Manager, IT SOX

Klaviyo•San Francisco, CA

About The Position

Klaviyo is seeking an experienced Manager, IT SOX to lead its IT SOX program and technology audits within the Internal Audit function. The role focuses on IT SOX controls—including IT general controls, application controls, and key reports—across homegrown and third-party systems, as well as risk-based technology audits. The Manager will partner with stakeholders across IT, Security, Business Intelligence, Finance, Accounting, Legal, People Operations, Engineering, and Global Technology Solutions. The role reports to the VP of Internal Audit & Compliance and includes day-to-day management and coaching of the Sr. IT Internal Auditor, plus oversight of co-sourced IT testing. The role owns the annual IT SOX plan and end-to-end program execution, advises business partners on SOX readiness for new systems and significant changes, and coordinates with external auditors and co-sourced providers. It also leads risk-based technology audits and helps shape the IT audit plan. As part of Klaviyo’s effort to build an AI-first audit function, the Manager will establish standards for AI-assisted audit work, build reusable prompts and workflows, support automated testing and continuous monitoring, and assess AI-related risks in financial reporting processes. The successful candidate is a hands-on, AI-fluent leader who coaches others, communicates technical concepts clearly, and is comfortable in a fast-paced, evolving environment. The work involves prolonged periods sitting at a desk and using a computer, with occasional travel.

Requirements

Bachelor’s degree in Information Systems, Computer Science, Accounting, Business, or another relevant field.
At least 8 years of IT audit experience in public accounting and/or industry, including IT SOX controls testing; experience in a technology or SaaS environment is ideal.
Experience managing or coaching auditors and/or co-sourced resources.
Professional audit-relevant certification; CISA is preferred, while CPA, CIA, or CISSP is a plus.
Experience leading planning, scoping, testing, and reporting for a full-year IT SOX program.
Experience leading technology audits, such as cloud, cybersecurity, or data governance audits.
Strong understanding of SOX 404, PCAOB Auditing Standards, COSO 2013, COBIT, US GAAP, and Internal Audit Standards.
Deep understanding of IT general controls, IT application controls, interfaces, key reports, segregation of duties, and SOC 1 reviews for homegrown and off-the-shelf applications and cloud environments such as AWS.
Experience auditing modern engineering environments, including CI/CD pipelines, access defined in code, and automated data pipelines.
Excellent written and verbal communication skills, including the ability to influence stakeholders and explain technical concepts clearly.
Exceptional analytical and problem-solving skills, attention to detail, and an investigative mindset focused on root causes.
Excellent project management skills working with cross-functional teams.
Data analytics skills and experience with SQL, Python, Tableau, or other analytics or visualization tools.
Experience using AI in audit work and understanding its limitations, including accuracy, confidentiality, and over-reliance.
Comfort working in a fast-paced, high-growth environment.

Nice To Haves

Experience in a technology or SaaS environment.
Experience using SOX GRC tools such as Optro (formerly AuditBoard) and ERP systems such as NetSuite.
Working knowledge of AI governance frameworks such as NIST AI RMF or ISO/IEC 42001.
AI audit credentials such as ISACA AAIA.
CPA, CIA, or CISSP certification.

Responsibilities

Own the annual IT SOX plan, including risk assessment, in-scope system scoping, and alignment with the external auditor on reliance and timing.
Scale and rationalize IT SOX scope as the company’s systems and business evolve.
Lead end-to-end IT SOX execution across IT general controls, application controls, interfaces and integrations, key reports and information produced by the entity, and segregation of duties across homegrown applications and third-party SaaS.
Maintain the ITGC risk and control matrix in Optro.
Review SOC 1 reports, complementary user entity controls, and bridge letters for in-scope vendors.
Evaluate IT deficiencies, including root cause and severity, and drive remediation through closure with control owners.
Coordinate co-sourced providers, external auditors, and internal business partners to support aligned and timely IT SOX work.
Provide SOX readiness advice for new system implementations and significant changes, including SDLC controls, while maintaining Internal Audit’s independence from control implementation and operation.
Train and enable control owners on IT SOX expectations.
Report IT SOX progress, risks, and remediation to Internal Audit leadership and key stakeholders.
Manage and coach the Sr. IT Internal Auditor day to day, including setting priorities, reviewing workpapers, and providing feedback and development.
Oversee co-sourced IT testing and review workpapers for quality and consistency.
Lead risk-based technology audits, including planning, scoping, execution, and reporting.
Contribute to the IT audit plan, with the opportunity to own it over time.
Set standards for AI use across the audit lifecycle, including review, validation, and documentation of AI-assisted work.
Build reusable prompts, workflows, and automations, and coach the Sr. IT Internal Auditor in using them.
Support automated control testing and continuous monitoring, using SQL or Python for full-population analysis where valuable.
Assess AI tool and agent risks in financial reporting, including access, data handling, and change management.
Advise on control design for AI-driven processes, including agents and automated workflows affecting financial reporting.
Monitor technical literature, emerging trends, and best practices in IT audit and AI.
Perform other related duties as assigned.