Analyst, IT Compliance & SDLC Governance

Solaris Oilfield Infrastructure, LLC•Houston, TX

6d•Onsite

About The Position

Solaris Energy Infrastructure is hiring an Analyst of IT Compliance and SDLC Governance to own the IT control environment for a publicly traded company undergoing significant growth. This hands-on leadership role combines enterprise SDLC governance with the Sarbanes-Oxley (SOX) IT control program. The position designs and operates controls, measures adherence, and supports internal and external audits. SDLC governance is a central focus: Solaris develops custom applications with internal engineering and nearshore resources, so the role must support effective controls while allowing teams to use iterative and product-based delivery models. The role covers a broad and consolidating application landscape, including SAP S/4HANA, NetSuite, SuccessFactors, Salesforce, ServiceMax, and internally developed tools. It reports to the SVP of Information Technology and is based onsite at the Houston headquarters. The position partners closely with Accounting, Internal Audit, Cybersecurity, vendors, and IT delivery functions. The governance program is initially built by the role holder, with an expectation that the program and team will grow over time. The successful candidate will own the SDLC framework, IT general controls, audit support, evidence and documentation, training, and IT policies and procedures. They will perform quality reviews of completed work, track remediation, report metrics, and provide guidance to delivery teams and stakeholders. The role also includes developing the compliance function, mentoring practitioners, and potentially hiring and managing future team members.

Requirements

Bachelor’s degree in Accounting, Information Systems, Computer Science, or a related field.
At least 7 years of enterprise IT lifecycle experience focused on SDLC governance, risk, audit, or compliance.
Prior leadership experience, such as people management, control-program leadership, or ownership of a governance function across teams.
Direct responsibility for SOX IT general controls, including Program Development and Program Change controls.
Demonstrated command of ITGC domains: access to programs and data, program change, program development, and computer operations.
Practical understanding of the software development lifecycle, including version control, environment separation, code review, release types, deployment patterns, and CI/CD, and the ability to control these without obstructing delivery.
Experience designing and testing change management controls where software is developed internally, not only purchased.
Experience performing control or quality reviews of completed delivery work and driving corrective action.
Experience developing, executing, and reporting performance and risk metrics, and summarizing findings for technical, executive, and audit audiences.
Experience serving as a primary liaison to internal and external auditors, including evidence preparation, walkthrough facilitation, and remediation.
Experience working with cross-functional teams in a regulated or publicly traded environment.
Advanced verbal, written, and presentation skills, with strong stakeholder management and the ability to maintain control requirements while remaining a partner to technical teams and leadership.
Working familiarity with Jira, Azure DevOps, ServiceNow, SharePoint, Confluence, Excel, and Power BI.
Ability to work onsite at the Houston corporate office.

Nice To Haves

CISA, CIA, CPA, or CRISC certification.
Public accounting or Big Four IT audit experience.
Experience evaluating SOC 1 and SOC 2 reports and assessing complementary user entity controls.
Experience at a company that implemented or stabilized SAP S/4HANA, including post-go-live control remediation.
Experience with SAP GRC, NetSuite, SuccessFactors, or Salesforce control and role design.
Experience bringing an acquired company into an existing SOX control environment.
Experience with governance, risk, and compliance tooling or control automation platforms.
Experience using data analytics to drive process improvement and control automation.
Familiarity with cybersecurity frameworks such as NIST CSF or CIS Controls.
Prior experience in energy, oilfield services, industrial, or manufacturing environments.
Credibility with engineers and auditors, including the ability to distinguish real deficiencies from auditor preferences.
Strong documentation discipline, lean control design instincts, communication, problem-solving, ownership, independent and innovative thinking, adaptability, collaboration, humility, and drive.

Responsibilities

Own the enterprise SDLC governance framework, including standards, processes, procedures, checklists, and controls for traditional and iterative delivery models.
Align SDLC governance with SOX Program Development and Program Change controls for relevant applications.
Oversee SDLC control design, documentation, review, execution, and reporting end to end.
Maintain centrally accessible governance standards, templates, and tools.
Establish and participate in architecture and design reviews, change advisory forums, and operational readiness reviews.
Advise delivery teams, product owners, and vendors on applying SDLC requirements to practical situations.
Perform quality control reviews of completed SDLC work, including adherence to processes, release types, deployment patterns, and required artifacts.
Identify control and process gaps, drive corrective actions to closure, and distinguish systemic failures from isolated misses.
Establish, monitor, and report SDLC adherence, delivery quality, and control-effectiveness KPIs to engineering, IT leadership, and audit committee audiences.
Use analytics and automation, including appropriate AI tools, to improve governance workflows, reduce manual control effort, and shorten audit cycles.
Continuously improve governance for clarity, efficiency, and audit readiness.
Own the IT general controls program across access to programs and data, program change, program development, and computer operations.
Maintain the IT control matrix, including descriptions, owners, frequency, and mappings to in-scope systems and financially relevant reports.
Execute and evidence recurring controls, including quarterly access reviews, privileged and administrative access verification, terminated-user validation, job monitoring, and backup reviews.
Design and maintain segregation-of-duties rulesets, coordinate remediation with application owners, and document mitigating controls where needed.
Verify separation of development, test, and production environments, including restrictions on developer access to production data and systems.
Establish and monitor emergency and expedited change procedures, including retrospective review and approval.
Assess control design and operating effectiveness, identify gaps, and drive remediation and retesting to closure.
Evaluate control impacts of new systems, integrations, and acquisitions, and incorporate newly acquired entities into the control environment.
Serve as the primary IT contact for external auditors, internal audit, and SOX program leadership, including during audit testing windows.
Manage IT audit requests, tracking, evidence collection, population and sample validation, and timely submission.
Maintain audit-ready documentation and an ongoing evidence repository.
Prepare walkthrough documentation and lead auditor process walkthroughs on behalf of IT.
Investigate and respond to audit findings, control deficiencies, and management letter comments; track remediation owners and dates.
Review third-party SOC 1 and SOC 2 reports and document complementary user entity controls and their coverage at Solaris.
Develop and deliver SDLC and control-awareness training for practitioners, employees, and vendors; track completion and support compliance reporting.
Own IT policies, standards, and procedures, including annual reviews, approval routing, and communication of changes.
Maintain the inventory of in-scope applications and financially relevant systems, coordinating annual scoping decisions with Accounting and external audit.
Partner with Cybersecurity on overlapping control areas, including access management, logging and monitoring, and vendor risk.
Lead cross-functional governance and compliance initiatives and serve as the organization’s contact for SDLC governance topics.
Communicate roadmaps, expectations, and changes clearly and specifically.
Mentor team members and delivery practitioners through onboarding and knowledge transfer.
Build and develop the compliance function as it grows, including hiring, coaching, and performance management of future team members.
Deliver service to end-users across field operations, corporate functions, and the Executive Team.