Job DescriptionSolaris is hiring an Analyst of IT Compliance and SDLC Governance to own the IT control environment for a publicly traded company in the middle of significant growth. You will lead enterprise system development lifecycle governance and the Sarbanes-Oxley IT control program as a single accountable function - designing the standards and controls, operating the recurring ones, measuring adherence, and defending the result in front of internal and external auditors.
SDLC governance is the center of gravity. Solaris runs an internal software engineering function alongside nearshore development resources, and custom applications are built and deployed here rather than only purchased. That makes Program Development and Program Change controls a live, daily concern rather than an annual checkbox. We need someone who understands version control, environment separation, code review, release types, and deployment patterns well enough to design controls that satisfy an auditor without pushing delivery teams back into a waterfall process - and who will then review actual releases to confirm the process was followed.
The application landscape is broad and still consolidating: SAP S/4HANA supported through an application managed services vendor, NetSuite supporting international entities, SuccessFactors for HR, Salesforce and ServiceMax on the commercial side, and a growing set of internally developed tools. Understanding how controls, segregation of duties, and access reviews work across a mixed environment matters more here than depth in any single platform.
This role reports to the SVP of Information Technology and is based onsite at our Houston headquarters. It partners closely with Accounting, Internal Audit, Cybersecurity, and every delivery function inside IT. It is a hands-on leadership role: you will build the governance program yourself first, with the expectation that the program and a team grow underneath you.
Essential FunctionsSDLC Governance Framework- Own the enterprise SDLC governance framework - standards, processes, procedures, checklists, and controls - covering both traditional project delivery and iterative or product-based delivery models
- Align the framework with Program Development and Program Change controls for SOX-relevant applications, so that governance and the control matrix tell the same story
- Oversee SDLC control design, documentation, review, execution, and reporting end to end
- Maintain governance artifacts in a single, centrally accessible location so standards, templates, and tools are discoverable and consistently applied across teams
- Establish and participate in design and readiness forums - architecture and design review, change advisory, and operational readiness review - to hold delivery teams accountable to SDLC standards before deployment rather than after
- Provide consultative guidance to delivery teams, product owners, and vendors on SDLC requirements, interpreting the standard for real situations instead of pointing at a document
Quality Control Reviews and Metrics- Perform SDLC quality control reviews on completed work, validating adherence to required processes, release types, deployment patterns, and expected artifacts
- Identify gaps and drive corrective actions through to closure, distinguishing systemic process failures from one-off misses
- Establish, monitor, and report KPIs for SDLC adherence, delivery quality, and control effectiveness, and present findings in formats suited to engineers, IT leadership, and the audit committee
- Use data analytics and automation to identify improvement opportunities, reduce manual control effort, and shorten audit cycle time, including appropriate use of AI tooling to enable, measure, and optimize governance workflow
- Continuously improve the governance program for leanness, clarity, and audit readiness - the goal is controls that engineers can follow without a translator
SOX IT General Controls- Own the IT general controls program across the access to programs and data, program change, program development, and computer operations control domains
- Maintain the IT control matrix, including control descriptions, owners, frequency, and the mapping of controls to in-scope systems and financially relevant reports
- Execute and evidence recurring controls, including quarterly user access reviews, privileged and administrative access verification, terminated user validation, and job monitoring and backup reviews
- Design and maintain segregation of duties rulesets across in-scope applications, coordinate conflict remediation with application owners, and document mitigating controls where remediation is not feasible
- Verify enforced separation between development, test, and production environments, including restriction of developer access to production data and systems
- Establish and monitor emergency and expedited change procedures, including after-the-fact review and approval
- Assess control design and operating effectiveness, identify gaps before auditors do, and drive remediation plans to closure with documented retesting
- Evaluate the control impact of new systems, integrations, and acquisitions, and bring newly acquired entities into the control environment
Audit, Risk, and Evidence- Serve as the primary IT point of contact for external auditors, internal audit, and SOX program leadership, including priority audit support during testing windows
- Manage IT audit requests end to end: request tracking, evidence collection, population and sample validation, and on-time submission
- Develop and maintain audit-ready documentation and a durable evidence repository, so that control descriptions, procedures, and support are current year-round rather than assembled under deadline
- Prepare walkthrough documentation and lead process walkthroughs with auditors on behalf of IT
- Investigate, respond to, and remediate audit findings, control deficiencies, and management letter comments, maintaining a tracked remediation log with owners and dates
- Review SOC 1 and SOC 2 reports for third-party providers, including the SAP application managed services vendor and cloud platform providers, and document complementary user entity controls and their coverage at Solaris
Training, Enablement, and Policy- Develop and deliver SDLC and control awareness training for IT and non-IT practitioners, employees, and vendors, keeping content aligned to the current governance standard
- Track training completion and support compliance reporting, including attendance tracking for vendor and contractor personnel
- Own IT policies, standards, and procedures, including the annual review cycle, approval routing, and communication of changes
- Maintain the inventory of in-scope applications and financially relevant systems, coordinating annual scoping decisions with Accounting and external audit
- Partner with the Cybersecurity function where control domains overlap, including access management, logging and monitoring, and vendor risk
Leadership and Communication- Lead cross-functional governance and compliance initiatives, serving as the organization's point of contact for SDLC governance topics
- Communicate roadmaps, expectations, and changes clearly and professionally, with enough specificity that teams know what to do differently
- Mentor team members and delivery practitioners through onboarding and knowledge transfer, building control literacy rather than dependence on a single person
- Build and develop the compliance function as it grows, including hiring, coaching, and performance management of future team members
- Deliver first-class service to end-users across the organization, including field operations, corporate functions, and the Executive Team
QualificationsExperience/Education- Bachelor's degree in Accounting, Information Systems, Computer Science, or a related field is required
- 7+ years of enterprise IT lifecycle experience with a focus on SDLC governance, risk, audit, or compliance
- Prior leadership experience, whether managing people, leading a control program, or owning a governance function across teams
- Direct responsibility for Sarbanes-Oxley IT general controls, including Program Development and Program Change controls
- Demonstrated command of the ITGC control domains: access to programs and data, program change, program development, and computer operations
- Practical understanding of the software development lifecycle - version control, environment separation, code review, release types, deployment patterns, and CI/CD - and how to control each without obstructing delivery
- Experience designing and testing change management controls in an environment with internally developed software, not only purchased applications
- Experience performing control or quality reviews of completed delivery work and driving corrective action
- Experience developing, executing, and reporting performance and risk metrics, and summarizing findings for technical, executive, and audit audiences
- Experience serving as a primary liaison to internal and external auditors, including evidence preparation, walkthrough facilitation, and remediation
- Experience working across cross-functional teams in a regulated or publicly traded environment
- Advanced verbal, written, and presentation skills, with strong stakeholder management - including the ability to hold a firm position with technical teams and leadership while remaining a partner rather than an obstacle
- Working familiarity with delivery and governance tooling such as Jira, Azure DevOps, ServiceNow, SharePoint, Confluence, and reporting tools including Excel and Power BI
- Ability to work onsite at the Houston corporate office
Preferred- CISA, CIA, CPA, or CRISC certification
- Public accounting or Big Four IT audit experience
- Experience evaluating SOC 1 and SOC 2 reports and assessing complementary user entity controls
- Experience in a company that implemented or stabilized SAP S/4HANA, including post-go-live control remediation
- Experience with SAP GRC, NetSuite, SuccessFactors, or Salesforce control and role design
- Experience bringing an acquired company into an existing SOX control environment
- Experience with governance, risk, and compliance tooling or control automation platforms
- Experience using data analytics to drive process improvement and control automation
- Familiarity with cybersecurity frameworks such as NIST CSF or CIS Controls
- Prior experience in energy, oilfield services, industrial, or manufacturing environments
Key Skills and Qualifications- Credible with engineers and auditors alike - holds the line on control requirements without becoming the department that says no, and knows the difference between a real deficiency and an auditor preference
- Disciplined documentarian - keeps standards, evidence, and remediation tracking current year-round rather than assembling them under deadline
- Lean by instinct - designs controls that make delivery more predictable instead of simply adding approval gates
- Exceptional communicator - direct and transparent, skilled problem-solver with proven success in building coalitions and avoiding conflicts
- Total ownership mentality - proactively identifies and removes obstacles across numerous ongoing tasks
- Independent thinker - provides original thoughts and constantly asking "how can we do this better"
- Innovative thinker - willingness to consider novel solutions and ability to adapt to change
- Desirable teammate - impeccable character, humility, and collaborative
- Relentless - aspires to contribute and achieve his/her full potential
Additional Information- Competitive compensation packages
- Medical, Dental & Vision benefits
- Disability Insurance
- Company paid Life and AD&D insurance with supplemental offerings
- Company matching 401(k) retirement plan
- Paid time off, including 10 paid holidays
- Career Progression
- Tuition Reimbursement
This job overview is not all inclusive. In addition, Solaris reserves the right to amend this job overview at any time.
