Description
Nebius is seeking an IT Risk & Controls Manager to act as an embedded risk partner to its engineering and technology organizations.
The successful candidate will combine deep IT risk and controls expertise with meaningful in-house technology experience. You will work directly with engineering leaders, system owners, Finance, Internal Controls, and external auditors to identify risk, design scalable controls, improve evidence quality, drive remediation, and embed compliance into the way technology organizations operate.
Responsibilities:
- Act as the risk and controls partner for an assigned technology organization or system portfolio
- Own and continuously improve the relevant IT risk and control framework
- Lead IT SOX readiness for assigned systems
- Partner with engineering, platform, infrastructure, security, and corporate IT teams to design and implement scalable controls
- Design, assess, and enhance ITGCs across various areas
- Assess IT application controls, automated controls, and IT-dependent business controls
- Evaluate how business controls depend on systems, integrations, configurations, reports, and underlying ITGCs
- Apply risk and controls thinking to modern engineering practices
- Lead the assessment and remediation of control gaps arising from new systems or technology transformations
- Review third-party assurance reports and determine the impact of vendor controls
- Maintain effective working relationships with external auditors and advisers
- Translate complex technical risks and auditor requirements into practical guidance
- Use data analytics, automation, and AI-assisted tools to improve control coverage and efficiency
- Contribute to the development of IT controls methodology, standards, and tooling
- Provide clear updates on control health, audit readiness, and remediation progress
Requirements:
- Degree in Information Systems, Computer Science, Engineering, Accounting, Finance, or a related discipline
- At least eight years of progressive experience in IT risk, IT controls, IT SOX, technology assurance, or IT audit
- Meaningful in-house technology or corporate ownership experience
- Experience working in a first-line technology, engineering, systems, or IT operations role
- Hands-on experience in an engineering-led technology, cloud, SaaS, platform, or digital-product environment
- Strong practical knowledge of SOX 404, ITGCs, IT application controls, automated controls, COSO, and COBIT
- Demonstrated experience with control design, implementation, monitoring, evidence review, audit readiness, issue evaluation, and remediation
- Practical understanding of modern technology environments, including cloud infrastructure, IAM, DevOps, CI/CD, SDLC, software repositories, deployment practices, system integrations, and container orchestration
- Experience connecting business-process controls to supporting systems, automated controls, IPEs/IUCs, and underlying IT dependencies
- Ability to communicate effectively with engineers, technical leaders, Finance stakeholders, and external auditors
- Strong judgment and confidence to challenge control owners while developing practical solutions
- Highly autonomous and hands-on approach
- Strong written and verbal English
- Ability to work effectively across international time zones and travel when needed
Nice to Have:
- Professional certification such as CISA, CRISC, CISM, CIA, CPA, or equivalent
- Experience building or transforming an IT SOX or technology-controls framework in a listed or pre-IPO technology company
- Experience in AI infrastructure, cloud platforms, large-scale SaaS, fintech, marketplaces, or engineering-intensive environments
- Experience with GRC and audit-management tools
- Experience with enterprise SaaS and financial systems
- Experience onboarding acquired companies or newly implemented systems into SOX scope
- Experience with control automation, continuous monitoring, data analytics, or AI-assisted assurance
- Exposure to AI governance, AI/ML control environments, or controls supporting AI-enabled development and operations