ownership of assigned work, including independently managing deliverables, following through on commitments, and driving issues to resolution.
Proficiency in Microsoft Office, particularly Excel.
Ability to obtain racing and/or gaming licenses as required in any jurisdiction where CDI operates; must be 21 years of age or older.

Nice To Haves

Experience working with GRC platforms such as Optro or similar compliance tools.
CISA, CRISC, or a similar certification.
Experience supporting PCI, cybersecurity, or other regulatory compliance programs.

Responsibilities

Support governance and execution of the IT SOX compliance program across in-scope systems and environments.
Participate in IT SOX lifecycle activities, including control scoping, walkthroughs, documentation maintenance, evidence collection, testing coordination, training, and remediation tracking.
Maintain and validate IT SOX documentation, including control narratives, risk control matrices (RCMs), and supporting artifacts.
Support Internal and External Audit inquiries by responding to questions, coordinating requests with control owners, and providing documentation and evidence.
Track control gaps and deficiencies, monitor remediation progress, and report program status and control effectiveness to support management oversight and audit readiness.
Assess the impact of system implementations, enhancements, and organizational changes on the IT SOX control environment.
Support the design, development, implementation, and execution of IT SOX controls in partnership with IT and business Control Owners.
Coordinate and execute periodic User Access Reviews (UARs), including validating review populations, coordinating reviewers, tracking completion, documenting reviews, and remediating identified access issues.
Support other governance, risk, and compliance initiatives, including PCI DSS, security risk management, IT policy governance, and third-party risk management.
Perform other duties as assigned.