Sarbanes Oxley Consultant

Senior Consultant – SOX Controls (Privileged Access Management)

Millenilink is hiring a hands-on Senior Consultant – SOX Controls (PAM) to support our consulting client on a cybersecurity and compliance engagement with a large Canadian financial services organization.

The successful consultant will assess existing SOX-related controls, evaluate Privileged Access Management (PAM) capabilities, and help define practical use cases, target-state, recommendations, and an implementation roadmap across a complex, decentralized enterprise environment.

This is a consulting and advisory engagement requiring a strong combination of SOX/ITGC knowledge, technical PAM expertise, and stakeholder engagement skills.

• Duration: Approximately 11 weeks, with an immediate start
• Location: Remote, Canada
• Working Hours: Approximately 40 hours per week, aligned with Montreal business hours, with flexibility in scheduling
• Language: English required; French is an asset but not mandatory

Key Responsibilities

• Assess existing SOX-related controls, identify gaps, and evaluate compliance requirements related to privileged access.
• Facilitate workshops and discovery sessions with business, cybersecurity, infrastructure, and technology stakeholders.
• Define PAM use cases, target-state requirements, recommended actions, and a practical roadmap.
• Evaluate the feasibility of proposed controls across diverse technology environments, including privileged account vaulting and password rotation.
• Apply knowledge of PAM architecture, IT General Controls (ITGCs), enterprise processes, and information flows to develop practical recommendations.
• Identify technical and operational considerations that could affect the adoption of proposed PAM controls.
• Document findings, recommendations, action plans, and roadmap deliverables.
• Communicate leading practices and recommendations clearly while accounting for the client's existing technology landscape and organizational structure.

Required Qualifications

• Strong experience with SOX compliance, ITGCs, and technology control frameworks , particularly as they relate to privileged access.
• Hands-on technical or solution-design experience with Privileged Access Management (PAM) , including implementation, architecture, or technical assessments.
• Practical knowledge of privileged account vaulting, password rotation, and associated technical dependencies.
• Ability to evaluate the feasibility of PAM controls across different technology stacks and enterprise environments.
• Strong understanding of enterprise architecture, access management processes, and information flows.
• Experience facilitating client workshops, gathering requirements, and translating findings into actionable recommendations.
• Excellent communication, documentation, and stakeholder management skills.
• Ability to navigate complex, decentralized organizations and collaborate with multiple business and technology teams.

Additional Assets

• Previous experience supporting financial services organizations or other highly regulated enterprises.
• Experience contributing to SOX remediation initiatives, PAM assessments, or control improvement roadmaps.

Engagement Scope

This engagement is focused on assessment, advisory, solution definition, and roadmap development , rather than hands-on technical implementation.

The consultant will be expected to understand the technical implications of proposed PAM controls and recommend feasible solutions. However, executing technical tests, implementing account vaulting, or configuring PAM solutions is not currently within scope.

Candidates with a purely compliance-auditing background, without practical PAM technical or architectural experience, will not be a fit.