IT Controls Manager

Division: IT

Location: Remote Ontario (Canada)
Hours: 40 hours per week, Monday to Friday

Employment type: Permanent
Salary: $111,000 - $137,000

Job Summary

The IT Controls Manager is responsible for the execution, oversight, governance, and continuous improvement of the organization's IT control environment across Canada, Europe, and Australia.

The role is accountable for assigned IT General Controls (ITGCs) and coordinates control activities across IT and business application teams to ensure controls are appropriately designed, consistently executed, adequately documented, monitored, and maintained in accordance with organizational policies, SOX requirements, and applicable regulatory standards. Responsibilities include maintaining control documentation, evaluating control effectiveness, identifying risks and deficiencies, coordinating remediation activities, and ensuring appropriate evidence is retained to support internal and external audits.

The position works closely with IT leadership, Business Application Owners, Information Security, Internal Audit, and external auditors to support compliance objectives, strengthen IT governance, and promote consistent control practices across regions. The role also supports the assessment of IT risks associated with system changes, new applications, third-party services, and evolving business processes, while identifying opportunities to improve control efficiency, standardization, and automation.

Practical knowledge of Sage X3 ERP is essential to assess and oversee application-related security, user access, segregation of duties, change management, and operational controls. The position collaborates with technical and functional teams to address control gaps, implement sustainable improvements, and maintain an effective, audit-ready IT control environment. Interesting? Here is a little more...

As an IT Controls Manager you will...

IT Control Ownership & Governance

Execute and oversee assigned IT General Controls (ITGCs), ensuring controls are appropriately designed, consistently performed, documented, and supported by sufficient evidence.
Coordinate control activities with IT teams, Business Application Owners, and other stakeholders to ensure timely execution and compliance with established requirements.
Maintain and update IT risk and control matrices, control narratives, inventories, procedures, and supporting documentation to reflect changes in systems, processes, and regulatory requirements.
Establish and maintain control execution schedules, evidence requirements, accountability, and escalation procedures to support consistent control practices across regions.
Assess control design and operating effectiveness, identify control gaps and deficiencies, and recommend appropriate corrective actions.
Review third-party SOC reports, assess relevant control gaps and complementary user entity controls, and coordinate implementation of mitigating or compensating controls where required.
Support the consistent application of IT control standards and governance practices across Canada, Europe, and Australia.

SOX & Regulatory Compliance

Coordinate and perform SOX ITGC activities across in-scope applications, infrastructure, identity and access management, change management, and IT operations.
Maintain accurate and complete control evidence, assessments, attestations, exceptions, and remediation records within ServiceNow GRC.
Conduct IT control walkthroughs and coordinate audit requests, evidence submissions, and follow-up activities with Internal Audit and external auditors.
Monitor control execution and effectiveness, identify overdue or ineffective controls, and escalate compliance issues to appropriate stakeholders.
Assess control deficiencies, evaluate associated risks, coordinate corrective action plans, and validate the effectiveness of remediation activities prior to closure.
Support internal and external audit activities, including audit planning, testing, issue resolution, and ongoing audit readiness.
Prepare and communicate control performance metrics, compliance status, audit findings, and remediation progress to IT leadership and relevant stakeholders.
Monitor changes in applicable compliance requirements and assess their impact on existing IT controls and procedures.

Sage X3 & Business Application Controls

Execute or coordinate assigned Sage X3 IT controls, including user provisioning and deprovisioning, privileged access, periodic user access reviews, segregation of duties, change management, and production access.
Evaluate Sage X3 security configurations, user roles, permissions, workflows, and system changes to identify potential control weaknesses and compliance risks.
Review supporting documentation and system-generated evidence to assess the design and operating effectiveness of Sage X3 controls.
Collaborate with ERP technical and functional teams to investigate control deficiencies, recommend corrective actions, and support remediation without disrupting critical business operations.
Assess the impact of Sage X3 enhancements, configuration changes, integrations, and upgrades on existing IT controls and compliance requirements.
Coordinate with Business Application Owners to ensure appropriate access management, change management, and operational controls are maintained across other in-scope business applications.
Identify opportunities to strengthen ERP-related controls through process improvements, standardization, and automation.

Continuous Improvement & Stakeholder Collaboration

Identify and implement opportunities to improve the efficiency, consistency, and effectiveness of IT control processes across the organization.
Support the standardization of control procedures, documentation, evidence requirements, and monitoring practices across regions and business applications.
Evaluate opportunities to automate control execution, evidence collection, and ongoing monitoring to reduce manual effort and improve control reliability.
Provide guidance to control owners, performers, and reviewers on control requirements, execution procedures, documentation standards, and remediation expectations.
Collaborate with IT, Information Security, Business Application Owners, and other stakeholders to address emerging risks and strengthen the overall IT control environment.
Support IT projects, system implementations, and process changes by identifying control implications and recommending appropriate control requirements.
Track and report control performance trends, recurring deficiencies, and improvement opportunities to support proactive risk management.
Promote accountability, effective communication, and sustainable control practices through cross-functional collaboration and stakeholder engagement.

You will be setup for success if you have...

Bachelor's degree in Computer Science, Information Systems, Information Technology, Accounting, Business Administration, or a related discipline, or an equivalent combination of education and relevant professional experience.
Minimum of 7 years of progressive professional experience in IT compliance, IT risk management, IT audit, or IT governance, preferably within a publicly traded company or regulated environment.
Previous hands-on experience working with Sage X3 ERP in an IT controls, compliance, security administration, or application governance capacity is mandatory. Experience with other ERP platforms alone does not satisfy this requirement.
Experience supporting SOX compliance programs, including participation in internal or external audits within complex IT environments.
Experience working in a multi-entity, multinational, or geographically distributed organization is preferred.
Professional certifications such as CISA, CRISC, CIA, CISSP, or equivalent are considered an asset.
Previous experience in a Big Four accounting firm, IT risk advisory practice, or corporate internal audit function is considered an asset.

Bonus points if you have...

Required

Strong knowledge of IT General Controls (ITGCs), SOX compliance requirements, IT risk management, and control governance principles, including control design, execution, testing, monitoring, and remediation.
Demonstrated practical knowledge of Sage X3 ERP, including its security model, user access management, role-based permissions, segregation of duties, change management, and related IT controls.
Strong understanding of IT operations, identity and access management, privileged access, system development life cycle (SDLC), IT change management, and business application controls.
Ability to assess IT control design and operating effectiveness, identify risks and deficiencies, evaluate root causes, and recommend practical, risk-based corrective actions.
Knowledge of audit requirements, control documentation standards, evidence retention, and procedures necessary to support internal and external audits.
Ability to independently execute assigned controls, coordinate control activities across multiple stakeholders, and manage competing priorities within established timelines.
Strong analytical and problem-solving skills, with the ability to evaluate complex technical processes, identify control weaknesses, and develop sustainable improvements.
Effective written and verbal communication skills, including the ability to clearly communicate technical risks, compliance requirements, control deficiencies, and remediation expectations to technical and non-technical stakeholders.
Strong organizational skills and attention to detail, with the ability to maintain accurate control documentation, monitor compliance activities, and follow through on outstanding issues.
Ability to collaborate effectively with IT teams, Business Application Owners, Information Security, and audit stakeholders across multiple geographic regions without direct reporting authority.
Sound judgment, professional integrity, and the ability to handle sensitive information while maintaining objectivity and appropriate confidentiality.

Preferred

Working knowledge of ServiceNow GRC or comparable governance, risk, and compliance platforms for control documentation, evidence management, compliance monitoring, and remediation tracking.
Familiarity with third-party assurance reporting, including SOC 1 and SOC 2 reports, complementary user entity controls, and assessment of third-party control risks.
Knowledge of control automation, continuous monitoring techniques, and opportunities to improve the efficiency and reliability of IT compliance processes.
Familiarity with recognized IT governance, cybersecurity, and control frameworks, including NIST, CIS Controls, COBIT, ISO 27001, and ITIL.
Understanding of applicable privacy and regulatory requirements, including GDPR, PIPEDA, Australian privacy legislation, and relevant industry standards such as GMP/GACP.
Professional certification such as Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), Certified Internal Auditor (CIA), Certified Information Systems Security Professional (CISSP), or equivalent.
Experience working with geographically distributed teams and navigating regional differences in business processes, technology environments, and compliance requirements.
Knowledge of the cannabis industry considered a strong asset, including regulatory compliance, inventory tracking, and financial reporting requirements specific to the sector.
Broad knowledge of computer systems, ERP technologies, programming fundamentals, and application design techniques, with an emphasis on optimizing business processes through Sage X3.
Familiarity with various Software Development Lifecycle (SDLC) methodologies including Agile, Waterfall, and hybrid models, as applied to ERP enhancement and deployment projects.
Experience supporting enterprise-level, multi-site, and global organizations, including configuration of Sage X3 to meet multi-company and multi-legislation requirements.
Proven track record of working on cross-functional ERP projects with multi-disciplinary teams in fast-paced, innovation-driven environments.

Working Conditions

Work is performed primarily at a desk with a laptop and extended screen time, including responding to emails, attending virtual meetings, and producing reports or documentation.
Sitting for extended periods with flexibility to adjust posture (neck, shoulder, and back) and take necessary breaks.
Repetitive movement of hands and wrists (typing on keyboard and using a mouse).
Flexibility in start and end times to support collaboration across multiple time zones.
After-hours, weekend, or on-call support rotation.
Work activities involve handling loads up to 5kg maximum.
Lifting and carrying 5kg and above is not required.
Mobility functions such as reaching, bending, crouching, kneeling, or crawling are not required

Aurora Cannabis

New Jobs

IT Controls Manager - Remote ON (Canada)