Platform SOX Risk Analyst

About this job

Total Number of Openings

1The Platform SOX Risk Analyst provides analysis, oversight, constructive challenge, and compliance support for information technology controls that support internal control over financial reporting. The role partners with platform leaders, control owners, control performers, Internal Controls, Finance, audit teams, and cybersecurity stakeholders to evaluate control design and operating effectiveness, enforce evidence and execution requirements, identify and communicate deficiencies, and drive timely, sustainable remediation. The position also supports broader platform cybersecurity risk-management activities while maintaining primary accountability for SOX-IT compliance analysis and control enforcement.

About the Company

The Chevron Engineering and Innovation Excellence Center (ENGINE) in Bengaluru India brings together the resources and expertise of the Chevron global network with talent in India to enhance agility and technological innovation to optimize solutions for the world’s current and future energy challenges. As one of the leading energy providers worldwide, Chevron is involved in the production of crude oil and natural gas, manufacturing of transportation fuels, lubricants, petrochemicals, and additives, and the development of enabling technologies.

Chevron's vision is to be the global energy company most admired for its people, partnerships, and performance. With a clear purpose to develop affordable, reliable, ever-cleaner energy that enables human progress, we believe human ingenuity has the power to solve any challenge and overcome any obstacle. Meeting the world’s growing energy needs requires the pursuit of innovations and advancements that deliver a better future for all.

About the Position

This role will report into the IT Risk Manager at Chevron Engine, India.

SOX Compliance Analysis and Enforcement of IT Controls

• Analyze and monitor compliance with SOX 404 requirements for assigned IT processes, applications, platforms, and Process 20 General IT Controls.
• Evaluate whether assigned controls are appropriately designed to mitigate identified financial-reporting risk and whether controls operate as designed.
• Assess local application of global control designs; review control performance, evidence, test results, and documentation for completeness, accuracy, and supportability to third parties.
• Apply appropriate testing methods and population and sampling concepts; analyze results and identify design or operating deficiencies.
• Enforce control requirements by challenging incomplete, insufficient, late, or noncompliant execution and escalating unresolved compliance gaps through established governance channels.
• Analyze and validate the impact of ineffective controls; support root-cause analysis, quantification, remediation planning, retesting, and closure of deficiencies.
• Monitor remediation plans and retesting efforts for ineffective controls and verify that corrective actions are sustainable and completed within required timeframes.
• Coordinate and complete SOX reporting requirements; monitor testing activities and communicate progress, exceptions, and emerging concerns to relevant stakeholders.
• Maintain accurate SOX documentation, including control narratives, risk/control matrices, flowcharts, testing support, evidence, and remediation records, in accordance with applicable retention requirements.
• Use SOX reporting and analytics capabilities to evaluate assessment accuracy and completeness, detect trends, and support management reporting.
• Participate in annual scoping and risk reviews, including consideration of changes to business processes, applications, systems, organizations, and major projects.
• Advise control owners and performers on evidence requirements, control execution expectations, and remediation of ineffective controls; identify training needs and reinforce consistent SOX testing practices.

IT…