SOX & Internal Controls Compliance IT Manager, CoStar Group - Arlington, VA

CoStar Group•Arlington, VA

2d•Onsite

About The Position

CoStar Group is a leading global provider of commercial and real estate information, analytics, and online marketplaces. We are seeking a SOX & Internal Controls Compliance IT Manager to support Sarbanes-Oxley (“SOX”) compliance, internal controls, and enterprise risk management (“ERM”) assessments. This role involves implementing SOX compliance programs, conducting risk assessments, documenting processes, assessing controls, evaluating deficiencies, and developing remediation plans. The manager will also execute IT risk management activities, ensure robust IT General Controls, oversee user access reviews, and coordinate with IT and Information Security. The position requires assessing technology risks associated with ERP, SaaS, and cloud platforms, creating presentations for stakeholders, and delivering efficient approaches to information security and change management. Data analytics will be used to enhance control assessments, and collaboration across technology, accounting, finance, and operations teams is essential.

Requirements

Bachelor's degree required in Information Systems, Accounting, Finance, or related field from an accredited, not-for-profit, in-person college/university.
A track record of commitment to prior employers.
7-8+ years of professional services experience with applicable IT risk management and internal controls experience.
Track record of technical expertise with SOX, IT risk management and internal controls assessments.
Deep knowledge of SOX compliance and PCAOB requirements: SOX 404 and COSO framework, IT General Controls (ITGCs), Segregation of duties architecture, ERP and financial systems governance.
Experience implementing and assessing controls over highly automated business processes.
Knowledge of emerging technology risks, including cloud computing, agile development, cybersecurity, and privacy.
Knowledge of best practices for authentication, authorization and change management.
Ability to manage and prioritize assignments while meeting deadlines and maintaining attention to detail.
Excellent analytical, problem-solving, and critical thinking skills to assess complex IT risks and identify appropriate control enhancements.
Exceptional verbal and written communication skills, with the ability to effectively communicate technical concepts to non-technical stakeholders.
Experience in a publicly traded company ($1B+ revenue) or Big 4 experience required.

Nice To Haves

One or more of the following risk related certifications is preferred: CPA, CIA, CISA, or CISSP.
7-8+ years of experience in IT auditing, or IT compliance or IT risk management, preferably within a large organization or a public accounting firm.
Knowledge and application of IT controls and governance frameworks such as SOC 1/2, COBIT, NIST (CSF, 800-53, and 800-171), ITIL, ISO 27001/2, and best practices.
Experience on ERP applications such as Oracle Cloud.
Proven experience in executing technology audits, including evaluating IT general controls, application controls, and data integrity.
Global, multi-entity experience preferred.

Responsibilities

Support Sarbanes-Oxley (“SOX”) compliance, internal controls, and enterprise risk management (“ERM”) assessments.
Assist with implementing the SOX compliance programs, including conducting risk assessments and system scoping.
Conduct walkthroughs and document end-to-end technology processes, identifying risks and key controls, using narratives.
Document and assess the design and effectiveness of key IT general controls (“ITGC”) and IT application controls (“ITAC”).
Execute testing to validate the operating effectiveness of controls.
Evaluate controls deficiencies to determine impact and significance.
Identify and implement effective and efficient plans to remediate control deficiencies.
Summarize and document results of work performed including management reporting.
Execute internal controls and IT risk management activities to support our risk management initiatives.
Ensure robust IT General Controls over: Logical access management, Role-based security and segregation of duties, Change management, System interfaces and data integrity, Configuration controls.
Oversee periodic user access reviews and segregation of duties analyses.
Coordinate with IT and Information Security to align financial systems governance with enterprise cybersecurity standards.
Assess technology risks and internal control solutions associated with ERP, SaaS, IT infrastructure and cloud platforms.
Create and deliver presentations on technical concepts, project work plans, delivery approach, milestones, and results to key stakeholders.
Deliver efficient and effective approaches to implement and assess risks relating to information security and change management.
Implement data analytics to enhance approaches to internal control assessments.
Work effectively across different groups within the company (technology, accounting, finance, operations).

Benefits

Generous compensation and performance-based incentives.
Internal training and tuition reimbursement.
Comprehensive healthcare coverage: Medical / Vision / Dental / Prescription Drug.
Life, legal, and supplementary insurance.
Virtual and in person mental health counseling services for individuals and family.
Commuter and parking benefits.
401(K) retirement plan with matching contributions.
Employee stock purchase plan.
Paid time off.
Tuition reimbursement.
On-site fitness center and/or reimbursed fitness center membership costs (location dependent).
Access to CoStar Group’s Diversity, Equity, & Inclusion Employee Resource Groups.
Complimentary gourmet coffee, tea, hot chocolate, fresh fruit, and other healthy snacks.