IT Compliance Analyst

ABOUT CHURCHILL DOWNS INCORPORATED

Churchill Downs Incorporated (“CDI”) (Nasdaq: CHDN) has been creating extraordinary entertainment experiences for more than 150 years, beginning with one of the most iconic and enduring events in sports and entertainment—the Kentucky Derby. Headquartered in Louisville, Kentucky, CDI blends a rich legacy with a forward-looking approach to growth. Through the acquisition, development, and operation of live and historical racing entertainment venues, the expansion of online wagering services and other technology businesses, and the ownership and operation of regional casino gaming properties, CDI offers diverse career opportunities across the country. Our success is driven by dedicated team members who are passionate about delivering exceptional experiences, embracing innovation, and helping shape the future of entertainment.

JOB SUMMARY

The IT Compliance Analyst is responsible for supporting the governance and execution of CDI’s IT Sarbanes-Oxley (SOX) compliance program across in-scope systems and environments. The role participates in key phases of the IT SOX lifecycle, including control scoping, control design, documentation, walkthroughs, issue management, remediation tracking, and compliance reporting. The IT Compliance Analyst partners with IT Control Owners, Finance, Internal Audit, and External Audit to maintain appropriately designed and documented controls aligned with SOX requirements and support management’s oversight of the IT control environment. The IT Compliance Analyst also supports other governance, risk, and compliance (GRC) initiatives, including PCI DSS, security risk management, IT policy governance, third-party risk management, and related technology compliance programs.

ESSENTIAL DUTIES AND RESPONSIBILITIES

• Support governance and execution of the IT Sarbanes-Oxley (SOX) compliance program across in-scope systems and environments.
• Participate in IT SOX lifecycle activities, including control scoping, walkthroughs, documentation maintenance, evidence collection, testing coordination, training, and remediation tracking.
• Maintain and validate IT SOX documentation, including control narratives, risk control matrices (RCMs), and supporting artifacts.
• Support Internal and External Audit inquiries, including responding to questions, coordinating requests with control owners, and providing supporting documentation and evidence.
• Track control gaps and deficiencies, monitor remediation progress, and provide reporting on program status and control effectiveness to support management oversight and audit readiness.
• Assess the impact of system implementations, enhancements, and organizational changes on the IT SOX control environment.
• Support the design, development, implementation, and execution of IT SOX controls in partnership with IT and business Control Owners to address identified risks and SOX requirements.
• Coordinate and execute periodic User Access Reviews (UARs) for in-scope systems, including review population validation, reviewer coordination, completion tracking, documentation, and remediation of identified access issues.
• Support additional governance, risk, and compliance initiatives, including PCI DSS, security risk management, IT policy governance, and third-party risk management.
• Other duties as assigned.

REGULATORY
• Ability to obtain racing and/or gaming licenses as required in any jurisdiction where CDI operates. The Gaming industry is highly regulated and as such demands an extensive background check to obtain a license. Must be 21 years of age or older.

EDUCATION AND EXPERIENCE

• Bachelor’s degree in Information Technology, Information Systems, Accounting, Finance, Business Administration, or related field (or equivalent experience) required.
• 2–4 years of experience in IT compliance, SOX, IT audit, internal controls, or related GRC work.
• Understanding of IT SOX controls, including IT General Controls (ITGCs), IT Application Controls (ITACs), and Information Produced by the Entity (IPE).
• Knowledge of key ITGC domains, including access management, change management, computer operations, and system development lifecycle (SDLC).
• Experience supporting SOX walkthroughs, evidence collection, control documentation, and deficiency tracking.
• Experience working with GRC platforms (e.g., Optro) or similar compliance tools preferred.
• CISA, CRISC, or similar certification preferred but not required.
• Experience supporting PCI, cybersecurity, or other regulatory compliance programs preferred.

REQUIRED SKILLS AND ABILITIES

• Strong analytical and problem-solving skills.
• Ability to interpret technical processes and translate them into clear control documentation.
• Effective collaboration and communication skills across technical and non-technical stakeholders.
• Demonstrated ability to work collaboratively and effectively as part of a team.
• Ability to build effective working relationships with control owners, auditors, and other stakeholders.
• Strong organizational skills and attention to detail.
• Ability to manage multiple priorities in a deadline-driven environment.
• Demonstrates accountability and ownership for assigned work, with the ability to independently manage deliverables, follow through on commitments, and drive issues to resolution.
• Proficiency in Microsoft Office, particularly Excel.

PHYSICAL REQUIREMENTS & WORKING CONDITIONS

• Extended periods of sitting at a desk and working on a computer.
• Regular use of a keyboard and mouse for typing and navigating software.
• Viewing a computer screen for prolonged periods.
• Ability to manipulate paperwork, including filing, sorting, and organizing.
• Moving within the office environment to attend meetings, use office equipment, or interact with colleagues.
• Occasional lifting of office supplies or paperwork (up to 20 pounds).
• Speaking and listening to colleagues and clients in person, over the phone, or via video conferencing.
• Working in a climate-controlled office environment with moderate noise levels.
• Performing repetitive tasks such as data entry or document preparation.
• Working under artificial lighting conditions typical of an office environment, which may include fluorescent or LED lighting.
• Role is onsite five days a week at the Louisville, KY CDI headquarters office.

CHURCHILL DOWNS INCORPORATED

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or disability.