IT Assurance Associate

Role Description

We are seeking an Associate for SMBC’s FSPDAD-FAD – Accounting – Finance Control Oversight (“FCO”) Group - IT Control Department. This role will support the FCO Head of IT Assurance in planning, managing, and executing IT general control (“ITGC”), IT application control (“ITAC”), automated control, data control, and interface control assessments supporting financial and regulatory reporting. The Associate will also support Service Organization Control (“SOC”) report reviews, control inventory maintenance, remediation tracking, technology change and system implementation reviews, and other internal control activities aligned with applicable requirements and frameworks, including PCAOB, AICPA, COSO 2013, and COBIT 5.0.

The position is located at 200 Hudson Street, Jersey City. It reports to the FCO Head of IT Assurance within SMBC’s FSPDAD – FAD Accounting – FCO group and is a non-supervisory role.

Responsibilities

• Prepare the annual internal control assessments and work plans for the respective IT areas.
• Perform walkthroughs, evidence reviews, and testing of IT-related internal controls, including test of design and operating effectiveness.
• Perform testing of IT application controls, automated controls, data controls, interface controls, reconciliations, and reports used in control execution.
• Perform Service Organization Control (“SOC”) report reviews, assess relevant user control considerations, and document review results.
• Prepare quarterly internal control assessment updates and final assessment reports for financial and regulatory reporting processes.
• Support control inventory maintenance, including control mapping, validation, rationalization, and documentation updates based on process, system, or reporting changes.
• Prepare clear testing documentation, issue summaries, status updates, and materials for management, auditors, and other stakeholders.
• Track open items, remediation actions, management responses, and supporting evidence; follow up with control owners and stakeholders to support timely resolution of IT-related control deficiencies.
• Build and maintain collaborative relationships with Internal Audit, External Audit, business stakeholders, technology stakeholders, and SMBC/SMBCAH management; prepare and provide internal control-related training as needed.
• Support special projects, focused reviews, technology change reviews, and system implementation assessments for applications, data flows, and processes that impact financial and regulatory reporting.
• Work closely with functional areas across SMBC/SMBCAH subsidiaries to interpret reporting, internal control, and audit requirements; define process and control expectations; and provide technical process and control advice to SMBC stakeholders.

Qualifications and Skills

• 5+ years of related experience
• Strong project management skills, including the ability to work collaboratively across functional teams and coordinate goals with a variety of stakeholders.
• Strong written and verbal communication skills, including the ability to prepare clear control descriptions, test procedures, testing results, and issue observations.
• Ability to multitask and work effectively with shifting priorities and competing deadlines.
• Strong analytical, control assessment, and process documentation skills.
• Detail oriented and well organized.
• Professional judgment, sound issue escalation, and ability to remain organized under competing deadlines.
• Ability to work independently as well as within a group setting.
• Familiarity with ITGCs, ITACs, automated controls, data and interface controls, SOC 1 reports, COSO, COBIT, SOX, or similar internal control frameworks.
• Prior consulting or audit experience supporting IT controls, internal controls, financial reporting, regulatory reporting, or technology risk initiatives is preferred.
• Proficiency with Microsoft Excel, PowerPoint, SharePoint, and Teams; experience with audit or GRC tools, data analytics, Power BI, Power Automate, SQL, or Alteryx is a plus.
• CPA, CIA, CISA, or similar professional certification is preferred.