Pci Compliance Specialist

IT Compliance & Quality Assurance Specialist (PCI DSS v4.0 & SOX)Location:
Richmond Hill, ON (Hybrid – 2 to 3 Days Onsite per week)
Position Type:
Full-Time, Permanent
Role Mandate & OverviewWe are seeking a detail-oriented
IT Compliance & Quality Assurance Specialist
to join a growing Enterprise Governance, Risk, and Compliance (GRC) team. Reporting directly to the IT GRC Manager, you will take the lead in building and maturing compliance controls across the IT enterprise.
This role presents an exciting opportunity to own a
brand-new migration project to PCI DSS v4.0
while aligning internal controls with SOX frameworks. You will actively review documentation, complete Self-Assessment Questionnaires (SAQs), collaborate with external auditors, track remediation efforts, and safeguard cardholder data across cloud and enterprise platforms.
Key Responsibilities
PCI DSS v4.0 Lead & Governance:
Take ownership of tracking PCI requirements, executing the migration to PCI DSS v4. 0, and completing Self-Assessment Questionnaires (SAQ D / SAQ requirements for Level 2+ merchants).
Control Testing & SOX Integration:
Test and validate security controls, network data flows, system configurations, and Data Loss Prevention (DLP) controls. Map general controls to the PCI DSS Risk Control Matrix (RCM) while balancing SOX Control Self-Assessments (CSAs).
Audit & Remediation Management:
Manage audit documentation, review ROCs/SAQs, track identified vulnerabilities or non-compliance findings, and work directly with internal IT teams and external auditors to verify corrective actions.
GRC Automation & Project Assurance:
Drive automation across the GRC function, update compliance SOPs, and assess new IT project architectures during planning phases for PCI DSS design and security worthiness.
Stakeholder & Auditor Engagement:
Serve as a key point of contact for external auditors and internal teams, presenting compliance status, risk metrics, and QA findings to senior leadership.
What We Are Looking For (Requirements)
PCI DSS & Compliance Experience:
3 to 5 years of hands‑on experience in information security, risk management, or regulatory compliance, with direct hands‑on experience working with
PCI DSS (mandatory experience with PCI v4.0) .
SOX Exposure:
Solid understanding of SOX IT General Controls (ITGC) and IT Application Controls (ITAC).
Data Security & Network Protection:
Strong working knowledge of
Data Loss Prevention (DLP), network access controls (NAC), cloud security controls, and vendor scanning/API mechanisms (AVS).
Framework Knowledge:
Familiarity with cloud environments ( AWS ) and recognized security/governance frameworks ( NIST 27001, COBIT, COSO ).
Meticulous Attention to Detail:
Absolute precision in documentation, reporting, and control tracking.
Education:
Post-secondary education in Computer Science, Information Technology, Auditing, or a related technical discipline.
Communication Skills:
Clear written and verbal communication skills with the ability to convey technical compliance findings to executive leadership and lead audit walk-throughs.
Nice-to-Have Qualifications
Internal Security Assessor (ISA)
designation (active or previously held) is strongly preferred.
Industry credentials such as
CISA, CISSP, CISM, PCIP,
or
AAIA .
Familiarity with data privacy frameworks (PIPEDA, GDPR).
Location & Work Schedule
Work Setup:
Hybrid model requiring
2 to 3 days per week on-site
at the corporate office in
Richmond Hill, ON .
Selection & Interview ProcessOur evaluation process is streamlined into two main interview steps following initial recruiter vetting:
First Round:
Technical & Compliance Deep-Dive with the Hiring Manager (IT GRC Lead).
Final Round:
Leadership Alignment & Culture Interview.
AI may be used to support certain administrative aspects of our recruitment process. However, all applications and resumes are reviewed by qualified human reviewers, and all screening and hiring decisions are made solely by the hiring team.
The posted salary range reflects expected compensation for this role in accordance with Ontario pay transparency requirements. Actual compensation will be determined based on the successful candidate’s experience, skills, and qualifications and may fall anywhere within the range.
#J-18808-Ljbffr