Controls Assurance Jobs (NOW HIRING)

This roleleadsthe design, execution, and continuous improvement of DePuy Synthes' IT controls, assurance, and (SOX) program within the Governance & Risk function of Cybersecurity.The Sr. Manager will own the enterprise IT SOX control framework, IT general controls (ITGCs), automated application controls, and IT-related assurance activities across financially relevant systems, cloud platforms, and third-party services. This position partners closely with Finance, Internal Audit, External Auditors, Application Owners, and Infrastructure teams to ensure a strong control environment,timelyremediation of deficiencies, and audit-ready operations as the company stands up as an independent, publicly traded entity.

Key Responsibilities

IT Controls & Assurance

• Own the enterprise IT control framework - including ITGCs (access, change, operations), automated application controls, and IT-dependent business controls - aligned to COBIT, COSO, NIST CSF, and internal policies

• Lead design and operating effectiveness assessments of IT controls across ERP, cloud, SaaS, and infrastructure platforms, and drive remediation ofidentifiedgaps

• Partner with application, cloud, and infrastructure teams to embed preventive and detective controls by design in the SDLC, DevOps pipelines, and cloud landing zones

• Extend the assurance program to third parties and managed service providers, including review of SOC 1/SOC 2 reports, complementary user entity controls (CUECs), and bridge letters

• Serve as the primary IT liaison for Internal Audit, External Auditors, and regulatory examiners - coordinating walkthroughs, evidence, testing, and management responses

• Advance continuous controls monitoring (CCM), analytics, and automation to expand control coverage and reduce manual testing effort

SOX

• Own the end-to-end IT SOX program - scoping, risk assessment, control design, management testing, deficiency evaluation, and reporting across in-scope financial systems and supporting IT infrastructure

• Define the annual IT SOX plan in partnership with Finance, Internal Audit, and External Auditors, including in-scope applications, ITGCs, key reports, and automated controls

• Lead management testing of ITGCs and IT-dependent business controls, ensuringtimelycompletion, quality of evidence, and consistent workpaper standards

• Drive deficiency evaluation, root cause analysis, remediation planning, and status reporting to leadership and the Audit Committee

• Stand up andoperatethe first-year SOX program for the standalone DePuy Synthes entity, including RCMs, narratives, and control ownership across the new operating model

• Modernize the SOX program through GRC tooling (e.g., ServiceNow IRM,AuditBoard, Archer), risk-based sampling, and automated evidence collection

Compliance

• Lead IT compliance activities across applicable regulatory, contractual, and internal policy requirements - including SOX, SEC,GxP, HIPAA, GDPR, and other data protection and industry regulations

• Maintain an integrated IT policy, standard, and control library, and drive alignment across Cybersecurity, IT, Legal, Privacy, and Compliance functions

• Track regulatory change, assess IT impact, and update controls, policies, and evidence to keep the environment continuously compliant

• Coordinate IT responses to customer, partner, and regulator due diligence requests, security questionnaires, and certification programs (e.g., ISO 27001, HITRUST where applicable)

• Assess compliance implications of emerging technologies (cloud, AI/ML, GenAI, automation) and update the control and compliance framework accordingly

• Provide training, guidance, and clear escalation paths to IT and business control owners to reinforce a strong compliance culture

Governance, Reporting & Team Leadership

• Provide regular reporting to the CISO, Director of Governance & Risk, Finance leadership, and the Audit Committee on IT controls, SOX status, and compliance posture

• Support Day-1 readiness and post-separation BAU operations for controls, assurance, SOX, and compliance across the standalone DePuy Synthes environment

• Build, lead, and develop a global team across the US and the GCC in India, and manage co-source/outsourced testing partners for quality, consistency, and efficiency

• Coach and mentor team members, fostering technical depth, audit acumen, and strong business partnership skills

Qualifications

Education:

• Bachelor's degree in Computer Science, Information Security, Business, Engineering, ora relatedfield (required).

• Master's degree in Cybersecurity, Information Systems, or Business Administration (preferred).

Experience and Skills:

Required:

• 10+ years of experience in IT audit, IT controls, SOX, or IT compliance, including experience in a Big 4 or large public company environment

• Deepexpertiseacross all three capability areas: IT Controls & Assurance, SOX (ITGCs and IT-dependent business controls), and IT Compliance

• Strong working knowledge of control and compliance frameworks - COBIT, COSO, NIST CSF, ISO 27001, and SOC 1/SOC 2

• Proven experience coordinating with External Auditors, Internal Audit, and business process owners on complex, multi-entity audits

• Demonstrated ability to evaluate control deficiencies, drive remediation, and communicate risk and compliance status to executive stakeholders

• Experience assessing IT controls and compliance in cloud environments (AWS, Azure, GCP) and across ERP and SaaS platforms

• Strong leadership, stakeholder management, and cross-functional collaboration skills, including managing global and co-sourced teams

Preferred:

• Experience supporting a separation, spin-off, IPO, or standalone company standing up its first-year SOX and compliance program

• Familiarity with SAP S/4HANA, Workday, Oracle, or other ERP platforms and their control configurations

• Experience with GRC platforms (e.g., ServiceNow IRM,AuditBoard, Archer) and continuous controls monitoring / audit analytics

• Background in healthcare, MedTech, pharmaceuticals, or other highly regulated industries

• Familiarity with regulatory and privacy requirements relevant to IT - SOX, SEC,GxP, HIPAA, GDPR, and emerging AI regulations

Other:

• Language: Englishproficiencyrequired

• Travel: Up to 15% domestic and international travel

• Certifications (preferred): CISA, CPA, CIA, CISSP, or equivalent

For more information on how we support the whole health of our employees throughout their wellness,careerand life journey, please visitwww.careers.jnj.com.