Sr. ITGC / IT SOX Analyst

Datavant is a data platform company and the world’s leader in health data exchange. Our vision is that every healthcare decision is powered by the right data, at the right time, in the right format.

Our platform is powered by the largest, most diverse health data network in the U.S., enabling data to be secure, accessible and usable to inform better health decisions. Datavant is trusted by the world’s leading life sciences companies, government agencies, and those who deliver and pay for care. 

By joining Datavant today, you’re stepping onto a high-performing, values-driven team. Together, we’re rising to the challenge of tackling some of healthcare’s most complex problems with technology-forward solutions. Datavanters bring a diversity of professional, educational and life experiences to realize our bold vision for healthcare.

What We’re Looking For

As a Sr ITGC / IT SOX Analyst (GRC) within the Security Governance, Risk, and Compliance (GRC) organization, you will lead implementation, remediation, and ongoing management of Information Technology General Controls (ITGCs) within our organization. This is a hands-on role suited for a self-starter who enjoys solving problems, collaborating cross-functionally, and ensuring compliance excellence in a fast-paced environment.This role will be responsible for ensuring that our IT processes and controls are maintained, compliant with regulatory standards, and aligned with best practices. This role reports to the Sr Manager of IT Assurance (Security GRC) and will work cross-functionally with IT, GRC, Information Security, Finance, and Compliance teams to address any ITGC deficiencies and assessments to drive continuous improvement in compliance programs.

What You Will Do

•  ITGC Program Execution
• Lead and monitor ITGC testing (access, change management, computer operations, backup/recovery, interfaces).
• Execute walkthroughs, control design assessments, and test-of-one/ongoing effectiveness procedures.
• Validate completeness and accuracy (C&A) for key reports and data flows; assess IPE.
• Controls Design & Remediation
• Advise on control design and documentation (risk/control matrices, narratives, process maps).
• Track deficiencies; partner on root cause analysis and target-state remediation plans.
• Independently verify remediation effectiveness and maintain evidence quality.
• Stakeholder Management
• Coordinate with external auditors and co-sourced providers; align on scope, reliance, and timelines.
• Communicate findings and status to management; escalate risks proactively.
• Governance & Continuous Improvement
• Maintain ITGC program artifacts (RACM, population and sample evidence, issue logs).
• Contribute to controls automation, segregation of duties (SoD) governance, and periodic access recertifications.
• Support IT policy/standard refreshes and control rationalization.
• Assessment Execution
• Perform end-to-end assessment: scoping, risk & control assessments, test plans, fieldwork, and reporting.
• Assess IT processes including identity & access management, change/release management, backup/recovery, incident/problem management, vulnerability management, patching, disaster recovery/business continuity, interfaces/integrations, and data quality.
• Perform cybersecurity-themed reviews (e.g., endpoint security, logging/monitoring, vulnerability & patch management, configuration baselines).
• Advisory & Continuous Improvement
• Provide practical recommendations that balance risk with operational realities.
• Monitor remediation progress; validate closure and sustainment of fixes.
• Support integrated audits with operational/financial teams; contribute to annual risk assessment and audit plan.
• Reporting & Governance
• Draft clear reports with prioritized findings, risk ratings, and management action plans.
• Present results to stakeholders; communicate clearly to technical and non-technical audiences.
• Maintain audit methodology and working papers to internal standards; support QA reviews.

What You Need to Succeed

• 4+ years of progressively responsible  IT General Controls experience via IT audit/assurance, SOX 404 testing, or IT risk & controls (Big 4 or industry).
• Hands-on experience testing ITGCs and automated application controls; working with internal and external auditors.
• Strong understanding of access management, change management, computer operations, IPE/C&A, and segregation of duties.
• Excellent communication skills—you can explain control requirements to engineers and translate technical speak for a