IT SOX Scoping and Governance Analyst

Wise is hiring a full-time IT SOX Scoping and Governance Analyst to join its Security Controls team in London. The role is listed as on-site. The team tests, assesses and continuously improves technology-related controls across Wise's complex IT landscape, and this position focuses on defining and refining the scope of those controls.

The analyst reviews what is currently in IT SOX scope, covering applications and infrastructure, looking for duplicate, redundant or overbuilt IT general controls and application controls, and proposes improvements. When new systems come into scope, the analyst prepares risk and control matrices and identifies the controls each one needs. Other work includes documenting and maintaining end-to-end dependency maps that show upstream and downstream data flows, infrastructure links and automated interfaces, so management can review them. The role also supports control testing for design and operating effectiveness across cloud infrastructure and SaaS tools. The analyst explains SOX 404 requirements to stakeholders in finance, risk, security and platform teams.

The posting seeks three or more years of experience in tech risk or internal IT audit with a dedicated SOX focus. Candidates should be familiar with SOX 404, COSO and IT control standards such as NIST and ISO 27001, and ideally have been involved in an initial SOX audit cycle inside cloud-native environments. An understanding of how change management works in CI/CD pipelines plus a grasp of access control across microservices architectures is important. Hands-on exposure to AWS, Terraform, GitHub, Jira, Okta or SailPoint is preferred. The analyst should be able to judge the quality of a risk and control matrix and explain the compliance reasoning clearly to engineers.