Platform SOX Risk Analyst

Platform SOX Risk Analyst

Bengaluru, India

R000074755

At Chevron Engineering and Innovation Excellence Center (ENGINE) in Bengaluru, we leverage India’s advanced engineering and digital capabilities to develop scalable, data-driven solutions for energy challenges. By integrating global expertise with local innovation, our teams are helping to meet the global energy demands of today and build the lower carbon energy systems of tomorrow.

Full-Time

8+ years of experience

success profile

At Chevron, we are dedicated to the success of our teams – we believe these attributes enhance the team to thrive in an inclusive, collaborative and innovative environment.

• Collaborative
• Detail-oriented
• Organized
• Proactive
• Strategic
• Adaptable

Culture

At Chevron India, culture is defined by collaboration, innovation, and a shared commitment to solving the world’s energy challenges. Employees are encouraged to think boldly, work across disciplines, and contribute to projects that have real-world impact. Whether it’s through advanced engineering, digital transformation, or operational excellence, team members are empowered to bring their best ideas forward.

The Bengaluru based Chevron ENGINE is a hub for technical talent, where professionals thrive in a dynamic, inclusive environment. Chevron fosters a workplace where continuous learning, and career growth are prioritized. Employees are supported with competitive benefits, leadership development, and a strong sense of purpose—knowing their work contributes to a lower carbon energy future.

hear from our people

our greatest strength lies in the diversity and dedication of our people. From our ENGINE center in Bengaluru to our operations across the country, our talented professionals bring deep expertise and a collaborative spirit to every task. Together, we ensure the safety, efficiency, and continuity of our work—driving innovation and excellence in everything we do.

benefits

• Competitive

• Salaries

• Annual incentive

• awards

• Health care

• coverage and life

• insurance

• Time off (Paid

• vacations and

• holidays)

• Retirement

benefits

• Recognition and

• service award

• programs

• Platform SOX Risk Analyst

• Bengaluru, India

• R000074755

About the Company

The Chevron Engineering and Innovation Excellence Center (ENGINE) in Bengaluru India brings together the resources and expertise of the Chevron global network with talent in India to enhance agility and technological innovation to optimize solutions for the world’s current and future energy challenges. As one of the leading energy providers worldwide, Chevron is involved in the production of crude oil and natural gas, manufacturing of transportation fuels, lubricants, petrochemicals, and additives, and the development of enabling technologies.

Chevron's vision is to be the global energy company most admired for its people, partnerships, and performance. With a clear purpose to develop affordable, reliable, ever-cleaner energy that enables human progress, we believe human ingenuity has the power to solve any challenge and overcome any obstacle. Meeting the world’s growing energy needs requires the pursuit of innovations and advancements that deliver a better future for all.

About the Position

This role will report into the IT Risk Manager at Chevron Engine, India.

Key Responsibilities

• SOX Compliance Analysis and Enforcement of IT Controls

• Analyze and monitor compliance with SOX 404 requirements for assigned IT processes, applications, platforms, and Process 20 General IT Controls.

• Evaluate whether assigned controls are appropriately designed to mitigate identified financial-reporting risk and whether controls operate as designed.

• Assess local application of global control designs; review control performance, evidence, test results, and documentation for completeness, accuracy, and supportability to third parties.

• Apply appropriate testing methods and population and sampling concepts; analyze results and identify design or operating deficiencies.

• Enforce control requirements by challenging incomplete, insufficient, late, or noncompliant execution and escalating unresolved compliance gaps through established governance channels.

• Analyze and validate the impact of ineffective controls; support root-cause analysis, quantification, remediation planning, retesting, and closure of deficiencies.

• Monitor remediation plans and retesting efforts for ineffective controls and verify that corrective actions are sustainable and completed within required timeframes.

• Coordinate and complete SOX reporting requirements; monitor testing activities and communicate progress, exceptions, and emerging concerns to relevant stakeholders.

• Maintain accurate SOX documentation, including control narratives, risk/control matrices, flowcharts, testing support, evidence, and remediation records, in accordance with applicable retention requirements.

• Use SOX reporting and analytics capabilities to evaluate assessment accuracy and completeness, detect trends, and support management reporting.

• Participate in annual scoping and risk reviews, including consideration of changes to business processes, applications, systems, organizations, and major projects.

• Advise control owners and performers on evidence requirements, control execution expectations, and remediation of ineffective controls; identify training needs and reinforce consistent SOX testing practices.

• IT Cybersecurity Risk Management Service Execution

• Execute risk management services for assigned digital platforms or business areas, including risk assessments, IRM planning, risk-register maintenance, policy exception support, vulnerability and assessment remediation coordination, and risk tracking and reporting.

• Analyze business and technical risks and translate them into clear business language, actionable mitigation plans, and decision-quality information for stakeholders.

• Monitor execution of risk and remediation plans, challenge overdue or ineffective actions, and escalate priority conflicts or material concerns to the Risk Manager.

• Engage architecture, cybersecurity, and platform teams to encourage secure-by-design solutions and alignment of security requirements with enterprise and solution architectures.

• Promote consistent use of risk management processes, systems of record, metrics, and reporting.

• Stakeholder Engagement, Reporting, and Continuous Improvement

• Engage Platform Technical Managers, Product Line Managers, Finance, Internal Controls, Corporate Audit, external audit support teams, Compliance, and other stakeholders to align on SOX and risk priorities.

• Provide regular, fact-based reporting on control status, testing progress, deficiencies, remediation, compliance performance, and representation-letter matters.

• Establish and document SOX compliance procedures with relevant stakeholders; periodically review processes and recommend practical improvements that increase quality, consistency, efficiency, and sustainability.

• Support awareness and training for control owners, control performers, assessors, and other stakeholders on SOX-IT responsibilities and documentation expectations.

• Maintain current knowledge of SOX, internal controls, cybersecurity risk, technology controls, and relevant company requirements.

• Required Qualifications

• Demonstrated experience of 3 to 5 years in applying Sarbanes-Oxley Section 404 requirements to information technology processes, systems, applications, or technology-dependent financial controls.

• Demonstrated experience evaluating the design and operating effectiveness of General IT Controls, including controls relevant to access, change management, technology operations, interfaces, automated processing, or other assigned SOX-IT control areas.

• Practical experience performing or reviewing SOX control assessments using inquiry, observation, inspection, and limited re-performance, with inquiry supplemented by corroborating evidence.

• Demonstrated ability to evaluate control populations, sampling approaches, test procedures, evidence, exceptions, and conclusions for completeness, accuracy, consistency, and audit supportability.

• Preferred Qualifications

• Experience distinguishing design deficiencies from operating deficiencies and supporting deficiency evaluation, root-cause analysis, impact assessment, remediation planning, retesting, and closure.

• Experience preparing and maintaining control narratives, process flowcharts, risk and control matrices, assessment workpapers, evidence, deficiency records, and remediation documentation.

• Experience using governance, risk, compliance, or SOX management platform to maintain control information, document t