Manager, IT SOX

Klaviyo•Boston, MA

About The Position

Klaviyo’s Internal Audit function partners with operational leaders to monitor and improve internal controls and processes, drive operating efficiencies, and apply industry best practices. The team is building an AI-first audit function that uses AI and automation across the audit lifecycle. The Manager, IT SOX will lead Klaviyo’s IT SOX program and technology audits. The role reports to the VP of Internal Audit & Compliance, manages and coaches the Sr. IT Internal Auditor day to day, and works with stakeholders across IT, Security, Business Intelligence, Finance, Accounting, Legal, People Operations, Engineering, and Global Technology Solutions. Its primary focus is IT SOX controls—including IT general controls, IT application controls, and key reports—across homegrown and third-party systems, as well as risk-based technology audits. The manager owns the annual IT SOX plan and oversees its end-to-end execution, including risk assessment, system scoping, testing, external-auditor coordination, deficiency evaluation, and remediation. The role also leads technology audits and establishes standards for AI use across the audit lifecycle, including review, validation, documentation, reusable workflows, and automation. It supports automated testing and continuous monitoring, and assesses AI-related risks and controls in the financial reporting environment.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Accounting, Business, or another relevant field.
At least 8 years of IT audit experience in public accounting, such as a Big 4 accounting firm, and/or industry, including IT SOX controls testing; experience in a technology or SaaS environment is ideal.
Experience managing or coaching auditors and/or co-sourced resources.
Strong understanding of SOX 404, PCAOB Auditing Standards, COSO 2013, COBIT, US GAAP, and Internal Audit Standards.
Deep understanding of IT general controls, IT application controls, interfaces, key reports, segregation of duties, and SOC 1 reviews for homegrown and off-the-shelf applications and cloud environments.
Experience auditing modern engineering environments, including CI/CD pipelines, access defined in code, and automated data pipelines.
Experience leading planning, scoping, testing, and reporting for a full-year IT SOX program.
Experience leading technology audits, such as cloud, cybersecurity, or data governance audits.
Excellent written and verbal communication skills, including the ability to influence and explain technical concepts clearly to stakeholders.
Exceptional analytical and problem-solving skills, attention to detail, and an investigative mindset focused on root causes.
Excellent project management skills and experience working with cross-functional teams.
Data analytics skills and experience with SQL, Python, Tableau, or other analytics or visualization tools.
Ability to use AI in audit work while understanding its limits, including accuracy, confidentiality, and over-reliance.
Comfort working in a fast-paced, high-growth environment.

Nice To Haves

Experience using SOX GRC tools such as Optro (formerly AuditBoard) and ERP systems such as NetSuite.
Working knowledge of AI governance frameworks such as NIST AI RMF or ISO/IEC 42001, or AI audit credentials such as ISACA AAIA.
CISA certification is preferred.
CPA, CIA, or CISSP certification is a plus.

Responsibilities

Manage and coach the Sr. IT Internal Auditor day to day by setting priorities, reviewing workpapers, and providing feedback and development.
Oversee co-sourced IT testing and review workpapers for quality and consistency.
Own the annual IT SOX plan, including risk assessment, scoping in-scope systems, and alignment with the external auditor on reliance and timing.
Scale and rationalize IT SOX scope as Klaviyo’s systems and business evolve.
Lead end-to-end IT SOX execution across IT general controls, IT application controls, system interfaces and integrations, key reports and information produced by the entity, and segregation of duties, across homegrown applications and third-party SaaS.
Maintain the ITGC risk and control matrix in Optro, Klaviyo’s SOX project management system.
Review SOC 1 reports, complementary user entity controls, and bridge letters for in-scope vendors.
Evaluate IT deficiencies, including root cause and severity, and drive remediation with control owners through closure.
Coordinate with co-sourced providers, external auditors, and internal business partners to ensure alignment and timely execution of IT SOX work.
Provide SOX readiness advice to business partners on new system implementations and significant changes, including SDLC controls, while maintaining Internal Audit’s independence from implementing or operating controls.
Train and enable control owners on IT SOX expectations.
Report regularly on IT SOX progress, risks, and remediation to Internal Audit leadership and key stakeholders.
Lead risk-based technology audits, such as cloud security, cybersecurity, data governance, and AI governance, including planning, scoping, execution, and reporting.
Contribute to the IT audit plan, with the opportunity to own it over time.
Set standards for AI use across the audit lifecycle, including review, validation, and documentation of AI-assisted work.
Build reusable prompts, workflows, and automations, and coach the Sr. IT Internal Auditor on developing and using them.
Support automated control testing and continuous monitoring, using SQL or Python for full-population analysis where useful.
Assess risks of AI tools and agents in the financial reporting environment, including access, data handling, and change management.
Advise on control design for AI-driven processes, including AI agents and automated workflows affecting financial reporting.
Monitor technical literature, emerging trends, and best practices in IT audit and AI.
Perform other related duties as assigned.