SOX & NERC CIP Manager

Position: SOX & Compliance Manager

Location: Rosemead, CA – Onsite

Type of Employment: 12 Months Contract

Role Description:

• Audit and Compliance, SOX, Non-SOX, NERC CIP
• Role Descriptions: Position TitleSOX & Compliance Manager

Position Summary

The SOX & Compliance Manager is responsible for leading and managing the organizations compliance programs including Sarbanes-Oxley (SOX) compliance, Non-SOX regulatory compliance, NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection) compliance, Non-NERC CIP compliance initiatives, and internal and external audit activities. This role partners closely with business, IT, cybersecurity, risk management, legal, and operational teams to ensure compliance with regulatory requirements, strengthen internal controls, mitigate risks, and support successful audit outcomes.

The ideal candidate will possess strong expertise in governance, risk, compliance (GRC), internal controls, audit management, cybersecurity compliance, and regulatory frameworks.

Key Responsibilities

SOX Compliance Management

• Lead the organizations SOX compliance program, including planning, execution, monitoring, testing, and reporting.
• Manage annual SOX risk assessments and control scoping activities.
• Coordinate control design reviews and operating effectiveness testing.
• Partner with process owners to identify, document, and remediate control deficiencies.
• Ensure timely completion of SOX certifications and compliance requirements.
• Maintain SOX narratives, process flows, risk control matrices (RCMs), and supporting documentation.
• Monitor regulatory changes affecting SOX compliance and recommend improvements.

Non-SOX Compliance Management

• Develop and maintain compliance programs related to company policies, regulatory requirements, industry standards, and operational controls.
• Conduct compliance assessments and gap analyses across business and technology functions.
• Support implementation and monitoring of compliance frameworks such as ISO 27001, NIST, PCI DSS, SOC, GDPR, CCPA, and other applicable regulations.
• Track remediation activities and ensure closure of compliance findings.

NERC CIP Compliance

• Manage NERC CIP compliance activities across applicable business units and critical infrastructure environments.
• Coordinate CIP evidence collection, documentation management, and compliance reporting.
• Oversee periodic reviews of CIP standards, policies, procedures, and technical controls.
• Partner with cybersecurity, IT, and operations teams to ensure compliance with NERC CIP requirements.
• Support self-certifications, spot checks, compliance monitoring, and regulatory audits.
• Track and manage mitigation plans and corrective action activities.
• Non-NERC CIP Compliance Activities
• Oversee compliance initiatives associated with operational technology (OT), cybersecurity, and industry-specific regulatory requirements.
• Conduct assessments to ensure adherence to corporate and regulatory standards.
• Manage compliance documentation, evidence repositories, and reporting mechanisms.
• Facilitate continuous improvement initiate