Director IT Governance, Risk, and Compliance (GRC)

Overview:

Diversified Gas & Oil Corporation (DGOC) is an established owner and operator of producing conventional and unconventional natural gas & oil wells and midstream pipelines and compression stations concentrated in the Appalachian Basin in the United States. Headquartered in Birmingham, AL, our field operations are located throughout the Appalachian Basin in the states of Tennessee, Kentucky, Virginia, West Virginia, Ohio, and Pennsylvania. DGOC is the largest conventional producer in the Appalachian Basin. DGOC’s parent company is Diversified Gas & Oil Plc, which is a public company listed on the London Stock Exchange and trades under the ticker “DGOC”.

Responsibilities:

POSITION SUMMARY & RESPONSIBILITIES:

The Director IT Governance, Risk, & Compliance (GRC) is a technical leadership role. The ideal candidate complements their technical audit expertise with solid leadership, communication, and relational skills. Under direction from the Vice President of Information Security the role will lead and assist in the company's Internal IT audits and GRC. While also providing concise reporting and communications to Board Audit Committee and C-Suite leadership.

Special focus will be placed on:

- SOX - Perform design walkthroughs, test operating effectiveness, and lead audits for Information Technology General Controls (ITGCs) in support of Sarbanes-Oxley (SOX) 404 assertions compliance.

- Drive continuous improvement of IT GRC to elevate company posture.

- Supporting and creating SOX ready documentation including narratives, flow charts, control descriptions, etc.

- Designing and identifying key controls for IT systems and applications that impact financial reporting for the company.

- Conducting periodic reviews to ensure application controls and Segregation of Duties (SOD) are configured across the company's systems.

- Working in tandem with the internal audit group to design testing programs to ensure appropriate SOX assertions can be made.

- Supporting evaluation of third-party service providers for SOC reports.

- Ensure new systems and significant changes to the IT environment are proactively addressed for considerations impacting IT General Controls (ITGC), that the right controls are incorporated in projects and that ongoing systems of sustainability are established to enable effectiveness.

- Reviewing, assessing, and evaluating reported control deficiencies, root causes, and planned corrective actions in conjunction with IT and business process owners.

- Lead training of IT process and control owners with respect to internal controls and SOX compliance.

- Assume lead and contributing roles in annual and semiannual audits and risk assessments.

- Working with internal and external auditors to coordinate IT General Controls, automated controls testing, and process walkthroughs.

- Preparing materials, findings, and assertions of SOX compliance and communicating to Leadership and Audit Committee.

- Seeking to continuously improve the SOX program to become more efficient and effective through optimization and automation.

Qualifications:

POSITION REQUIREMENTS:

- Bachelor’s degree and 10+ years of information technology audit experience with growing responsibility including application control testing.

- Demonstrated experience performing internal audits for operational and regulatory environment.

- Ability to work as a member of a project team and cultivate a strong working relationship with external providers and internal lines of businesses.

- CISA, CIA strongly preferred and other relevant certifications considered.

- Understanding of risks and internal controls. The ability to evaluate and figure out adequacy and efficiency of controls.

- Stays current on industry and regulatory issues and standard methodologies.

- Excellent analytical skills, including the ability to anticipate issues and to craft appropriate solutions.

- Strong verbal and written communication skills with a shown ability to articulate effectively and expertly – Board Committee levels.

- Ability to work independently to conduct audits from beginning to end and facilitate multiple projects at a time with a sense of urgency.

- Knowledge on NIST CSF, ISO 27K, SOC Reports, IT General Controls, and Information Security Risk Assessments