Senior Risk Management Engineer

Responsibilities

• Build and operate Grafana Labs’ IT SOX program, including scoping, risk assessment, control design, and testing across IT general controls (ITGCs) and key application controls tied to financial reporting.
• Execute walkthroughs, design and operating effectiveness testing, documentation, status tracking, deficiency identification, and remediation validation.
• Assess ITGCs and application controls across financial systems and cloud/SaaS environments, including NetSuite, Salesforce, and Workday.
• Maintain the IT SOX documentation library, including narratives, flowcharts, and IT risk-and-control matrices (RCMs), in an audit-ready state.
• Manage deficiency conversations with control owners and promote automated, scalable remediation.
• Own the relationship with external IT auditors and align testing methodologies and documentation with PCAOB standards.
• Use AI and automation to improve scoping, testing, continuous monitoring, and audit insights.
• Evaluate the IT control impact of new systems, tools, operations, and policies.
• Manage co-source partner resources while maintaining quality and consistency.
• Report IT SOX status, risks, deficiencies, and remediation to Internal Audit leadership and senior management.
• Help expand the function into broader technology and IT audit and eventually build and lead a team.

Requirements

• 10+ years of progressive experience in IT SOX compliance, IT audit, or IT risk advisory in Big 4 or similar organizations and/or in-house audit, compliance, or risk management.
• Hands-on expertise in COSO, SOX 404, ITGCs, ITACs, and PCAOB audit standards.
• Experience establishing, scaling, or transforming an IT SOX program, ideally in a pre-IPO or newly public SaaS environment.
• Experience auditing cloud-native and SaaS environments and modern business applications such as NetSuite, Salesforce, and Workday.
• Experience implementing or optimizing AI and automated compliance or audit capabilities.
• Knowledge of COSO, COBIT, NIST CSF, and ISO 27001.
• Experience with GRC or audit tools, or with building internal solutions.
• Strong project management, organization, prioritization, and stakeholder-influence skills.
• Ability to communicate technical risk clearly and influence without authority.
• High integrity, ownership, curiosity, and a continuous-improvement mindset.

Nice-to-haves

• CISA, CPA, CIA, or CISSP certification.
• Big 4 and in-house audit, compliance, or risk leadership experience.
• Experience in pre-IPO or newly public, high-growth, consumption-based SaaS companies.
• CPA, CISM, CRISC, or CGEIT certification.
• ISACA AAIA certification or demonstrated investment in AI governance and audit innovation.
• Experience expanding audit beyond SOX into technology, operational, or advisory assurance.
• Experience working in globally distributed organizations.

Compensation and Benefits

• U.S. base compensation range: $163,000–$195,000.
• Actual compensation varies based on level, experience, and skillset.
• Restricted Stock Units (RSUs) are included with all roles.
• The company is remote-only with a global culture, transparent communication, career growth opportunities, and in-person onboarding.