Senior Manager, Internal Controls & SOX Readiness

Position Overview

Triumph is building its internal controls and SOX program from the ground up, and we are hiring a Senior Manager, Internal Controls & SOX Readiness, to lead it. Reporting to the VP, Accounting & Corporate Controller and working closely with the Assistant Controller, you will design controls into our newly implemented NetSuite environment, define SOX scope, build the risk and control matrix, and prepare the company for audits under PCAOB standards.

Much of the control environment does not exist yet. You will decide what gets documented, what gets automated, and what does not need a control at all.

You will be the primary point of contact for our external auditors and will be expected to defend the program’s scope with evidence and judgment. Financially relevant data moves through automated pipelines and third-party payment processors, so a practical command of ITGCs in a modern data stack matters as much as traditional process controls.

Success in the first year looks like

• Controls designed into NetSuite, covering user roles, segregation of duties, and approval workflows
• A scoping memo and risk and control matrix within your first 90 days
• Walkthroughs and design assessments completed for all in-scope processes ahead of audits under PCAOB standards.
• A SOC 1 review process covering our key service providers
• A right-sized program the VP, Accounting & Corporate Controller and Assistant Controller can rely on without a consultant in the room

About the role

• Scope, build, own, and manage Triumph’s end-to-end SOX program. You will oversee the full process from risk assessment to design, implementation, testing of key controls, identification of deficiencies, and remediation.
• Build and own Triumph’s risk control matrix and risk-based audit plan, documenting all workflows that feed the financial statements.
• Coordinate with external auditors on SOX-related matters, including walkthroughs, testing support, issue resolution, and defending the program’s established scope boundaries when necessary.
• Prepare and present SOX program updates to the VP, Accounting & Corporate Controller and C-suite, and external auditors, including status reporting, deficiency summaries, and remediation progress.
• Build SOX awareness across the organization by educating control owners on their responsibilities and the importance of a well-controlled environment.
• Identify opportunities to streamline and automate controls as Triumph’s systems and processes evolve.
• Direct third-party SOX consultants while ensuring quality of output and keeping all decision-making owned internally.

Required

• 6+ years in internal controls, SOX compliance, or external audit.
• At least 3 years in-house at a public or pre-IPO company as the accountable owner of some or all of ICFR. You have been through at least one external audit, on either side, as auditor or auditee.
• Experience in an environment where financially relevant data flows through automated pipelines, with a practical view on ITGCs in a modern data stack.
• Working command of the frameworks and standards that govern the program: COSO 2013 Internal Control-Integrated Framework, COBIT for ITGCs, PCAOB AS 2201 and SEC guidance on SOX 302/404, and the IIA’s International Professional Practices Framework.
• Demonstrated judgment on rightsizing. You can point to controls you simplified or removed and successfully defended against pushbacks from external auditors.
• Able to move cross-functional stakeholders without formal authority.
• Comfortable presenting to senior leadership
• Strong documentation skills: clean, auditor-ready narratives and control matrices.
• In-office 5 days a week

Preferred

• Big 4 or equivalent risk advisory foundation.
• In-house experience through an IPO transition, with exposure to both sides of the process.
• Experience in fintech, lending, or payments.
• CPA license or equivalent certification (CIA, CISA).
• Hands-on experience with AuditBoard or Workiva, or enough SQL fluency to review evidence directly.