SOX & IT Compliance Analyst

About McKesson

McKesson is a Fortune 10 company dedicated to enhancing healthcare accessibility and affordability through its comprehensive insights, products, and services. The organization values the well-being of its employees and the communities it serves, fostering a culture that encourages growth, impact, and innovation.

Role Overview

The SOX & IT Compliance Analyst will play a key role in advancing McKesson's Governance, Risk, and Compliance (GRC) initiatives. The individual will focus on ensuring adherence to Sarbanes-Oxley (SOX) regulations, managing IT control tests, overseeing access governance, and supporting cybersecurity compliance efforts.

Key Responsibilities

• Conduct and assist with SOX IT General Controls testing, including gathering, reviewing, and documenting evidence.
• Manage and support SAP GRC Access Control and Process Control tools.
• Oversee user access reviews, monitor segregation of duties, and administer identity governance via SailPoint.
• Collaborate with business and technology stakeholders to maintain compliance with internal and regulatory control requirements.
• Prepare compliance documentation, audit reports, test outcomes, and status updates on remediation actions.
• Monitor and report on cybersecurity compliance tasks, vulnerability findings, and corrective measures.
• Carry out risk assessments and compliance analyses to identify deficiencies and suggest improvements.
• Facilitate internal and external audit processes by coordinating evidence collection and validating controls.
• Support corrective action planning and tracking for identified control shortcomings.
• Maintain comprehensive documentation, including policies, procedures, and standards related to compliance.
• Develop metrics and indicators to measure compliance performance.
• Drive continuous enhancements to governance, risk management, and compliance processes.

Required Qualifications

• Bachelor's degree or equivalent experience.
• Minimum of 4 years' relevant experience in IT compliance, audit, SOX, governance, risk management, or cybersecurity compliance.
• Proven skills in SOX controls testing and audit support, including evidence documentation.
• Practical experience with SAP GRC Access and Process Control systems.
• Background in conducting user access reviews, segregation of duties analysis, or identity governance.
• Familiarity with SailPoint Identity Governance Administration or similar platforms.
• Capability in generating compliance reports, audit documents, and remediation monitoring.
• Strong analytical thinking, problem-solving aptitude, and documentation skills.

Preferred Experience and Skills

• Knowledge of cybersecurity compliance, vulnerability management, and risk reporting.
• Understanding of governance, risk, and compliance frameworks and integrated risk management practices.
• Awareness of IT regulatory requirements including SOX and access governance.
• Experience utilizing compliance analytics and monitoring tools.
• Exposure to audit methodologies, risk assessments, and control evaluations.
• Experience with RegTech or integrated risk management solutions.
• Relevant certifications such as CISA, CRISC, CISSP, CIA, CGRC, SAP GRC, or SailPoint credentials.
• Experience in large enterprises or regulated environments.
• Excellent stakeholder engagement and communication skills with cross-functional influence capability.

Work Conditions

• Work is primarily remote or office-based, depending on business needs.
• Travel may occasionally be necessary for meetings, training, audits, or events.
• Requires ability to work at a computer and participate in virtual meetings over extended durations.

Compensation and Benefits

McKesson provides a comprehensive Total Rewards package supporting physical, mental, and financial well-being tailored to its diverse workforce. The base salary for this position ranges from €56,300 to €93,800, determined by multiple factors such as skills, experience, equity, and market conditions. Additional compensation may include annual bonuses or long-term incentives. The company emphasizes compliance with all applicable regulations in its compensation policies.

Additional Information

McKesson warns candidates about fraudulent job offers or communication claiming to be from McKesson but are not authorized representatives. The Company never requests payment or credit card details during recruitment. Official McKesson communications do not use informal email accounts or chatrooms, though a virtual assistant may support recruiting correspondence. Job postings are hosted exclusively on the company's careers website.