IT Controls Engineer, Enterprise Applications

Gusto

IT Controls Engineer owning SOX ITGCs across Gusto’s payroll, HR, and benefits applications. Building AI-augmented assurance and continuous controls monitoring for a growing small-business platform.

Posted 8/19/2026full-timeSan Francisco • California • 🇺🇸 United StatesSeniorLead💰 $245,000 - $265,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in ITGC design and operation, with a strong focus on SOX compliance, segregation of duties, and AI-augmented controls. Proven ability to lead audit engagements and manage first-line control environments across enterprise applications.

Highest-signal resume keywords

ITGC Design and OperationSOX 404 ComplianceSegregation of Duties (SoD)AI-Augmented Controls DevelopmentContinuous Controls Monitoring (CCM)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

IT ControlsAudit ManagementEnterprise Applications GovernanceChange ManagementRisk AssessmentControl DesignEvidence CollectionAnomaly DetectionRole Design ReviewsControl Consolidation

Soft Skills

Excellent Communication SkillsStrong Judgment on AI Risk

Tools & Technologies

NetSuiteWorkdaySalesforceAI SystemsLLM-Based Evidence PipelinesIGA Platforms

Certifications & Qualifications

CISACISSPCIACPA

Industry Keywords

COSOCOBITSOC 1/2ISO 27001NIST CSFPCI DSSPublic Company ReadinessIPO Readiness

Tech Stack

Tools & technologies

ERPSDLC

About the role

Key responsibilities & impact

Own ITGC design and operation across enterprise applications, including logical access, change management, SDLC, computer operations, and segregation of duties
Lead the first-line control environment for in-scope enterprise applications
Drive SoD strategy across ERP, HRIS, and CRM, including role design reviews, conflict remediation, mitigating control design, and ongoing monitoring tooling
Manage the audit lifecycle as the primary first-line liaison with Internal Audit, External Audit, and the SOX PMO
Conduct walkthroughs, evidence collection, deficiency remediation, and management responses
Build AI-native continuous controls monitoring using LLM-based evidence review, agentic control testing, and automated anomaly surveillance
Own the controls posture for Gusto's internal AI and automation portfolio
Review internal AI use cases, classify them by risk category, and ensure controls, evidence trails, and validation are integrated during development
Lead access governance, including provisioning/deprovisioning workflows, periodic user access reviews, privileged access management, and IGA platform integration
Govern application change management for in-scope systems, including approvals, developer/production segregation, emergency changes, and release evidence
Mature the controls program through rationalization, control consolidation, and adoption of automated/preventive controls
Partner with Security/GRC, Legal, Finance/Accounting, People Operations, and Revenue Operations

Requirements

What you’ll need

10+ years of experience in IT controls, audit, or enterprise applications governance
Strong hands-on experience operating in the 1st line of defense as a control owner across NetSuite, Workday, and/or Salesforce
Deep expertise in SOX 404, COSO, COBIT, and ITGC frameworks
Experience with segregation of duties (SoD) design and remediation across ERP, HRIS, and CRM environments
Proven experience leading external audit engagements as the management-side owner
Experience with public company or IPO readiness preferred
Experience building and deploying AI-augmented controls work, including agents, LLM-based reviewers, or automated anomaly detection
Ability to design controls for and with AI systems
Strong judgment on AI risk, including model risk, prompt injection, output validation, and audit trail design
Hands-on familiarity with Claude Code, MCPs, or LLM-based evidence pipelines
Excellent communication skills for translating complex control concepts to executives, auditors, and engineers
Experience in continuous controls monitoring (CCM) and data-driven assurance approaches
Relevant certifications such as CISA, CISSP, CIA, CPA, or equivalent are a plus
Familiarity with SOC 1/2, ISO 27001, NIST CSF, and PCI DSS is a plus
Ability to work from a secure, reliable, and consistent internet connection when approved to work outside a Gusto office

Benefits

Comp & perks

Competitive base pay
Benefits
Equity (RSUs)
Secure, reliable, and consistent internet connection required when working outside a Gusto office
Reasonable accommodations for qualified individuals with disabilities and disabled veterans
Equal opportunity employment