Director, Enterprise Risk Management & IT SOX Risk Advisory

POS-7385 Director, Enterprise Risk Management & IT SOX Risk Advisory Role Summary Our mission at HubSpot is to help millions of organizations grow better. HubSpot's Risk and Internal Audit function is growing in scope and complexity. This Director role owns two of the function's most strategic portfolios: Enterprise Risk Management and IT SOX Risk Advisory, including the expansion of SOX coverage and transformation initiatives. In this role, you'll lead Enterprise Risk Management (ERM) facilitation across the business, own the risk advisory relationship with Engineering and Finance stakeholders, and provide director-level oversight of IT SOX readiness as HubSpot scales. You'll manage a team of risk professionals and serve as a key voice in executive reporting on technology risk. What You'll Do Lead execution of the enterprise risk assessment, including surveys, interviews, and cross-functional facilitation. Maintain the enterprise risk register and Key Risk Indicator (KRI) reporting cadence. Synthesize risk inputs from risk owners into executive-ready reporting and recommendations. Track mitigation plan progress and escalate stalled items to leadership. Monitor emerging risks—including AI, regulatory, cybersecurity, and macroeconomic trends—and integrate them into the Enterprise Risk Assessment cycle. Partner with the Head of Risk and Internal Audit to connect Enterprise Risk Assessment outputs to the annual audit plan. Lead the SOX Risk Advisory portfolio, including pre-implementation reviews, control design guidance, and readiness assessments across key business initiatives. Own director-level relationships with Finance and Engineering stakeholders across SOX-relevant system changes. Lead implementations requiring IT audit scoping, control design, and readiness validation. Apply IT SOX expertise to assess ITGC impacts of system migrations, API changes, and platform builds. Partner with the IT Internal Audit team and external auditors on scoping and reliance where advisory work intersects. Manage and develop a team of business and IT risk professionals. Set quality standards for advisory deliverables and risk documentation. Allocate team capacity across concurrent advisory workstreams. Coach advisors on stakeholder management, technical writing, and control design thinking. What You'll Bring Required Qualifications 10+ years of experience across IT audit, risk, or advisory. Bachelor's degree or equivalent experience in Information Systems, Accounting Information Systems, Management Information Systems, Computer Science, or a related field. Experience facilitating Enterprise Risk Management processes, including leading risk assessments, synthesizing outputs, and presenting findings to leadership. Deep IT SOX experience, including ITGC design, operating effectiveness testing, deficiency assessment, and external auditor coordination. Hands-on experience supporting SOX readiness for new systems, ERP implementations, or product features in a technology or SaaS environment. Track record of managing or mentoring teams in a high-volume, multi-stakeholder environment. Ability to translate technical IT and SOX observations into business risk language for non-technical executive audiences. Strong control design expertise with the ability to advise Engineering and Finance stakeholders before implementation, not just after. Comfortable managing ambiguity across concurrent, fast-moving workstreams. Collaborative approach that builds credibility with Engineering, Finance, Legal, and Product stakeholders while maintaining appropriate independence. Executive presence with the ability to deliver leadership updates on risk and advisory themes. Nice-to-Have Qualifications Certified Information Systems Auditor (CISA). Certified Internal Auditor (CIA). Additional professional certifications related to risk management, governance, or internal audit. Where You'll Work Location: Anywhere within the United States Work location preference: Remote (United States) Posting: Internal and External Travel: Minimal travel as needed. Pay & Benefits The cash compensation below includes base salary, on-target commission for employees in eligible roles, and annual bonus targets under HubSpot’s bonus plan for eligible roles. In addition to cash compensation, some roles are eligible to participate in HubSpot’s equity plan to receive restricted stock units (RSUs). Some roles may also be eligible for overtime pay. Individual compensation packages are tailored to your skills, experience, qualifications, and other job-related reasons. This resource will help guide how we recommend thinking about the range you see. Learn more about HubSpot’s compensation philosophy . Benefits are also an important piece of your total compensation package. Explore the benefits and perks HubSpot offers to help employees grow better. At HubSpot, fair compensation practices aren’t just about checking off the box for legal compliance. It’s about living out our value of transparency with our employees, candidates, and community. Annual Cash Compensation Range: $209,400 — $335,000 USD We know the confidence gap and impostor syndrome can get in the way of meeting spectacular candidates, so please don’t hesitate to apply — we’d love to hear from you. If you need accommodations or assistance due to a disability, please reach out to us using this form . At HubSpot, we value both flexibility and connection. Whether you’re a Remote employee or work from the Office, we want you to start your journey here by building strong connections with your team and peers. If you are joining our Engineering team, you will be required to attend a regional HubSpot office for in-person onboarding. If you join our broader Product team, you’ll also attend other in-person events, such as your Product Group Summit and other gatherings, to continue building on those connections. If you require an accommodation due to travel limitations or other reasons, please inform your recruiter during the hiring process. We are committed to supporting candidates who may need alternative arrangements Massachusetts Applicants: It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability. Germany Applicants: (m/f/d) - link to HubSpot's Career Diversity page here . India Applicants: link to HubSpot India's equal opportunity policy here . About HubSpot HubSpot (NYSE: HUBS) is an AI-powered customer platform with all the software, integrations, and resources customers need to connect marketing, sales, and service. HubSpot's connected platform enables businesses to grow faster by focusing on what matters most: customers. At HubSpot, bold is our baseline. Our employees around the globe move fast, stay customer-obsessed, and win together. Our culture is grounded in four commitments: Solve for the Customer, Be Bold, Learn Fast, Align, Adapt & Go!, and Deliver with HEART. These commitments shape how we work, lead, and grow. We’re building a company where people can do their best work . We focus on brilliant work, not badge swipes. By combining clarity, ownership, and trust, we create space for big thinking and meaningful progress. And we know that when our employees grow, our customers do too. Recognized globally for our award-winning culture by Comparably, Glassdoor, Fortune, and more, HubSpot is headquartered in Cambridge, MA, with employees and offices around the world. Explore more: HubSpot Careers Life at HubSpot on Instagram HubSpot may use AI to help screen or assess candidates, but all hiring decisions are always human. More information can be found here . By submitting your application, you agree that HubSpot may collect your personal data for recruiting, global organization planning, and related purposes. We may use CLEAR ID Verification during the hiring process to confirm your identity and help maintain a safe, secure, and trusted experience for all candidates. Refer to HubSpot's Recruiting Privacy Notice for details on data processing and your rights.