Overview

You will own PCI-DSS end to end: certification as a service provider, passing audits, and maintaining status year over year. This includes leading scoping, defining the cardholder data environment, driving remediation, and managing the relationship with the QSA. You translate compliance requirements into concrete technical or process changes with evidence that they work, collaborating with engineering and infrastructure to ensure lasting outcomes. You will also lead the broader GRC program, including risk, audits, and frameworks, reporting to the Group CISO with autonomy to run compliance as your own area.

Responsibilities

- PCI-DSS certification and maintenance
- Own the PCI-DSS program end to end for a service provider: scoping, gap assessment, remediation, certification, and annual maintenance
- Define and minimize the cardholder data environment; drive segmentation and scope reduction with engineering and infrastructure
- Manage the QSA relationship: scoping workshops, evidence packages, assessments, and findings
- Keep the certification live between audits: quarterly requirements and ongoing evidence and control monitoring

- Translating compliance into reality

- Turn PCI and other framework requirements into concrete technical and organizational solutions, working directly with engineering and infrastructure teams
- Distinguish between controls that exist on paper and those that actually work, and insist on the latter
- Design processes and evidence flows that keep controls satisfied without constant manual effort

- Audit and assurance

- Lead internal and external audits: scope, evidence, finding responses, and closure
- Build and maintain an evidence base that supports continuous readiness across PCI, ISO 27001, and BSP
- Coordinate the ISO 27001 surveillance cycle

- GRC leadership

- Bring structure and ownership to the wider compliance and risk program
- Maintain the risk register as a working document and drive treatment with system owners




- Run vendor security assessments and track third-party compliance obligations
- Report compliance posture clearly to leadership and governance committees

Requirements
- Experience
- 6+ years in security GRC, compliance, or audit with real ownership of a compliance program
- Has led a PCI-DSS certification end to end, ideally as a service provider, and maintained status across cycles
- Has managed a QSA relationship and run a real audit, not just supported one
- Has led cardholder data environment scoping and segmentation decisions with technical teams
- Comfortable across at least PCI-DSS and one of ISO 27001 or a banking framework (BSP MORB or equivalent)
- Experience in a regulated environment where compliance was enforced, not aspirational

What Sets The Right Person Apart
- Ability to translate a compliance requirement into a specific technical or process change and explain it to engineers
- Understands technology well enough to know whether a proposed control satisfies the requirement
- Treats certification xqbhyrx as an ongoing state to maintain, not a one-time project
- Builds evidence and monitoring into how controls run, rather than collecting it under deadline pressure

Technical understanding
- Solid grasp of network segmentation, access control, encryption, logging, and other PCI-relevant technical domains
- Familiarity with cloud (AWS), identity, and infrastructure to discuss control implementations with engineering
- Comfortable working in Jira and Confluence, and open to building automation around evidence and reviews

Nice to have
- Experience with a GRC platform (Vanta, Thoropass, ServiceNow GRC, or similar)
- Familiarity with BSP examination processes or Philippine financial services regulation
- Certifications: PCI-DSS ISA, CISA, CRISC, CISSP, ISO 27001 Lead Auditor or Implementer

Communication
- Strong written and verbal English; most work is async and documentation quality matters
- Can lead a working session with engineering and a reporting conversation with leadership

#J-18808-Ljbffr

📌 GRC Engineer (España)
🏢 Salmon Group
📍 España