Senior SOX Analyst

Steelcase Inc.•Grand Rapids, MI

2d•$100,000 - $110,000•Hybrid

About The Position

The Senior SOX Analyst leads the maintenance and execution of IT controls and compliance programs to meet regulatory requirements, improve the organization’s risk posture, and support strategic initiatives. The role coordinates SOX compliance, General IT Controls (GITCs), data privacy requirements, and third-party risk management, and serves as a primary liaison among IT, business stakeholders, and internal and external audit partners. The position conducts risk assessments and reviews, maintains and enhances the enterprise IT risk register, communicates risks and control issues to leadership, and works with control owners to ensure controls are designed, documented, tested, and operating effectively. It also manages workflows in Governance, Risk, and Compliance (GRC) platforms, supports compliance awareness and training, and contributes thought leadership and mentoring to advance organizational governance, risk, compliance, and control capabilities. The role calls for a collaborative, proactive problem solver who can translate technical and compliance concepts into practical actions for stakeholders across IT, Security, Finance, Legal, Privacy, and business teams. Steelcase describes a flexible hybrid schedule, with the office expected to be the primary place of work, balanced with employee choice and control. Applicants must be authorized to work in the United States on a full-time basis; Steelcase will not sponsor work authorization or visas.

Requirements

Bachelor’s degree in Computer Science, Information Systems, Finance, Accounting, or a related field, or equivalent experience.
Five or more years of experience in Information Systems Audit, IT Risk Assurance, Internal Audit, External Audit, or a related discipline.
Five or more years of experience supporting SOX compliance, Internal Control over Financial Reporting (ICFR), and PCAOB standards.
Experience designing, testing, evaluating, and improving IT controls in complex enterprise environments.
Strong knowledge of governance, risk, and compliance frameworks, including SOX, NIST CSF, COBIT, GDPR, CCPA, and related standards.
Strong analytical and problem-solving skills, including the ability to evaluate large amounts of information and communicate meaningful insights.
Excellent interpersonal and communication skills, including the ability to explain technical concepts to non-technical audiences.
Authorization to work in the United States on a full-time basis; Steelcase will not provide support for or sponsor work authorization or visas.

Nice To Haves

Professional certifications such as CISA, CISSP, CRISC, CISM, or related credentials.
Experience with cloud environments, legacy on-premises technologies, and complex enterprise architectures.
Experience reporting compliance and risk assessment results to leadership through clear and effective written communication.
Experience with GRC platforms and workflow management.
Experience supporting privacy programs and regulatory requirements, including GDPR, CCPA, or similar frameworks.
Experience with third-party risk management and vendor assessments.
Experience collaborating with external auditors and consulting firms, including Big Four audit organizations.
Strong facilitation and stakeholder management skills across multiple business functions.
Proficiency with Microsoft Office tools, including Word and Excel.
SQL experience.
Self-motivation, a continuous learning mindset, and the ability to adapt in a fast-moving environment.

Responsibilities

Lead the maintenance and execution of IT controls and compliance programs to meet regulatory requirements, improve risk posture, and support strategic initiatives.
Own and coordinate activities related to SOX compliance, General IT Controls (GITCs), data privacy requirements, and third-party risk management.
Serve as a primary liaison between IT, business stakeholders, and internal and external audit partners for audit, risk, and compliance activities.
Conduct risk assessments, framework assessments, policy and procedure reviews, operational reviews, vendor evaluations, contract reviews, and audit activities.
Maintain and enhance the enterprise IT risk register; identify emerging risks, recommend mitigation strategies, and track remediation efforts.
Communicate risk, compliance, and control issues to leadership and help develop action plans to address identified gaps.
Work with control owners to ensure controls are appropriately designed, documented, tested, and operating effectively.
Manage workflows in GRC platforms supporting controls, risk, privacy, compliance, and audit activities.
Support employee compliance awareness, education, and training initiatives.
Provide thought leadership to advance governance, risk, compliance, and control maturity across the organization.
Mentor peers and build organizational capability through knowledge sharing and collaboration.