SOX ITGC Controls & SOX Key Reports

Career Category Engineering Job Description Job Description The Specialist role is a key member of the Governance, Risk and Compliance (GRC) team within Cybersecurity and Digital Trust (CDT). The position is responsible for supporting Amgen's Information Technology Sarbanes-Oxley (SOX) Compliance program, with primary responsibilities across SOX IT General Controls (ITGCs) and SOX Key Reports. The Specialist will partner with IT SOX Compliance leadership, system and service owners, engineers, developers, Finance, Compliance, Corporate Audit, and Internal and External Audit teams to support the design, execution, monitoring, validation, and continuous improvement of SOX IT controls and key reports. The role requires a strong understanding of IT controls combined with the technical ability to analyze systems, applications, report logic, data flows, queries, and supporting technologies to ensure SOX controls and reports are appropriately designed, documented, operated, and supported.

Key Responsibilities SOX ITGC Controls · Support the execution and ongoing management of the ITGC SOX Controls and Compliance program. · Coordinate and support quarterly and annual SOX certification activities with control owners, process owners, system owners, and other stakeholders. · Review control documentation and supporting evidence to assess control execution, identify potential gaps, and ensure SOX requirements are appropriately addressed. · Partner with control owners to strengthen control design, documentation, evidence quality, and operational effectiveness. · Participate in SOX walkthroughs with system, service, process, and control owners. · Support Internal and External Audit evidence requests, testing inquiries, walkthroughs, and remediation activities. · Review SOX systems and applications within the Configuration Management Database (CMDB) to assess SOX applicability and ensure relevant system components and dependencies are appropriately identified. · Assess IT audit findings, identify relevant mitigating controls, support root cause analysis, and coordinate remediation activities through completion. · Support the design, implementation, and effectiveness of SAP GRC SOX ITGC controls, including Logical Access, Segregation of Duties (SoD), and Emergency Access. · Support SAP GRC processes such as Access Request, Risk Analysis, Role Management, user access lifecycle activities, and Emergency Access. · Support key access controls including role reviews, privileged access monitoring, access governance, and related issue remediation. · Partner with IT Security, SAP Basis, application teams, and other technology stakeholders to ensure appropriate implementation and operation of controls across SAP ECC, S/4HANA, and integrated systems. · Develop and maintain SOX guidance, procedures, training materials, and educational resources to support control and process owners. · Promote compliance by design by partnering with IT teams to embed appropriate controls within technology processes and solutions. SOX Key Reports Analysis & Validation · Serve as a key contributor to the SOX Key Reports program for system-generated reports relied upon in the execution of SOX controls. · Perform technical analysis of report logic, including application code, queries, scripts, calculations, configurations, data transformations, and report parameters. · Validate the completeness and accuracy of SOX Key Reports by reconciling report outputs to source systems and underlying data. · Review custom-developed and configurable report logic, including technologies such as SAP ABAP, SQL, ERP reporting tools, and other financial applications. · Analyze and interpret technical artifacts including SQL queries, stored procedures, ETL logic, interfaces, application code, and data transformations. · Recreate or independently generate report outputs, where applicable, using reviewed queries, application logic, or ERP report code to validate report accuracy. · Perform report tie-outs between reports provided by Process Owners and independently generated outputs. · Reconcile record counts, key data fields, financial totals, parameters, and reporting periods between source data and report outputs. · Confirm report parameters, filters, date ranges, calculations, and report logic align with the intended SOX control objective. · Verify whether manual manipulation or post-extraction adjustments have been applied to system-generated reports and assess their impact. · Investigate and document variances identified during report validation and ensure explanations and resolutions are appropriately supported. · Identify potential gaps, defects, or risks associated with report logic, data integrity, interfaces, system changes, or report generation. · Support remediation and re-testing when key report logic, documentation, or report outputs do not meet SOX requirements. · Partner with system owners, developers, Process Owners, Finance, Compliance, and Audit teams to understand report design, data flows, system dependencies, and control requirements. · Ensure SOX Key Reports meet applicable documentation and testing expectations, including completeness, accuracy, access, and change management considerations.