Job Description

The Specialist role is a key member of the Governance, Risk and Compliance (GRC) team within Cybersecurity and Digital Trust (CDT). The position is responsible for supporting Amgen's Information Technology Sarbanes-Oxley (SOX) Compliance program, with primary responsibilities across SOX IT General Controls (ITGCs) and SOX Key Reports.

The Specialist will partner with IT SOX Compliance leadership, system and service owners, engineers, developers, Finance, Compliance, Corporate Audit, and Internal and External Audit teams to support the design, execution, monitoring, validation, and continuous improvement of SOX IT controls and key reports.

The role requires a strong understanding of IT controls combined with the technical ability to analyze systems, applications, report logic, data flows, queries, and supporting technologies to ensure SOX controls and reports are appropriately designed, documented, operated, and supported.

Key Responsibilities

SOX ITGC Controls

·   Support the execution and ongoing management of the ITGC SOX Controls and Compliance program.

·   Coordinate and support quarterly and annual SOX certification activities with control owners, process owners, system owners, and other stakeholders.

·   Review control documentation and supporting evidence to assess control execution, identify potential gaps, and ensure SOX requirements are appropriately addressed.

·   Partner with control owners to strengthen control design, documentation, evidence quality, and operational effectiveness.

·   Participate in SOX walkthroughs with system, service, process, and control owners.

·   Support Internal and External Audit evidence requests, testing inquiries, walkthroughs, and remediation activities.

·   Review SOX systems and applications within the Configuration Management Database (CMDB) to assess SOX applicability and ensure relevant system components and dependencies are appropriately identified.

·   Assess IT audit findings, identify relevant mitigating controls, support root cause analysis, and coordinate remediation activities through completion.

·   Support the design, implementation, and effectiveness of SAP GRC SOX ITGC controls, including Logical Access, Segregation of Duties (SoD), and Emergency Access.

·   Support SAP GRC processes such as Access Request, Risk Analysis, Role Management, user access lifecycle activities, and Emergency Access.

·   Support key access controls including role reviews, privileged access monitoring, access governance, and related issue remediation.

·   Partner with IT Security, SAP Basis, application teams, and other technology stakeholders to ensure appropriate implementation and operation of controls across SAP ECC, S/4HANA, and integrated systems.

·   Develop and maintain SOX guidance, procedures, training materials, and educational resources to support control and process owners.

·   Promote compliance by design by partnering with IT teams to embed appropriate controls within technology processes and solutions.

SOX Key Reports Analysis & Validation

·   Serve as a key contributor to the SOX Key Reports program for system-generated reports relied upon in the execution of SOX controls.

·   Perform technical analysis of report logic, including application code, queries, scripts, calculations, configurations, data transformations, and report parameters.

·   Validate the completeness and accuracy of SOX Key Reports by reconciling report outputs to source systems and underlying data.

·   Review custom-developed and configurable report logic, including technologies such as SAP ABAP, SQL, ERP reporting tools, and other financial applications.

·   Analyze and interpret technical artifacts including SQL queries, stored procedures, ETL logic, interfaces, application code, and data transformations.

·   Recreate or independently generate report outputs, where applicable, using reviewed queries, application logic, or ERP report code to validate report accuracy.

·   Perform report tie-outs between reports provided by Process Owners and independently generated outputs.

·   Reconcile record counts, key data fields, financial totals, parameters, and reporting periods between source data and report outputs.

·   Confirm report parameters, filters, date ranges, calculations, and report logic align with the intended SOX control objective.

·   Verify whether manual manipulation or post-extraction adjustments have been applied to system-generated reports and assess their impact.

·   Investigate and document variances identified during report validation and ensure explanations and resolutions are appropriately supported.

·   Identify potential gaps, defects, or risks associated with report logic, data integrity, interfaces, system changes, or report generation.

·   Support remediation and re-testing when key report logic, documentation, or report outputs do not meet SOX requirements.

·   Partner with system owners, developers, Process Owners, Finance, Compliance, and Audit teams to understand report design, data flows, system dependencies, and control requirements.

·   Ensure SOX Key Reports meet applicable documentation and testing expectations, including completeness, accuracy, access, and change management considerations.

Audit, Risk & Compliance Support

·   Serve as a knowledgeable point of contact for Internal and External Audit inquiries related to ITGC controls and SOX Key Reports.

·   Prepare and provide clear, complete, and timely audit evidence, technical explanations, reconciliations, and supporting documentation.

·   Participate in walkthroughs, audit testing, remediation discussions, and re-testing activities.

·   Work with stakeholders to identify control or report deficiencies, evaluate associated risks, and drive issues through remediation.

·   Ensure quality, completeness, and timeliness across assigned SOX and compliance deliverables.

·   Maintain awareness of changing technology environments, implementation methodologies, regulatory expectations, and emerging technologies that may impact IT controls and compliance.

·   Identify opportunities to improve and automate SOX compliance, control monitoring, evidence collection, report validation, and related processes.

Technical Skills & Experience

·   Strong understanding of SOX IT General Controls, IT controls, control design, control testing, and audit principles.

·   Experience supporting SOX compliance, IT audit, IT risk, Information Security controls, or technology control assurance.

·   Experience working with ERP platforms such as SAP S/4HANA, SAP ECC, Oracle, Workday, and/or PeopleSoft.

·   Ability to review and understand queries, scripts, application logic, and report code; experience with SQL, SAP ABAP, Python, or similar technologies is preferred.

·   Understanding of data flows, system interfaces, ETL processes, access controls, and change management.

·   Experience with data analysis and reconciliation tools such as Alteryx, Python, Oracle SQL Developer, or similar technologies is preferred.

·   Working knowledge of IT infrastructure, ITIL, SDLC, Agile, and/or DevOps methodologies.

·   Experience with Governance, Risk and Compliance tools such as AuditBoard, SAP GRC, ServiceNow IRM, or similar platforms.

·   Experience with financial systems or applications such as Anaplan and Model N is an advantage.

·   Knowledge of Information Security and Information Governance principles and relevant industry frameworks and standards.

·   Experience supporting Internal and External Audit teams, including experience communicating with external auditors.

·   Financial controls, financial reporting, or Big Four IT Audit/SOX advisory experience is an advantage.

Key Competencies

·   Strong analytical, technical, and problem-solving skills.

·   Strong attention to detail with a focus on accuracy, quality, and complete documentation.

·   Ability to translate complex technical concepts, system logic, and data flows into clear business and control language.

·   Strong written and verbal communication skills, including the ability to communicate technical and compliance matters to both technical and non-technical audiences.

·   Strong organizational, planning, and prioritization skills with the ability to manage multiple deliverables and deadlines.

·   Demonstrated ownership and accountability with the ability to independently drive activities through completion.

·   Ability to work effectively across IT, Information Security, Finance, Compliance, Audit, and business teams in a global environment.

·   Strong collaboration and stakeholder-management skills.

·   Ability to work effectively in a fast-paced environment and navigate complexity and ambiguity.

·   Technical curiosity and willingness to understand new technologies, systems, processes, and emerging compliance risks.

·   Team-oriented approach with a focus on achieving overall program and organizational objectives.

Basic Qualifications

Master's degree

OR

Bachelor's degree and 2 years of Information Systems experience

OR

Associate's degree and 6 years of Information Systems experience

OR

High school diploma/GED and 8 years of Information Systems experience.

Preferred Qualifications

·   8+ years of experience in IT Audit, SOX compliance, Information Technology/Security control assurance, enterprise IT compliance, or a related field.

·   Experience supporting SOX ITGC controls and/or SOX Key Report validation.

·   Experience working in large, global corporate environments involving multiple business and technology functions.

·   Experience within biotechnology, pharmaceutical, healthcare, or another regulated industry is preferred.

·   Experience with SAP environments, including SAP S/4HANA, ECC, and SAP GRC.

·   Experience reviewing report logic, source data, queries, scripts, and system-generated reports.

·   Knowledge of Information Security standards and frameworks such as ISO 27001/27002, NIST, or comparable frameworks.

·   Experience working within Agile and/or DevOps environments.

·   Strong presentation and stakeholder communication skills.

Industry-recognized certifications are preferred, including:

·   Certified Information Systems Auditor (CISA)

·   Certified Information Security Manager (CISM)

·   Certified Information Systems Security Professional (CISSP)

·   SANS Global Information Assurance Certification (GIAC)