Manager, IT SOX

Klaviyo • San Francisco, CA

22h • $124,000 - $186,000

About The Position

Klaviyo is seeking an experienced Manager, IT SOX to lead its IT SOX program and technology audits within the Internal Audit function. The role focuses on IT SOX controls—including IT General Controls, IT application controls, and key reports—across homegrown and third-party systems, as well as risk-based technology audits. The successful candidate will be a hands-on leader who develops others, uses AI in day-to-day audit work, and thrives in a fast-paced, evolving environment.

The Manager reports to the VP of Internal Audit & Compliance and manages and coaches the Sr. IT Internal Auditor day to day. The role works with stakeholders across IT, Security, Business Intelligence, Finance, Accounting, Legal, People Operations, Engineering, and Global Technology Solutions. It also oversees co-sourced IT testing and coordinates with external auditors, third-party providers, and internal partners.

The role owns the annual IT SOX plan and leads end-to-end program execution, including risk assessment, scoping, control testing, deficiency remediation, readiness advisory, and status reporting. It also leads risk-based technology audits and helps develop the IT audit plan. As part of Klaviyo’s AI-first audit approach, the Manager sets standards for responsible use and validation of AI in audit work, develops reusable prompts and workflows, supports automated testing and continuous monitoring, and assesses AI-related risks and controls affecting financial reporting.

The position requires a bachelor’s degree in a relevant field and at least eight years of IT audit experience, including IT SOX controls testing. CISA is preferred; CPA, CIA, or CISSP is a plus. The role may require up to 10% travel. The listed U.S. base pay range is $124,000–$186,000.

Requirements

• Bachelor’s degree in Information Systems, Computer Science, Accounting, Business, or another relevant field.
• At least 8 years of IT audit experience in public accounting and/or industry, including IT SOX controls testing; experience in a Tech/SaaS environment is ideal.
• Experience leading planning, scoping, testing, and reporting for a full-year IT SOX program.
• Experience leading technology audits, such as cloud, cybersecurity, or data governance audits.
• Experience managing or coaching auditors and/or co-sourced resources.
• Strong understanding of SOX 404, PCAOB Auditing Standards, COSO 2013, COBIT, US GAAP, and Internal Audit Standards.
• Deep understanding of ITGCs, IT application controls, interfaces, key reports, segregation of duties, and SOC 1 reviews for homegrown and off-the-shelf applications and cloud environments.
• Experience auditing modern engineering environments, including CI/CD pipelines, access defined in code, and automated data pipelines.
• Ability to use AI in audit work and understand its limitations, including accuracy, confidentiality, and over-reliance.
• Excellent written and verbal communication skills, including the ability to influence stakeholders and explain technical concepts clearly.
• Strong analytical and problem-solving skills, attention to detail, and an investigative mindset.
• Excellent project management skills working with cross-functional teams.
• Data analytics skills and experience with SQL, Python, Tableau, or other analytics or visualization tools.
• Professional audit-relevant certification; CISA is preferred, while CPA, CIA, or CISSP is a plus.
• Comfort working in a fast-paced, high-growth environment.

Nice To Haves

• Experience in a Tech/SaaS environment.
• Experience using SOX GRC tools such as Optro (formerly AuditBoard) and ERP systems such as NetSuite.
• Working knowledge of AI governance frameworks such as NIST AI RMF or ISO/IEC 42001, or AI audit credentials such as ISACA AAIA.
• CISA certification preferred.
• CPA, CIA, or CISSP certification.

Responsibilities

• Own the annual IT SOX plan, including risk assessment, scoping of in-scope systems, and alignment with the external auditor on reliance and timing.
• Scale and rationalize IT SOX scope as Klaviyo’s systems and business evolve.
• Lead end-to-end IT SOX execution across ITGCs, IT application controls, system interfaces and integrations, key reports/IPE, and segregation of duties across homegrown applications and third-party SaaS.
• Maintain the ITGC risk and control matrix in Optro.
• Review SOC 1 reports, complementary user entity controls, and bridge letters for in-scope vendors.
• Evaluate IT deficiencies, including root cause and severity, and drive remediation through closure.
• Coordinate co-sourced providers, external auditors, and internal business partners to align and complete IT SOX work on time.
• Provide SOX readiness advisory for new system implementations and significant changes, including SDLC controls, while maintaining Internal Audit’s independence from implementing or operating controls.
• Train and enable control owners on IT SOX expectations.
• Report IT SOX progress, risks, and remediation to Internal Audit leadership and key stakeholders.
• Lead risk-based technology audits, including planning, scoping, execution, and reporting.
• Contribute to the IT audit plan, with the opportunity to own it over time.
• Set standards for AI use across the audit lifecycle, including review, validation, and documentation of AI-assisted work.
• Build reusable prompts, workflows, and automations, and coach the Sr. IT Internal Auditor in developing and using them.
• Support automated control testing and continuous monitoring, using SQL or Python for full-population analysis where valuable.
• Assess AI tool and agent risks in financial reporting, including access, data handling, and change management.
• Advise on control design for AI-driven processes that affect financial reporting.
• Monitor technical literature, emerging trends, and best practices in IT audit and AI.
• Manage and coach the Sr. IT Internal Auditor, including setting priorities, reviewing workpapers, and providing feedback and development.
• Oversee co-sourced IT testing and review workpapers for quality and consistency.
• Perform other related duties as assigned.

Benefits

• The total compensation package may include participation in the company’s annual cash bonus plan.
• Equity may be included in the total compensation package.
• Sign-on payments may be included in the total compensation package.
• Comprehensive health, welfare, and wellbeing benefits based on eligibility.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager