Senior IT Auditor

About Ethos Ethos is a leading life insurance technology company on a mission to protect families by democratizing access to life insurance and empowering agents at scale. With its robust three-sided technology platform, Ethos is transforming the life insurance experience for consumers, agents, and carriers alike. Ethos offers instant, accessible products and a seamless online process that requires no medical exams and just a few health questions; it eliminates traditional barriers, making it easier than ever for everyone to protect their families. Ethos is redefining how life insurance is bought, sold, and underwritten. About the role: The Senior GRC Analyst is responsible for supporting the organization s information security governance, risk, and compliance activities. This role involves ensuring that the organization’s security policies, procedures, and practices are aligned with regulatory requirements, industry standards, and best practices. The ideal candidate will have a strong understanding of information Security and Privacy principles, Third Party Vendor Risk management, ITGC and SOC2 audit controls, and the ability to communicate complex security issues to various stakeholders. Duties and Responsibilities: 1. Audit Governance and Strategy Evaluate the design and effectiveness of IT governance frameworks to ensure compliance with SOX 404 and organizational objectives. Ensure alignment of IT controls with business objectives and regulatory requirements. Perform independent assessments of the IT control environment to identify gaps in the governance structure. 2. SOX Compliance and Internal Controls Lead the end-to-end execution of IT General Controls (ITGC) testing across domains including Logical Access, Change Management, and IT Operations. Perform walkthroughs and testing of Automated Application Controls and Manual-Dependent Controls to ensure system-generated data is reliable. Assess Segregation of Duties (SoD) within key ERP systems and financial applications, identifying and validating mitigating controls where necessary. Execute rigorous testing of Information Produced by Entity (IPE) and Information Used in Control (IUC) to ensure completeness and accuracy. Perform SOC 1 and SOC 2 Type II report evaluations, specifically mapping Complementary User Entity Controls (CUECs) to internal control environments. Identify, document, and communicate control deficiencies (SD/MW) to stakeholders and track remediation efforts to completion. 3. Risk