PCI Compliance Specialist

Recruiting in Motion; Toronto; Hybrid; CAD 90,000 - 120,000; Full time

Job summary

Recruiting in Motion is seeking an IT Compliance & Quality Assurance Specialist to lead PCI DSS v4.0 migration efforts and align controls with SOX. Based in Richmond Hill, Ontario, this hybrid role combines governance, risk, and compliance work across cloud and on‑prem environments.

You will own SAQs, coordinate with auditors, track remediation, and drive automation of GRC processes while reporting to IT GRC leadership.

Qualifications

• 3–5 years in information security, risk management, or regulatory compliance with PCI DSS v4.0 experience.
• Strong knowledge of ITGC and ITAC.
• Knowledge of DLP, NAC, cloud security controls, and vendor scanning.
• Familiarity with AWS and governance frameworks (NIST 27001, COBIT, COSO).
• Excellent documentation, reporting, and tracking of controls.

Responsibilities

• Lead migration to PCI DSS v4.0 and SAQ D requirements.
• Test and validate security controls; map to PCI DSS RCM and SOX CSAs.
• Manage audit documentation, vulnerabilities, and remediation with IT teams and auditors.
• Drive GRC automation and update SOPs for PCI DSS design and security worthiness.
• Engage with auditors and leadership; present status and risk metrics.

Skills

PCI DSS

SOX ITGC

DLP

Cloud security

AWS

NIST 27001

COBIT

COSO

ITGC/ITAC

Education

Post-secondary education in CS/IT/Auditing

Job description

IT Compliance & Quality Assurance Specialist (PCI DSS v4.0 & SOX)

Location: Richmond Hill, ON (Hybrid – 2 to 3 Days Onsite per week)

Position Type: Full-Time, Permanent

Role Mandate & Overview

We are seeking a detail-oriented IT Compliance & Quality Assurance Specialist to join a growing Enterprise Governance, Risk, and Compliance (GRC) team. Reporting directly to the IT GRC Manager, you will take the lead in building and maturing compliance controls across the IT enterprise.

This role presents an exciting opportunity to own a brand-new migration project to PCI DSS v4.0 while aligning internal controls with SOX frameworks. You will actively review documentation, complete Self-Assessment Questionnaires (SAQs), collaborate with external auditors, track remediation efforts, and safeguard cardholder data across cloud and enterprise platforms.

Key Responsibilities

• PCI DSS v4.0 Lead & Governance: Take ownership of tracking PCI requirements, executing the migration to PCI DSS v4. 0, and completing Self-Assessment Questionnaires (SAQ D / SAQ requirements for Level 2+ merchants).

• Control Testing & SOX Integration: Test and validate security controls, network data flows, system configurations, and Data Loss Prevention (DLP) controls. Map general controls to the PCI DSS Risk Control Matrix (RCM) while balancing SOX Control Self-Assessments (CSAs).

• Audit & Remediation Management: Manage audit documentation, review ROCs/SAQs, track identified vulnerabilities or non-compliance findings, and work directly with internal IT teams and external auditors to verify corrective actions.

• GRC Automation & Project Assurance: Drive automation across the GRC function, update compliance SOPs, and assess new IT project architectures during planning phases for PCI DSS design and security worthiness.

• Stakeholder & Auditor Engagement: Serve as a key point of contact for external auditors and internal teams, presenting compliance status, risk metrics, and QA findings to senior leadership.

What We Are Looking For (Requirements)

• PCI DSS & Compliance Experience: 3 to 5 years of hands‑on experience in information security, risk management, or regulatory compliance, with direct hands‑on experience working with PCI DSS (mandatory experience with PCI v4.0).

• SOX Exposure: Solid understanding of SOX IT General Controls (ITGC) and IT Application Controls (ITAC).

• Data Security & Network Protection: Strong working knowledge of Data Loss Prevention (DLP), network access controls (NAC), cloud security controls, and vendor scanning/API mechanisms (AVS).

• Framework Knowledge: Familiarity with cloud environments (AWS) and recognized security/governance frameworks (NIST 27001, COBIT, COSO).

• Meticulous Attention to Detail: Absolute precision in documentation, reporting, and control tracking.

• Education: Post-secondary education in Computer Science, Information Technology, Auditing, or a related technical discipline.

• Communication Skills: Clear written and verbal communication skills with the ability to convey technical compliance findings to executive leadership and lead audit walk-throughs.

Nice-to-Have Qualifications

• Internal Security Assessor (ISA) designation (active or previously held) is strongly preferred.

• Industry credentials such as CISA, CISSP, CISM, PCIP, or AAIA.

• Familiarity with data privacy frameworks (PIPEDA, GDPR).

Location & Work Schedule

• Work Setup: Hybrid model requiring 2 to 3 days per week on-site at the corporate office in Richmond Hill, ON.

Selection & Interview Process

Our evaluation process is streamlined into two main interview steps following initial recruiter vetting:

1. First Round: Technical & Compliance Deep-Dive with the Hiring Manager (IT GRC Lead).

2. Final Round: Leadership Alignment & Culture Interview.

AI may be used to support certain administrative aspects of our recruitment process. However, all applications and resumes are reviewed by qualified human reviewers, and all screening and hiring decisions are made solely by the hiring team.

The posted salary range reflects expected compensation for this role in accordance with Ontario pay transparency requirements. Actual compensation will be determined based on the successful candidate’s experience, skills, and qualifications and may fall anywhere within the range.