AI/IT Controls Engineer, Enterprise Applications

Gusto is a payroll, benefits, and HR platform for small businesses, supporting over 500,000 businesses nationwide. All full-time employees receive competitive base pay, benefits, and equity (RSUs).

Own, evolve, and scale IT General Controls (ITGCs) across Gusto's enterprise application ecosystem including NetSuite, Workday, Salesforce, and adjacent platforms. Serve as the single point of accountability for ITGC design, testing, remediation, and audit readiness, partnering with Internal Audit, IT, Security, and Finance to ensure SOX 404 compliance. Pioneer the use of AI and automation to make controls testing faster, smarter, and more continuous.

• Own ITGC design and operation across enterprise applications, including logical access, change management, SDLC, computer operations, and segregation of duties (SoD).
• Lead the 1st-line control environment for in-scope enterprise applications, embedding controls into operational workflows.
• Drive SoD strategy across ERP, HRIS, and CRM, including role design reviews, conflict remediation, and monitoring tooling (e.g., Pathlock, SailPoint, Saviynt).
• Manage the audit lifecycle as the primary 1st-line liaison with Internal Audit, External Audit, and the SOX PMO.
• Build AI-native continuous controls monitoring, including LLM-based evidence review, agentic control testing, and automated anomaly surveillance.
• Own the controls posture for Gusto's internal AI and automation portfolio, reviewing internal AI use cases and ensuring controls travel with the build.
• Lead access governance including provisioning/deprovisioning workflows, periodic user access reviews (UARs), and privileged access management.
• Govern application change management for in-scope systems, including approvals and release evidence.
• Mature the controls program through rationalization, consolidation, and adoption of automated/preventive controls.

• 10+ years of experience in IT controls, audit, or enterprise applications governance, with hands-on background as a control owner across NetSuite, Workday, and/or Salesforce.
• Deep expertise in SOX 404, COSO, COBIT, and ITGC frameworks, including SoD design and remediation.
• Proven track record leading external audit engagements (Big 4 or equivalent) as management-side owner.
• Demonstrated experience building and deploying AI-augmented controls work including agents, LLM-based reviewers, or automated anomaly detection.
• Strong judgment on AI risk, including model risk, prompt injection, output validation, and audit trail design, with familiarity with agentic tooling such as Claude Code, MCPs, or LLM-based evidence pipelines.
• Excellent communication skills to translate complex control concepts for executives, auditors, and engineers.
• Relevant certifications (CISA, CISSP, CIA, CPA, or equivalent) and familiarity with SOC 1/2, ISO 27001, NIST CSF, and PCI DSS are a plus.

Cash compensation is targeted at $205,000-$220,000/yr in Denver & most remote locations, and $245,000-$265,000/yr for San Francisco, Seattle & New York. All full-time employees receive competitive base pay, benefits, and equity (RSUs).

Apply through the Gusto Greenhouse job board.