Associate Director - SOX

We are seeking an Associate Director - SOX to lead the SOX IT testing team and the end-to-end delivery of GSK's Sarbanes-Oxley IT general controls programme.

The SOX team owns GSK's IT general controls compliance under the Sarbanes-Oxley Act, scoping the SOX control environment for technology, running the annual testing cycle, managing deficiencies, and coordinating with external auditors.

Key Responsibilities:

• Lead the SOX IT testing team, including its people, delivery, and outcomes, planning and executing the annual testing cycle across in-scope systems.
• Manage delivery against the SOX testing roadmap and escalate blockers early.
• Develop team capability in SOX ITGC and IT audit testing through coaching, review, and structured feedback.
• Represent the SOX programme in CSO and Finance governance forums, including Risk boards and Audit Committee reporting.
• Own the technology scope of GSK's SOX control environment, including in-scope systems and controls.
• Run the annual SOX ITGC testing cycle, covering access, change, operations, and program development controls.
• Assess control deficiencies for severity and aggregation, analyse root causes, and partner with Tech product owners on remediation plans through to closure.
• Act as the main point of contact with external auditors, facilitating audit coordination, scope, and testing reliance discussions throughout the year.
• Maintain SOX control documentation, narratives, and risk-control matrices.
• Advise system and control owners on SOX control design and evidence expectations.
• Liaise with Finance risk management on scoping and changes to the IT landscape.
• Track and report testing status and findings to Risk boards and in Audit Committee papers.

Basic Qualifications:

• Degree in a relevant discipline, or related experience.
• Demonstrated experience in SOX IT general controls or IT audit.
• Working knowledge of control testing and deficiency evaluation.
• Practical experience with external auditor coordination.
• Experience analysing root causes of control issues and partnering with technology owners on remediation plans.
• Ability to prioritise and manage multiple concurrent testing workstreams.
• Significant experience in cyber security within the relevant domain.
• Proven experience leading a team or a substantial programme of work.
• Experience managing delivery to plan, quality, and timelines.
• Excellent relationship management, influencing, and communication skills.

Preferred Qualifications:

• Deep working knowledge of SOX ITGC across access, change, and operations.
• Experience coordinating with external auditors on IT controls.
• Big Four or internal audit background.
• Experience in a listed pharmaceutical or life sciences company.
• Experience auditing cloud and SaaS environments.
• Familiarity with ERP and financial applications.
• Relevant certification such as CISA, CPA, CISSP, CRISC, or ISO 27001 Lead Auditor.
• Experience in pharmaceutical, life sciences, or another highly regulated industry.