About Nebius
Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.
Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking, and applied AI.
Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America, and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software, and AI R&D.
The Role
Nebius is seeking an IT Risk & Controls Manager to act as an embedded risk partner to our engineering and technology organizations.
You will help scale and strengthen a modern IT SOX and controls framework across Nebius’s custom-built AI cloud platform, infrastructure, corporate technology environment, and other systems supporting financial reporting.
This role goes beyond traditional IT audit testing. You will work directly with engineering leaders, system owners, Finance, Internal Controls, and external auditors to identify risk, design scalable controls, improve evidence quality, drive remediation, and embed compliance into the way our technology organizations operate.
The successful candidate will combine deep IT risk and controls expertise with meaningful in-house technology experience. You must be equally comfortable discussing technical control design with engineers, explaining risk implications to business leaders, and aligning audit expectations with external assurance providers.
Your Responsibilities
- Act as a Risk and Controls Partner: Support an assigned technology organization or system portfolio, developing a detailed understanding of its architecture, operations, risks, and financial-reporting dependencies.
- Own the IT Risk and Control Framework: Continuously improve the relevant framework, including system scoping, risk assessment, RCM and control-catalogue maintenance, documentation, and control ownership.
- Lead IT SOX Readiness: Coordinate readiness for assigned systems, including walkthrough preparation, evidence-quality reviews, testing coordination, issue evaluation, and remediation oversight.
- Partner with Technology Teams: Work with engineering, platform, infrastructure, security, and corporate IT teams to design and implement scalable controls that address risk while supporting operational efficiency.
- Design and Enhance IT General Controls (ITGCs): Assess controls across user access, privileged access, segregation of duties, change management, SDLC, system operations, incident management, and third-party services.
- Assess Application and Automated Controls: Evaluate IT application controls, automated controls, and IT-dependent business controls, including the completeness and accuracy of system-generated information used in business-process controls.
- Evaluate System Dependencies: Assess how business controls depend on systems, integrations, configurations, reports, and underlying ITGCs, working with business and IT control owners to resolve gaps.
- Support Modern Engineering Practices: Apply risk and controls thinking to cloud infrastructure, DevOps, CI/CD, repositories, deployment processes, containerized environments, and audit logging.
- Lead Control Gap Remediation: Assess and remediate control gaps arising from new systems, major technology transformations, platform changes, integrations, and acquisitions.
- Review Third-Party Assurance: Evaluate third-party assurance reports and determine the impact of vendor controls and complementary user-entity controls on the Nebius control environment.
- Manage External Audit Relationships: Align with external auditors and advisers on audit scope, evidence expectations, testing approaches, reliance opportunities, timelines, and issue resolution.
- Translate Technical Risks into Practical Guidance: Explain complex technical risks and auditor requirements clearly to engineering teams and system owners.
- Drive Automation and Continuous Improvement: Use data analytics, automation, continuous monitoring, and AI-assisted tools to improve control coverage, evidence quality, and the efficiency of the IT SOX program.
- Develop Controls Methodology: Contribute to IT controls methodology, standards, tooling, training, reporting, and the broader Risk Partner operating model.
- Report on Control Health: Provide clear, concise updates on control health, audit readiness, deficiencies, and remediation progress to senior technology and Finance stakeholders.
What We Expect You to Have
- Education: A degree in Information Systems, Computer Science, Engineering, Accounting, Finance, or a related discipline, or equivalent professional experience.
- Relevant Experience: At least eight years of progressive experience in IT risk, IT controls, IT SOX, technology assurance, IT audit, or a closely related area.
- In-House Technology Experience: Meaningful in-house technology or corporate ownership experience is required. Big Four or consulting experience is valuable when combined with subsequent in-house responsibility, but an exclusively advisory or external-audit background will not be sufficient.
- First-Line or Embedded Risk Experience: Experience working in a first-line technology, engineering, systems, or IT operations role, or as an embedded in-house risk partner supporting a technology organization.
- Technology Environment: Hands-on experience in an engineering-led technology, cloud, SaaS, platform, or digital-product environment.
- IT Controls Expertise: Strong practical knowledge of SOX 404, ITGCs, IT application controls, automated controls, COSO, and COBIT.
- Control Lifecycle Management: Demonstrated experience with control design, implementation, monitoring, evidence review, audit readiness, issue evaluation, and remediation.
- Modern Technology Knowledge: Practical understanding of cloud infrastructure, IAM, DevOps, CI/CD, SDLC, software repositories, deployment practices, system integrations, and container orchestration such as Kubernetes.
- Business and IT Control Dependencies: Experience connecting business-process controls to supporting systems, automated controls, IPEs/IUCs, and underlying IT dependencies.
- Communication Skills: The ability to communicate effectively with engineers, technical leaders, Finance stakeholders, and external auditors.
- Sound Judgment: Strong judgment and the confidence to challenge control owners while developing practical, scalable solutions.
- Autonomy and Ownership: A highly autonomous and hands-on approach, with the ability to operate effectively in an evolving environment with incomplete processes and competing priorities.
- English Proficiency: Strong written and verbal English.
- International Collaboration: The ability to work effectively across international time zones and travel when needed to build relationships with key technology and audit stakeholders.
It Will Be an Added Bonus If You Have
- Professional Certifications: A certification such as CISA, CRISC, CISM, CIA, CPA, or an equivalent qualification.
- IT SOX Transformation: Experience building or materially transforming an IT SOX or technology-controls framework in a listed or pre-IPO technology company.
- Engineering-Intensive Industries: Experience in AI infrastructure, cloud platforms, large-scale SaaS, fintech, marketplaces, or another engineering-intensive environment.
- GRC and Audit Tools: Experience with GRC and audit-management platforms such as Workiva, Jira, ServiceNow GRC, or similar tools.
- Enterprise SaaS and Financial Systems: Experience with systems such as NetSuite, HR platforms, billing systems, procurement tools, or treasury systems.
- Acquisitions and New Systems: Experience onboarding acquired companies or newly implemented systems into SOX scope.
- Control Automation: Experience with control automation, continuous monitoring, data analytics, or AI-assisted assurance.
- AI Governance: Exposure to AI governance, AI/ML control environments, or controls supporting AI-enabled development and operations.
Benefits & Perks
- Competitive Compensation: Receive competitive compensation for your expertise and contributions.
- Career Growth and Learning: Access opportunities to develop your skills and advance your career.
- Flexibility and Ownership: Enjoy flexibility and the opportunity to take ownership of your work.
- Collaborative and Innovative Culture: Work in an environment that encourages collaboration, innovation, and new ideas.
- Impactful AI Projects: Contribute to meaningful projects shaping the future of AI infrastructure.
- International Environment: Collaborate with talented teams across countries and disciplines.
What’s It Like to Work at Nebius?
- Fast moving
- Bold thinking
- Constant growth
- Meaningful impact
- Trust and real ownership
- Opportunity to shape the future of AI
Equal Opportunity Statement
Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment.
We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law.
Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire.
If you need accommodations during the application process, please let us know.
