The posting
We take pride in what we do! Deciding to come grow with us is an exciting opportunity to enhance your career success stories. You are the center to what we do. We would love to have you here!
The IT Business Operations Manager supports the business, financial, and oversight functions of Tower Loan’s technology organization. This role manages vendor relationships, contracts, technology investments, procurement activities, and related financial processes while helping ensure efficient and well-organized IT operations. The position also coordinates IT audit, risk, and assurance activities, including PCI DSS validation, SOC 2 Type II readiness and attestation, control documentation, evidence management, audit responses, and remediation tracking.
Duties/Responsibilities:
- Manage the lifecycle of IT contracts, subscriptions, licenses, and vendor records from intake through renewal, amendment, and termination.
- Maintain renewal schedules and communicate upcoming deadlines, obligations, and risks.
- Coordinate agreements and related documentation with Legal, vendors, and business stakeholders.
- Maintain complete, accurate, and audit-ready contract, approval, and vendor records.
- Coordinate vendor onboarding, procurement requirements, payment information, security reviews, and system setup.
- Request and compare proposals, develop negotiation strategies, conduct initial vendor negotiations within established parameters, and present recommendations for final approval.
- Track vendor performance, service issues, commitments, and commercial opportunities.
- Partner with IT leadership to develop, track, and forecast operating and capital budgets.
- Coordinate purchase requests, purchase orders, invoice approvals, accruals, and accounts payable follow-up.
- Reconcile contracts, invoices, purchase orders, licenses, and general ledger activity to identify billing errors, duplicate expenses, unused services, and savings opportunities.
- Prepare reporting related to technology expenses, forecasts, renewals, vendor status, contract risk, and budget performance.
- Develop and maintain approval workflows, procedures, templates, and internal controls that support consistent IT business operations and recordkeeping.
- Identify opportunities to improve commercial terms, streamline processes, strengthen recordkeeping, and reduce unnecessary costs.
- Serve as the central IT contact for internal auditors, external auditors, assessors, and compliance reviewers, coordinating requests, walkthroughs, interviews, evidence submissions, management responses, and follow-up activities.
- Coordinate PCI DSS validation and SOC 2 Type II readiness and attestation activities, including scoping, gap assessments, evidence collection, testing support, remediation tracking, and recurring readiness reviews.
- Maintain IT control inventories and compliance calendars, including control ownership, testing requirements, evidence, exceptions, findings, remediation plans, and due dates.
- Partner with Information Security, Infrastructure, Software Development, Finance, Legal, Human Resources, and business leaders to document controls and ensure required evidence is complete, accurate, consistent, and delivered on time.
- Develop and maintain IT policies, standards, control narratives, data-flow documentation, system inventories, and other records required for audits and assessments.
- Review vendor assurance documentation, including SOC reports, PCI attestations, penetration-test summaries, insurance certificates, and related third-party materials; document exceptions and required follow-up.
- Perform all other duties as assigned.
Required Skills/Abilities:
- Strong organizational, analytical, problem-solving, and decision-making skills with excellent attention to detail.
- Strong negotiation skills and the ability to evaluate vendor proposals, contracts, and commercial terms.
- Ability to manage multiple priorities, deadlines, vendors, documents, and stakeholders effectively.
- Strong written and verbal communication skills with the ability to work across technical, financial, legal, and business teams.
- Sound judgment, discretion, and integrity when handling confidential or commercially sensitive information.
- Ability to work independently and adapt priorities in a fast-paced environment.
- Strong spreadsheet skills and proficiency with Microsoft Office and business systems.
- Working knowledge of PCI DSS and the SOC 2 Trust Services Criteria; direct experience supporting PCI DSS validation or a SOC 2 Type II examination is strongly preferred.
- Experience coordinating IT audits or assessments, including evidence requests, walkthroughs, findings, and remediation activities.
- Ability to translate control requirements into clear ownership, practical procedures, testable evidence, and sustainable operating processes.
- Strong document-management skills with the ability to organize contracts, records, and sensitive audit evidence while maintaining appropriate confidentiality and access controls.
Education:
- Bachelor’s degree in business, finance, accounting, supply chain, legal studies, information systems, cybersecurity, or a related field preferred; equivalent relevant experience may be considered.
- Five (5) or more years of relevant experience spanning IT vendor management, procurement, contract administration, financial operations, IT audit, or compliance.
- Relevant credentials such as CISA, CISM, CRISC, PCI ISA, CPSM, CPCM, PMP, or a comparable audit, security, procurement, contracting, finance, or project-management certification are a plus.
Physical Requirements:
- Stand, walk, and/or sit for eight (8) hours a day
- Communicate effectively, verbally, written, in person, via telephone, or electronically.
- Lift and maneuver up to 20 lbs.
The above description outlines the most significant job functions performed, but may include other similar functions or assignments not explicitly mentioned.
