Manager, IT Audit & Compliance

Foundation Building Materials•Santa Ana, CA

1d•$130,000 - $150,000

About The Position

The IT Audit and Compliance Manager leads and manages the organization’s IT audit, risk assessment, and compliance programs. The role ensures IT systems, processes, and controls comply with internal policies, industry standards, and regulatory requirements. It partners with IT, security, finance, legal, and business teams to strengthen internal controls, mitigate risk, and support strategic initiatives. The position also leads and mentors the IT audit and compliance team, serves as the primary liaison with external auditors, regulators, and third-party assessors, and provides senior management with reports and recommendations to strengthen the organization’s compliance posture. The manager is responsible for IT audit and risk management, including managing and testing SOX controls within a publicly traded company, conducting risk assessments, developing audit plans, and tracking remediation. The role also manages compliance with frameworks and requirements such as SOX, NIST, and PCI-DSS 4.0, including PCI scope reductions through segmentation, iFrame, and P2PE. In addition, the posting assigns responsibility for leading tax audits, inquiries, and examinations involving US federal, state, and Canadian tax authorities, and for mitigating tax risks through monitoring, controls, and process improvements. This is a full-time position with a base salary of $130,000–$150,000 per year and a 20% target bonus. The stated total compensation range is $150,000–$190,000. The role is not eligible for the Lowe’s Long-Term Incentive program. FBM offers medical, dental, and vision coverage; HSA/FSA plans; insurance and legal plan options; paid time off and holidays; and a 401(k) plan with company match.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Accounting, or a related field.
Seven or more years of experience in IT audit, compliance, or risk management roles.
Strong understanding of IT general controls, cybersecurity frameworks, and regulatory requirements.
Proven experience managing audits and compliance projects in large organizations.
Demonstrated experience managing and testing SOX controls within a publicly traded company.
Excellent analytical, problem-solving, and organizational skills.
Strong communication skills for engaging technical and non-technical stakeholders.
Ability to manage multiple priorities in a fast-paced environment.

Nice To Haves

Master’s degree preferred.
CISA, CISM, CISSP, CRISC, or similar certification highly desirable.

Responsibilities

Plan, execute, and manage IT audits evaluating internal-control design and effectiveness, security measures, and operational processes.
Manage and test SOX controls within a publicly traded company and ensure compliance with financial and IT regulatory requirements.
Conduct risk assessments to identify gaps and vulnerabilities in IT systems and processes.
Conduct third-party vendor risk assessments in accordance with NIST.
Develop and maintain audit plans aligned with business priorities and regulatory changes.
Track, monitor, and report remediation efforts for audit findings and ensure timely closure.
Ensure adherence to regulatory requirements, including SOX, NIST, and PCI.
Ensure adherence to PCI-DSS 4.0 requirements, including scope reductions through segmentation, iFrame, and P2PE.
Manage IT compliance frameworks, policies, and procedures.
Collaborate with legal, finance, and business stakeholders to support compliance across systems and processes.
Monitor regulatory changes and assess their impact on IT and business operations.
Lead and manage tax audits, inquiries, and examinations by US federal, state, and Canadian tax authorities.
Mitigate tax risks through proactive monitoring, internal controls, and process improvements.
Coordinate with external auditors and advisors regarding tax-related matters.
Lead and mentor the IT audit and compliance team.
Partner with IT and security teams to promote information-security and data-protection best practices.
Serve as the primary liaison with external auditors, regulators, and third-party assessors.
Provide senior management with reports, insights, and recommendations to strengthen compliance.
Perform other duties as assigned to support IT and Corporate objectives.