Senior Manager, SOX IT Compliance

Papa Johns•Atlanta, GA

About The Position

The Senior Manager of IT SOX Compliance leads Papa Johns’ enterprise-wide IT SOX compliance program and reports to the Director of SOX Compliance. The role focuses on governance, risk assessment, control design evaluation, and program oversight. The SOX team does not perform control testing; this position instead provides advisory support through program ownership, risk and control design oversight, coordination with control owners, remediation facilitation, training, and collaboration with Internal Audit and external auditors. The role partners with IT, Finance, Internal Audit, process owners, and other stakeholders to maintain effective control design and accountability. It oversees SOX documentation, scoping and risk assessments, SOC report reviews, deficiency remediation, and communication of program status and risks. The position also advises on the SOX implications of business initiatives, system implementations, SDLC controls, policy changes, and personnel changes, and supports control automation and continuous monitoring. Travel averages 15–20% annually, and the role works remotely with team members in multiple locations.

Requirements

Bachelor’s degree in Information Systems, Accounting, Finance, or a related field.
At least 8 years of relevant experience, including IT SOX, IT audit, or risk management at a public company or Big 4/public accounting firm.
Strong understanding of SOX 404, COSO, COBIT, and PCAOB standards.
Proficiency in annual and rolling SOX scoping based on risk factors and materiality.
Deep understanding of IT General Controls (ITGCs).
Ability to identify and assess application controls, key reports, and interface controls.
Skill in documenting IT processes, process and data flows, and risk and control matrices (RCMs).
Strong project management capabilities, including managing timelines, milestones, and dependencies.
Ability to review SOC 1 reports and assess reliance on third-party controls.
Ability to translate complex IT and control concepts into business-friendly language.
Excellent interpersonal, analytical, and problem-solving skills; team-oriented and process-focused approach.
Critical thinking skills and ability to complete tasks with an appropriate level of skepticism.
Ability to travel an average of 15–20% annually.
Ability to work remotely with team members in multiple locations.

Nice To Haves

Relevant professional certification preferred, such as CISA, CISSP, CISM, or CRISC.
Familiarity with ERP systems such as Oracle Cloud, NetSuite, or PeopleSoft.
Experience with audit software such as AuditBoard.

Responsibilities

Lead the company’s IT SOX compliance program to help mitigate financial reporting risks related to technology and data.
Advise on the SOX impact of new business initiatives, system implementations and SDLC controls, IT policy changes, and personnel changes.
Conduct and update risk assessments and SOX scoping, particularly for systems supporting financial reporting and revenue recognition.
Partner with IT, Finance, Internal Audit, and other cross-functional stakeholders to maintain control design and accountability.
Maintain and oversee SOX documentation, including risk and control matrices, process and data flows, and system diagrams.
Train and guide process owners, including by reviewing their processes and advising on IT General Controls, IT Operations, and SOC Reporting.
Facilitate deficiency management and remediation, from root cause analysis through readiness for retesting.
Support implementation of automation and continuous control monitoring as control enhancement efforts.
Manage review of SOC Reports and mapping to complementary user entity controls (CUECs).
Track and communicate program status, issues, and risks to the Director of SOX Compliance, including preparing reports for the SOX Steering Committee and Audit Committee.
Monitor emerging IT compliance risks, including cybersecurity threats that could affect SOX controls.
Perform other duties as assigned.