Senior IT SOX Audit Manager| United States | Remote

The Opportunity

We're looking for a Senior Manager, IT SOX Audit to help stand up Grafana Labs' IT SOX program from the ground up as we scale our controls and governance for our next stage of growth. This is a hands-on, high-visibility role reporting to the Head of Internal Audit, with direct exposure to Finance, IT, Engineering, Security, and senior leadership.

This is a player-coach individual contributor role today. You'll architect and execute the IT SOX program yourself and with external consultant support, influencing through expertise rather than direct reports. As the function matures, you'll have the opportunity to broaden your scope into technology and IT audit and to build and lead a team over time.

Success here isn't measured by control test completion rates or a tally of audit projects. It's measured by whether Grafana is more risk-intelligent, better controlled, and able to continue to scale because of your work. This is ideal for someone who enjoys building from scratch, partnering closely with stakeholders, and leveraging modern tools, including AI, to deliver efficient, high-impact assurance.

What You'll Be Doing

• Partner with the Head of Internal Audit to build and operate Grafana's IT SOX program from the ground up: scoping, risk assessment, control design, and testing across IT general controls (ITGCs) and key application controls tied to financial reporting.
• Design and execute all phases of IT SOX activity: walkthroughs, design and operating effectiveness testing, documentation, status tracking, deficiency identification, and remediation validation.
• Assess ITGCs and application controls across key financial systems and Grafana's cloud/SaaS environment (e.g., NetSuite, Salesforce, Workday).
• Own the IT SOX documentation library in partnership with the Business Process / Finance SOX lead (narratives, flowcharts, and IT risk-and-control matrices (RCMs), and keep it audit-ready at all times.
• Drive deficiency management conversations with control owners, advocating for automation-first, scalable remediation over manual, siloed patches.
• Own the relationship with external IT auditors, ensuring testing methodologies and documentation meet PCAOB standards and align with external auditor expectations to create th