Business Analyst (Specialist)

Job Title: Business Analyst – IT Compliance & Risk Management
Location: Calgary, AB
Department: IS Performance

Job Summary:
We are seeking a skilled and detail-oriented Business Analyst with expertise in IT compliance, risk management, and financial reporting systems to support our Sarbanes-Oxley (SOX) IT compliance efforts. The ideal candidate will have strong technical knowledge in IT General Controls (ITGCs), SOX compliance frameworks, and risk management methodologies. You will play a pivotal role in evaluating and enhancing our IT controls, ensuring that systems and processes adhere to required compliance standards. Your ability to analyze complex IT environments, identify control gaps, and provide actionable insights will be critical to ensuring the effectiveness of our internal controls and operational processes.

Key Responsibilities:

1. IT Control Evaluation & Risk Management:
   • Evaluate the effectiveness of IT General Controls (ITGCs), including access management, change management, backup & recovery, and system operations.
   • Assess financial reporting risks related to IT and implement risk mitigation strategies.
   • Conduct control testing and identify deficiencies, providing solutions for remediation.
   • Perform root cause analysis of issues and recommend corrective actions to enhance compliance.
2. SOX Compliance & Audit Support:
   • Ensure IT systems and processes are compliant with Sarbanes-Oxley (SOX 404) requirements, focusing on IT control frameworks.
   • Support internal and external audits by preparing and reviewing audit documentation, evidence, and reports.
   • Review and ensure alignment with compliance frameworks such as COSO, COBIT, NIST, and ISO 27001.
   • Maintain and update documentation on SOX controls and compliance activities.
3. Identity & Access Management (IAM):
   • Oversee user access reviews (UARs), role-based access control (RBAC), and privileged access management (PAM) to ensure compliance with security standards.
   • Manage IAM processes and tools such as SailPoint and Okta to ensure efficient and secure access control management.
4. Data Analytics & Reporting:
   • Use tools such as Excel, Power BI, SQL, and GRC platforms (e.g., ServiceNow GRC, AuditBoard) to analyze IT control effectiveness.
   • Create and present regular reports on the status of IT compliance, audit findings, and remediation progress.
5. Collaboration & Cross-Functional Coordination:
   • Work closely with IT, Finance, Security, and Internal Audit teams to ensure alignment on compliance activities.
   • Communicate audit findings and recommendations clearly to non-technical stakeholders.
6. Process Improvement & Automation:
   • Identify opportunities for process improvements in SOX IT compliance procedures, particularly through automation.
   • Leverage tools like RPA (UiPath, Automation Anywhere) to streamline compliance activities and improve efficiency.

Required Skills & Qualifications:

1. Technical Expertise:
   • Strong understanding of IT General Controls (ITGCs) and IT compliance frameworks (COSO, COBIT, NIST, ISO 27001).
   • Familiarity with SOX compliance requirements and financial system controls (SAP, Workday).
   • Experience with Identity & Access Management (IAM) tools (e.g., SailPoint, Okta) and methodologies.
   • Proficiency in Excel (pivot tables, VLOOKUP), SQL, and Power BI for data analysis and reporting.
   • Experience with GRC platforms like ServiceNow GRC, AuditBoard, RSA Archer, ZenGRC.
2. Analytical & Problem-Solving Skills:
   • Ability to assess IT control design and effectiveness.
   • Strong critical thinking and problem-solving skills to identify and address compliance gaps.
   • Ability to perform issue remediation and recommend practical solutions.
3. Communication & Collaboration:
   • Exceptional communication skills to explain complex IT compliance concepts to non-technical audiences.
   • Proven ability to collaborate with cross-functional teams, including IT, Finance, and Internal Audit.
4. Project Management:
   • Experience managing SOX testing timelines, evidence collection, and remediation activities.
   • High attention to detail to ensure accuracy in audit reports and compliance documentation.

Preferred Qualifications:

1. Certifications:
   • Certified Information Systems Auditor (CISA), Certified Internal Auditor (CIA), or Certified in Risk and Information Systems Control (CRISC) certifications are highly desirable.
2. Additional Skills:
   • Familiarity with cloud compliance frameworks (AWS, Azure, GCP).
   • Experience with automation tools for compliance (RPA tools such as UiPath or Automation Anywhere).
   • Knowledge of cybersecurity best practices and their impact on SOX compliance.

With over 90 years' combined experience, NES Fircroft (NES) is proud to be the world's leading engineering staffing provider spanning the Oil & Gas, Power & Renewables, Chemicals, Construction & Infrastructure, Life Sciences, Mining and Manufacturing sectors worldwide. With more than 80 offices in 45 countries, we are able to provide our clients with the engineering and technical expertise they need, wherever and whenever it is needed. We offer contractors far more than a traditional recruitment service, supporting with everything from securing visas and work permits, to providing market-leading benefits packages and accommodation, ensuring they are safely and compliantly able to support our clients.