About Estée Lauder Companies

The Estée Lauder Companies is the global leader in prestige beauty - delighting consumers with transformative products and experiences, inspiring them to express their individual beauty. We are the only company focused solely on prestige makeup, skin care, fragrance, and hair care with a diverse portfolio of 25+ brands sold in approximately 150 countries and territories. Infused throughout our organization is a passion for creativity and imagination - a desire to push the boundaries and invent the unexpected - as we continue the bold work of our founder Estée Lauder.

Who We Are

Do you want to be part of the team catalyzing digital innovation, harnessing the power of data, and transforming the fabric of security across the world's most prestigious beauty, skin-care, and luxury fragrance brands? Then join the information security and technology team, Enterprise Cybersecurity & Risk (ECR) at Estée Lauder Companies (ELC). ECR's security team fuels cyber defense, technology excellence, risk and compliance, and global resilience. We stay on the forefront of cyber threats to deliver fit-for-purpose tools, technologies, and processes that protect ELC's business operations and empower secure strategic growth. If you thrive in change-rich entrepreneurial environments, then this is the team for you. From our fast-paced delivery plans to our global team expansion, this is an exciting time to join us!

• Participating in the continued transformation of the SOX IT and controls maturation program and play a critical role with the function
• Maintainining a high level of visibility across the organization with various levels of Management and serve as a key point of contact for lines of business. Manage communications with key partners, including messaging of SOX IT objectives and requirements, managing request lists, and facilitating discussions on risk & controls.
• Facilitating the walkthrough process with Management and various audit team. Collaborate with IT partners to review SOX documentation (risk control matrices, narratives, flowcharts) and identify areas where control enhancements and/or documentation improvements are needed. Ensure SOX documentation is accurate and reflects current process.
• Completing and/or reviewing SOX assurance testing for key general IT controls (GITCs/ITGCs), IT application controls (ITACs), and key reports (IPE) identified in the walkthrough process. Coordinate testing approach and align expectations with internal & external auditors to ensure documentation and testing complies with industry standards (including PCAOB) and allows for reliance by the external auditors. Leverage knowledge of SOX methodology and industry requirements to ensure thorough workpapers are maintained.
• Supporting the team-oriented culture of the Tech GRC function. Mentor less experienced Tech GRC team members and contractors and review workpapers where appropriate for quality assurance.
• Assessing IT control deficiencies identified and work with Management for impact analysis and to identify an appropriate remediation action. Follow-up on remediation activities to verify appropriate resolution.
• Gathering details for in-scope SOX entities and assist in performing an annual SOX IT Risk, Scoping and Controls Assessment

• Providing advisory and when required, assess SOC 1 / SOC 2 reports to ensure appropriate controls are identified and operating effectively.
• Assisting and updating IT policies, standards, SOP's as needed

• Participating in cross domain trainings, awareness sessions, and on-the-job learning to further develop risk & controls knowledge across all cirical regulations beyond SOX (i.e. PCI, DI, Privacy / GDPR)