SOX and Compliance Analyst

About the Company

Responsibilities

• ● McKesson is an impact-driven, Fortune 10 company that touches virtually every aspect of healthcare. We are known for delivering insights, products, and services that make quality care more accessible and affordable. Here, we focus on the health, happiness, and well-being of you and those we serve - we care.
• ● What you do at McKesson matters. We foster a culture where you can grow, make an impact, and are empowered to bring new ideas. Together, we thrive as we shape the future of health for patients, our communities, and our people. If you want to be part of tomorrow's health today, we want to hear from you.
• ● McKesson is seeking a SOX and Compliance Analyst to support enterprise governance, risk, and compliance initiatives across SAP, Identity Governance, Cybersecurity, and Internal Controls. This role will be responsible for administering SAP GRC platforms, supporting SOX compliance activities, managing user access governance processes through SailPoint, producing cybersecurity compliance reporting, and partnering with internal and external auditors to strengthen the organization's control environment.
• ● The ideal candidate combines technical expertise, compliance knowledge, and analytical problem-solving skills to improve control effectiveness, reduce risk, and support regulatory compliance across the enterprise. This position operates within McKesson's Governance, Risk, and Compliance (GRC) organization and collaborates with Information Security, Internal Audit, Application Teams, and Business Stakeholders.
• ● What You'll Do
• ● Administer and support SAP GRC Access Control and Process Control solutions, including user provisioning, access requests, emergency access management, and Segregation of Duties (SoD) monitoring.
• ● Execute SOX ITGC and automated control testing activities, including evidence collection, documentation, validation, and issue tracking.
• ● Support SailPoint Identity Governance & Administration (IGA) processes, user access reviews, certification campaigns, role management, and provisioning workflows.
• ● Develop and maintain cybersecurity compliance dashboards, risk reports, vulnerability tracking metrics, and executive reporting.
• ● Partner with Information Security teams to monitor remediation efforts for identified vulnerabilities and control deficiencies.
• ● Coordinate internal and external audit activities, provide audit evidence, and support walkthroughs and testing requests.
• ● Track control exceptions and drive remediation plans through closure while ensuring compliance with internal policies and regulatory requirements.
• ● Identify opportunities to improve governance, compliance, automation, and operational effectiveness across GRC processes.
• ● Basic Requirements
• ● + years of experience in IT Governance, Risk & Compliance (GRC), IT Audit, SOX Compliance, Cybersecurity Compliance, Identity & Access Management, or related fields.
• ● Bachelor's degree in Information Systems, Information Security, Computer Science, Accounting, Risk Management, Business Administration, or a related field; or equivalent combination of education and experience.
• ● Hands-on experience administering SAP GRC Access Control and/or SAP Process Control.
• ● Knowledge of IT General Controls (ITGC), access governance, Segregation of Duties (SoD), and regulatory compliance frameworks.
• ● Strong analytical, communication, documentation, and stakeholder management skills.
• ● Preferred Skills/Experience