IT Controls Analyst

📢 JOB FAIR | November 12, 2026

🕐 Time: 12:00 PM - 5:00 PM
📍 Venue: Ballroom A & B, Shangri-La Makati

Walk in, meet our recruitment team, and explore exciting career opportunities with us!

🔗 Registration Link: Register Here: RCMTPH Job Fair 2026 | November 12, 2026 | RCMTPH Inc.

Responsibilities:

• Keep the IT risk control matrix, the IT inventory of in-scope systems and the SOX IT policies (Access Security, Change Management, SDLC) current.
• Run the test of effectiveness from management's side: provide the operating-effectiveness populations, coordinate sample evidence with each system owner, and deliver the evidence to internal and external audit on schedule.
• Run the quarterly user access review, track remediation actions to closure, and assemble the quarterly evidence package.
• Support audit walkthroughs and observations, including the ITGC walkthroughs by system and the ITAC observations (for example, journal entry segregation of duties in the ERP).
• Support the annual close and year-end audit: roll-forward testing from interim to year end, year-end user access reviews, and the completeness and accuracy of key reports used in the close.
• Review vendor SOC 1 reports for in-scope systems, including complementary user entity controls and bridge letters.
• Track audit remediation actions to closure and report status to the IT lead and the Controller.
• Collect change management evidence from source control and work tracking (GitHub, Azure DevOps) for in-scope applications.
• Document system controls for in-scope applications across ERP, HR, payroll and billing systems.

Qualifications

• 3 or more years in IT audit, ITGC testing or SOX 404 compliance, at a public accounting or advisory firm or in-house at a US-listed company.
• Working knowledge of PCAOB and COSO requirements, test of design versus test of effectiveness, population completeness and sample-based testing.
• Experience with access reviews and segregation of duties in an ERP, preferably SAP.
• Clear written English for audit evidence and for correspondence with US auditors.
• CISA, CIA or an equivalent certification preferred.
• Amenable to work in Valero, Makati City
• Amenable to work in graveyard shift schedule and hybrid setup (3 day office, 2 days remote)