PCI Compliance & Access Review Specialist (Security Engineer)

Position Overview

This specialist guards both the company’s defenses and its compliance cadence, building and operating the security toolchain while managing the PCI calendar, access reviews, and evidence.

This role does not set company-level security strategy (owned by the Digital Information Manager); it lands controls onto systems and endpoints and keeps compliance continuously attained.

Job Responsibilities

1. Security toolchain
2. 1. Build/operate EDR, email security, identity security, logging; land MFA and 802.1X.
   2. Run vulnerability scans and remediation; manage store and cloud baselines.
3. PCI compliance
4. 1. Run quarterly scans, annual assessment, SAQ/ROC prep; drive remediation to closure.
   2. Maintain the evidence repository; support QSA and external audits.
5. Access reviews
6. 1. Review business-system, cloud, and MSP access periodically.
   2. Manage third-party access (incl. warehouse-vendor remote access) onboarding, approval, revocation.
7. Incidents & reviews
8. 1. Investigate, contain, and review security incidents.
   2. Provide security review for infrastructure and system changes.

Qualifications

• Education: Bachelor’s degree or above; cybersecurity or computer science preferred.
• Experience: 4+ years in security engineering/operations; PCI or GRC experience preferred.
• Knowledge & Skills: EDR/SIEM/vulnerability tooling; PCI-DSS controls and IAM concepts; Python scripting.
• Competencies: Fast responder with strong evidence discipline; principled; switches fluently between technical and compliance work.

Compensation

• $100,000 – $150,000 per year
• Quarterly Performance Bonus: This position is eligible for a quarterly performance-based bonus, subject to the eligibility requirements, performance criteria, and terms of the Company's bonus program.

Benefits

• 401(k) & 401(k) matching - subject to the eligibility requirements
• Paid Sick Leave
• Employee discount
• Health insurance
• Paid Time Off

Job Type: Full-Time (On-Site)