Analyst, IT Compliance & SDLC Governance

The user wants me to reformat a job posting into clean, well-structured semantic HTML. I need to follow the rules: 1. Use

for section headings (e.g., About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule) 2. Use

• for any list of duties/requirements/benefits, and

  for prose 3. Do NOT repeat the job title as a heading (the page already shows it) 4. Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

  or drop it 5. Preserve ALL substantive information; do NOT invent or summarize away detail 6. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions 7. Include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text 8. Never create Pay/Schedule/Benefits sections unless the posting actually states them 9. Prefer a few substantive sections over many thin ones 10. Output ONLY the HTML fragment — no /, no markdown code fences Let me analyze the job posting content: 1. Company description: "About Solaris Energy Infrastructure" - this is company background 2. Job Description: Overview of the role 3. Essential Functions: Multiple sub-sections with detailed responsibilities 4. Qualifications: Experience/Education requirements 5. Preferred qualifications 6. Key Skills and Qualifications (soft skills/attributes) 7. Additional Information: CREATORS Culture (cut off at the end) I need to structure this into appropriate sections. The job title is "Analyst of IT Compliance and SDLC Governance" but I shouldn't repeat it as a heading. Sections I can create: - About the role (or Overview) - for the job description paragraph - Responsibilities - for the Essential Functions (which are detailed responsibilities) - Requirements - for the Qualifications (Experience/Education) - Preferred Qualifications - for the Preferred section - Skills - for the Key Skills and Qualifications - Additional Information - for the CREATORS Culture (though it's cut off) The Essential Functions has multiple sub-sections: SDLC Governance Framework, Quality Control Reviews and Metrics, SOX IT General Controls, Audit, Risk, and Evidence, Training, Enablement, and Policy, Leadership and Communication. These are all responsibilities, so I'll group them under Responsibilities with sub-lists or keep as prose with bullet points. I need to preserve all substantive information. The Essential Functions are very detailed - I should include them as bullet points under Responsibilities. Let me structure:

  About the role

  ...job description paragraph...

  Responsibilities

  • SDLC Governance Framework: ...
  • Quality Control Reviews and Metrics: ...
  • SOX IT General Controls: ...
  • Audit, Risk, and Evidence: ...
  • Training, Enablement, and Policy: ...
  • Leadership and Communication: ...
  But each of those has multiple bullet points. I could either make nested lists or flatten. The rule says use
  • for any list of duties. I think nested lists are okay, but the instruction says "use
    • for any list of duties/requirements/benefits". I'll use nested lists for clarity. Alternatively, I could make each sub-section a separate

      but the rule says use

      for section headings. It doesn't mention

      . I'll stick to

      for main sections and use nested

      for sub-items. Let me write the HTML. First, company description: "About Solaris Energy Infrastructure" - this could be a section "About the company" but the rule says headings like "About the role". I'll include it as a brief intro paragraph maybe under "About the role" or separate. The job posting starts with "About Solaris Energy Infrastructure" then "Job Description". I'll combine. I'll create:

      About the role

      Solaris Energy Infrastructure, Inc. (NYSE:SEI) delivers comprehensive power infrastructure solutions including generation, distribution, installation and commissioning, aftermarket support, and operations and maintenance. Headquartered in Houston, Texas, the Company serves multiple U.S. end markets, including data centers, energy, and other commercial and industrial sectors.

      Solaris is hiring an Analyst of IT Compliance and SDLC Governance to own the IT control environment for a publicly traded company in the middle of significant growth. You will lead enterprise system development lifecycle governance and the Sarbanes-Oxley IT control program as a single accountable function — designing the standards and controls, operating the recurring ones, measuring adherence, and defending the result in front of internal and external auditors. SDLC governance is the center of gravity. Solaris runs an internal software engineering function alongside nearshore development resources, and custom applications are built and deployed here rather than only purchased. That makes Program Development and Program Change controls a live, daily concern rather than an annual checkbox. We need someone who understands version control, environment separation, code review, release types, and deployment patterns well enough to design controls that satisfy an auditor without pushing delivery teams back into a waterfall process — and who will then review actual releases to confirm the process was followed. The application landscape is broad and still consolidating: SAP S/4HANA supported through an application managed services vendor, NetSuite supporting international entities, SuccessFactors for HR, Salesforce and ServiceMax on the commercial side, and a growing set of internally developed tools. Understanding how controls, segregation of duties, and access reviews work across a mixed environment matters more here than depth in any single platform. This role reports to the SVP of Information Technology and is based onsite at our Houston headquarters. It partners closely with Accounting, Internal Audit, Cybersecurity, and every delivery function inside IT. It is a hands-on leadership role: you will build the governance program yourself first, with the expectation that the program and a team grow underneath you.

      Responsibilities

      • SDLC Governance Framework
        • Own the enterprise SDLC governance framework — standards, processes, procedures, checklists, and controls — covering both traditional project delivery and iterative or product-based delivery models
        • Align the framework with Program Development and Program Change controls for SOX-relevant applications, so that governance and the control matrix tell the same story
        • Oversee SDLC control design, documentation, review, execution, and reporting end to end
        • Maintain governance artifacts in a single, centrally accessible location so standards, templates, and tools are discoverable and consistently applied across teams
        • Establish and participate in design and readiness forums — architecture and design review, change advisory, and operational readiness review — to hold delivery teams accountable to SDLC standards before deployment rather than after
        • Provide consultative guidance to delivery teams, product owners, and vendors on SDLC requirements, interpreting the standard for real situations instead of pointing at a document
      • Quality Control Reviews and Metrics
        • Perform SDLC quality control reviews on completed work, validating adherence to required processes, release types, deployment patterns, and expected artifacts
        • Identify gaps and drive corrective actions through to closure, distinguishing systemic process failures from one-off misses
        • Establish, monitor, and report KPIs for SDLC adherence, delivery quality, and control effectiveness, and present findings in formats suited to engineers, IT leadership, and the audit committee
        • Use data analytics and automation to identify improvement opportunities, reduce manual control effort, and shorten audit cycle time, including appropriate use of AI tooling to enable, measure, and optimize governance workflow
        • Continuously improve the governance program for leanness, clarity, and audit readiness — the goal is controls that engineers can follow without a translator
      • SOX IT General Controls
        • Own the IT general controls program across the access to programs and data, program change, program development, and computer operations control domains
        • Maintain the IT control matrix, including control descriptions, owners, frequency, and the mapping of controls to in-scope systems and financially relevant reports
        • Execute and evidence recurring controls, including quarterly user access reviews, privileged and administrative access verification, terminated user validation, and job monitoring and backup reviews
        • Design and maintain segregation of duties rulesets across in-scope applications, coordinate conflict remediation with application owners, and document mitigating controls where remediation is not feasible
        • Verify enforced separation between development, test, and production environments, including restriction of developer access to production data and systems
        • Establish and monitor emergency and expedited change procedures, including after-the-fact review and approval
        • Assess control design and operating effectiveness, identify gaps before auditors do, and drive remediation plans to closure with documented retesting
        • Evaluate the control impact of new systems, integrations, and acquisitions, and bring newly acquired entities into the control environment
      • Audit, Risk, and Evidence
        • Serve as the primary IT point of contact for external auditors, internal audit, and SOX program leadership, including priority audit support during testing windows
        • Manage IT audit requests end to end: request tracking, evidence collection, population and sample validation, and on-time submission
        • Develop and maintain audit-ready documentation and a durable evidence repository, so that control descriptions, procedures, and support are current year-round rather than assembled under deadline
        • Prepare walkthrough documentation and lead process walkthroughs with auditors on behalf of IT
        • Investigate, respond to, and remediate audit findings, control deficiencies, and management letter comments, maintaining a tracked remediation log with owners and dates
        • Review SOC 1 and SOC 2 reports for third-party providers, including the SAP application managed services vendor and cloud platform providers, and document complementary user entity controls and their coverage at Solaris
      • Training, Enablement, and Policy
        • Develop and deliver SDLC and control awareness training for IT and non-IT practitioners, employees, and vendors, keeping content aligned to the current governance standard
        • Track training completion and support compliance reporting, including attendance tracking for vendor and contractor personnel
        • Own IT policies, standards, and procedures, including the annual review cycle, approval routing, and communication of changes
        • Maintain the inventory of in-scope applications and financially relevant systems, coordinating annual scoping decisions with Accounting and external audit
        • Partner with the Cybersecurity function where control domains overlap, including access management, logging and monitoring, and vendor risk
      • Leadership and Communication
        • Lead cross-functional governance and compliance initiatives, serving as the organization’s point of contact for SDLC governance topics
        • Communicate roadmaps, expectations, and changes clearly and professionally, with enough specificity that teams know what to do differently
        • Mentor team members and delivery practitioners through onboarding and knowledge transfer, building control literacy rather than dependence on a single person
        • Build and develop the compliance function as it grows, including hiring, coaching, and performance management of future team members
        • Deliver first-class service to end-users across the organization, including field operations, corporate functions, and the Executive Team

      Requirements

      • Bachelor’s degree in Accounting, Information Systems, Computer Science