Senior Staff IT Controls, Enterprise Applications

Gusto • San Francisco, CA;Seattle, WA • 1d ago

Why This Job is Featured on The SaaS Jobs

This Senior Staff IT Controls role stands out in SaaS because it sits at the intersection of public company compliance expectations and the reality of modern, highly integrated SaaS enterprise stacks. The remit spans core systems that underpin subscription operations and reporting, including ERP, HRIS, and CRM, with clear ownership of ITGCs and SOX 404 readiness across those platforms.

For a long-term SaaS career, the role offers durable leverage: building controls that scale with business complexity, partnering across Security, Finance, and application owners, and shaping how assurance work evolves as automation becomes more common. The emphasis on continuous controls monitoring and AI-augmented testing reflects a broader shift in SaaS toward reducing manual evidence cycles and moving governance closer to day-to-day system operations. Experience here tends to translate across SaaS companies that run on similar enterprise application ecosystems and face recurring audit and risk demands.

This position fits professionals who prefer high-accountability individual contributor scope, enjoy translating between auditors and builders, and are motivated by designing practical governance rather than policing after the fact. It will particularly suit someone comfortable owning end-to-end control outcomes while influencing how teams implement access, change management, and monitoring in production systems.

The section above is editorial commentary from The SaaS Jobs, provided to help SaaS professionals understand the role in a broader industry context.

Job Description

About the Role:

As the Senior Staff IT Controls you will own, evolve, and scale IT General Controls (ITGCs) across Gusto's enterprise application ecosystem including NetSuite, Workday, Salesforce, and adjacent platforms, serving as the single point of accountability for ITGC design, testing, remediation, and audit readiness. Sitting within the Enterprise Applications organization, you will partner closely with Internal Audit, IT, Security, and Finance to ensure Gusto meets SOX 404 compliance requirements while strengthening our broader risk posture. You will not only maintain a best-in-class controls environment, but will also pioneer the use of AI and automation to make controls testing faster, smarter, and more continuous, transforming assurance from a periodic, manual exercise into a scalable, intelligent capability. In line with Gusto's enterprise risk management strategy, you will reduce manual effort across the compliance lifecycle while raising the bar on control precision and coverage as the company scales. This is a senior, high-impact individual contributor role that blends deep IT controls expertise with a forward-looking vision for AI-augmented assurance, combining technical rigor, cross-functional partnership, and strategic systems thinking to build a controls function that is both audit-ready and future-proof.

About the Team:

This role will report to the Enterprise AIT team, a group focused on driving the intelligent transformation of Gusto’s enterprise systems. The Enterprise AIT team is responsible for integrating AI, automation, and advanced analytics across our internal applications ecosystem to improve scalability, efficiency, and decision-making. Partnering closely with Finance, Business Ops, IT, and Security, the team enables Gusto’s enterprise systems to become smarter, more predictive, and more adaptive. This is a new role, designed to expand the team’s capacity to operationalize AI within enterprise workflows and support Gusto’s broader Enterprise Systems strategy.

Here’s what you’ll do day-to-day:

Own ITGC design and operation across enterprise applications — including logical access, change management, SDLC, computer operations, and segregation of duties (SoD).
Lead the 1st-line control environment for in-scope enterprise applications, partnering with application owners and engineering leads to embed controls into operational workflows rather than bolting them on.
Drive SoD strategy across ERP, HRIS, and CRM — including role design reviews, conflict remediation, mitigating control design, and ongoing monitoring tooling (e.g., Pathlock, SailPoint, Saviynt, native role analyzers).
Manage the audit lifecycle as the primary 1st-line liaison with Internal Audit, External Audit, and the SOX PMO — walkthroughs, evidence collection, deficiency remediation, and management responses.
Build AI-native continuous controls monitoring — including LLM-based evidence review, agentic control testing, and automated anomaly surveillance — to eliminate manual evidence collection, shift controls left, and surface exceptions in near real time. Treat AI agents as control operators with the same evidence and validation expectations as human operators.
Own the controls posture for Gusto's internal AI and automation portfolio. Partner with AI-builder teams across the company (Finance & BizOps, GRC, Engineering) to review internal AI use cases, classify by risk category, and ensure controls, evidence trails, and validation travel with the build — not bolted on after launch. Be the senior 1st-line owner for "do our internal AI builds meet our control standards?
Lead access governance including provisioning/deprovisioning workflows, periodic user access reviews (UARs), privileged access management, and integration with the IGA platform.
Govern application change management for in-scope systems — approvals, segregation between developers and production, emergency change handling, and release evidence.
Mature the controls program by leading rationalization initiatives, control consolidation, and the adoption of automated/preventive controls over manual/detective ones.
Partner cross-functionally with Security/GRC, Legal, Finance/Accounting, People Operations, and Revenue Operations to ensure controls support — rather than impede — the business.

Here’s what we're looking for:

10+ years of experience in IT controls, audit, or enterprise applications governance, with a strong hands-on background operating in the 1st line of defense as a control owner across NetSuite, Workday, and/or Salesforce.
Deep expertise in SOX 404, COSO, COBIT, and ITGC frameworks, including segregation of duties (SoD) design and remediation across ERP, HRIS, and CRM environments.
Proven track record leading external audit engagements (Big 4 or equivalent) as the management-side owner, with public company or IPO readiness experience preferred.
Demonstrated experience building and deploying AI-augmented controls work including agents, LLM-based reviewers, or automated anomaly detection, with the ability to design controls both for and with AI systems.
Strong judgment on AI risk, including model risk, prompt injection, output validation, and audit trail design, with hands-on familiarity with agentic tooling such as Claude Code, MCPs, or LLM-based evidence pipelines.
Excellent communicator who can translate complex control concepts for executives, auditors, and engineers, with experience in continuous controls monitoring (CCM) and data-driven assurance approaches.
Relevant certifications (CISA, CISSP, CIA, CPA, or equivalent) and familiarity with adjacent frameworks including SOC 1/2, ISO 27001, NIST CSF, and PCI DSS are a plus.

Our cash compensation amount for this role is targeted at $175,000-$195,000 /yr in Denver & most remote locations, and $205,000-$225,000 /yr for San Francisco, Seattle & New York. Final offer amounts are determined by multiple factors, including candidate experience and expertise, and may vary from the amounts listed above.

Related Jobs

Head of Product, Payroll

Gusto • Remote (Denver, CO;San Francisco, CA;New York, NY;Los Angeles, CA;Seattle, WA;Toronto, Ontario, CAN - Remote) • 2w ago

Finance Senior level

2w ago

Apply

Senior Data Engineer

Gusto • Remote (Denver, CO;San Francisco, CA;New York, NY;Los Angeles, CA;Seattle, WA;Toronto, Ontario, CAN - Remote) • 2w ago

Engineering Senior level

2w ago

Apply

Senior Technical Success Manager - West

Amplitude • Remote (Los Angeles, CA; Portland, OR; Remote - West; San Diego, CA; San Francisco, CA; Seattle, WA) • 1m ago

Customer Success Senior level

1m ago

Apply

Group Creative Director, Copy

Gusto • Denver, CO;San Francisco, CA;New York, NY;Los Angeles, CA;Seattle, WA • 1m ago

Senior level

1m ago

Apply

Senior Software Engineer, Data Platform

Gusto • Remote (Denver, CO;San Francisco, CA;New York, NY;Los Angeles, CA;Seattle, WA;Toronto, Ontario, CAN - Remote) • 1m ago

Engineering Senior level

1m ago

Apply

Senior Staff Software Engineer, Developer Productivity Async

Gusto • Remote (Denver, CO;San Francisco, CA;New York, NY;Atlanta, GA;Austin, TX;Chicago, IL;Los Angeles, CA;Seattle, WA;Toronto, Ontario, CAN - Remote) • 1m ago

Engineering Senior level

1m ago

Apply