Business Controls Testing Senior Analyst

The Role

The First Line of Defense (1LOD) Business Controls Testing (BCT) team executes independent, evidence-based control testing to evaluate the design and operating effectiveness of SoFi’s internal controls across in-scope business processes.

As a Business Controls Testing Senior Analyst, you will independently plan and execute complex control reviews, partner with business and control owners, and communicate clear, well-supported results. You will apply sound risk judgment to identify control gaps, evaluate potential impacts, and drive timely resolution activities. This role requires a strong command of control testing methodology, the ability to navigate ambiguity, and an effective, solutions-oriented approach to stakeholder management.

What You’ll Do

• Execute design effectiveness and operating effectiveness testing, including transactional testing, in accordance with the 1LOD BCT Playbook, procedures, and applicable policies.
• Lead control-owner engagement throughout the testing lifecycle, including walkthroughs, test-script development, evidence requests, status updates, and results discussions.
• Assess processes, risks, controls, data, and documentation to identify weaknesses, gaps, or vulnerabilities; determine whether controls are appropriately designed and operating effectively.
• Produce complete, accurate, and timely workpapers, testing reports, findings, and supporting documentation in required trackers and systems of record, including AuditBoard.
• Clearly articulate testing results, risk implications, and recommended actions to control owners, business partners, management, and other stakeholders.
• Drive accountability for timely evidence submission, issue remediation, and follow-up activities; perform validation or re-performance testing, as needed.
• Partner with issue management and control owners to support the development of actionable remediation plans, milestones, owners, and timelines for identified control failures.
• Exercise judgment in resolving diverse and complex testing issues; proactively identify roadblocks, communicate risks and downstream implications, and propose practical, principle-based solutions.
• Maintain productive relationships across product, process, and control-owner teams, as well as 1LOD Risk & Business Controls and Enterprise Risk Management partners.
• Conduct peer quality-assurance reviews, provide constructive feedback, and contribute to consistent application of BCT methodology and documentation standards.
• Support onboarding, training, cross-training, and knowledge sharing for team members.
• Contribute to cross-functional initiatives and continuous-improvement efforts that strengthen testing processes, reporting, and the overall control environment.

What You’ll Need

• 5+ years of relevant experience in risk management, internal controls, control testing, audit, quality assurance, compliance, or a related field; experience in financial services, banking, fintech, or another regulated environment is strongly preferred.
• Demonstrated experience executing control design and operating effectiveness testing, including writing or using test scripts, performing transactional testing, assessing evidence, and documenting results.
• Strong understanding of operational risk management, internal controls, control design, issue remediation, and control-testing methodologies.
• Ability to independently manage a portfolio of testing activities, prioritize competing deadlines, and provide proactive status updates and timely escalations.
• Strong analytical and problem-solving skills, including the ability to use data to assess risk, reach evidence-based conclusions, and recommend pragmatic solutions.
• Excellent written and verbal communication skills, with the ability to distill complex control and risk concepts for varied audiences and facilitate productive stakeholder discussions.
• Proven ability to build trust, influence without direct authority, and drive shared accountability in a cross-functional, matrixed environment.
• High attention to detail, sound judgment, intellectual curiosity, and a continuous-improvement mindset.
• Proficiency with Microsoft Office and Google Workspace, particularly Excel/Google Sheets; experience with GRC platforms such as ServiceNow/AuditBoard is preferred.
• Bachelor’s degree or equivalent practical experience.

Preferred Qualifications

• Experience in a first-line risk and controls, operational risk, internal audit, or second-line risk function.
• Experience supporting risk and control self-assessments (RCSAs), issue management, remediation validation, or regulatory/exam readiness.
• Experience testing and deep understanding of technical/ITGC/InfoSec related controls.
• Professional certification or progress toward certification, such as CIA, CISA, CRCM, CRCM, CPA, or equivalent.