PCI Compliance Specialist

Recruiting In Motion - Eastern Ontario; Toronto; Hybrid; CAD 85,000 - 115,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

Recruiting In Motion - Eastern Ontario is seeking an IT Compliance & Quality Assurance Specialist to join the GRC team in Richmond Hill. You will lead the migration to PCI DSS v4.0, align controls with SOX, review SAQs, and work with auditors to safeguard cardholder data across cloud and on-prem platforms.

The role emphasizes meticulous documentation, testing of controls, and driving automation within GRC. You will engage with IT teams and leadership to report compliance status and remediation

Qualifications

• 3–5 years in information security, risk management, or regulatory compliance with PCI DSS v4.0 hands-on.
• Solid understanding of SOX IT General Controls (ITGC) and IT Application Controls (ITAC).
• Experience with Data Loss Prevention (DLP), NAC, cloud security controls, and vendor scanning.
• Familiarity with NIST 27001, COBIT, COSO.
• Strong documentation and reporting accuracy.

Responsibilities

• Lead PCI DSS v4.0 migration and SAQ management (SAQ D / Level 2+).
• Test and validate security controls, network data flows, and DLP controls; map to PCI DSS RCM while aligning SOX CSAs.
• Audit documentation management; review ROCs/SAQs; track vulnerabilities and remediation with auditors.
• Drive GRC automation and project assurance; update SOPs and assess new IT project architectures.
• Engage stakeholders and auditors; present compliance status and risk metrics to senior leadership.

Skills

PCI DSS compliance

SOX ITGC

Data security

Communication skills

Education

Post-secondary degree in CS/IT/Auditing

Tools

AWS

Job description

IT Compliance & Quality Assurance Specialist (PCI DSS v4.0 & SOX)

Location: Richmond Hill, ON (Hybrid - 2 to 3 Days Onsite per week) Position Type: Full-Time, Permanent

Mandate & Overview

We are seeking a detail-oriented IT Compliance & Quality Assurance Specialist to join a growing Enterprise Governance, Risk, and Compliance (GRC) team. Reporting directly to the IT GRC Manager, you will take the lead in building and maturing compliance controls across the IT enterprise. This role presents an exciting opportunity to own a brand-new migration project to PCI DSS v4.0 while aligning internal controls with SOX frameworks. You will actively review documentation, complete Self-Assessment Questionnaires (SAQs), collaborate with external auditors, track remediation efforts, and safeguard cardholder data across cloud and enterprise platforms.

Key Responsibilities

• PCI DSS v4.0 Lead & Governance: Take ownership of tracking PCI requirements, executing the migration to PCI DSS v4.0, and completing Self-Assessment Questionnaires (SAQ D / SAQ requirements for Level 2+ merchants).
• Control Testing & SOX Integration: Test and validate security controls, network data flows, system configurations, and Data Loss Prevention (DLP) controls. Map general controls to the PCI DSS Risk Control Matrix (RCM) while balancing SOX Control Self-Assessments (CSAs).
• Audit & Remediation Management: Manage audit documentation, review ROCs/SAQs, track identified vulnerabilities or non-compliance findings, and work directly with internal IT teams and external auditors to verify corrective actions.
• GRC Automation & Project Assurance: Drive automation across the GRC function, update compliance SOPs, and assess new IT project architectures during planning phases for PCI DSS design and security worthiness.
• Stakeholder & Auditor Engagement: Serve as a key point of contact for external auditors and internal teams, presenting compliance status, risk metrics, and QA findings to senior leadership.

What We Are Looking For (Requirements)

• PCI DSS & Compliance Experience: 3 to 5 years of hands-on experience in information security, risk management, or regulatory compliance, with direct hands-on experience working with PCI DSS (mandatory experience with PCI v4.0).
• SOX Exposure: Solid understanding of SOX IT General Controls (ITGC) and IT Application Controls (ITAC).
• Data Security & Network Protection: Strong working knowledge of Data Loss Prevention (DLP), network access controls (NAC), cloud security controls, and vendor scanning/API mechanisms (AVS).
• Framework Knowledge: Familiarity with cloud environments (AWS) and recognized security/governance frameworks (NIST 27001, COBIT, COSO).
• Meticulous Attention to Detail: Absolute precision in documentation, reporting, and control tracking.
• Education: Post-secondary education in Computer Science, Information Technology, Auditing, or a related technical discipline.
• Communication Skills: Clear written and verbal communication skills with the ability to convey technical compliance findings to executive leadership and lead audit walk-throughs.

Nice-to-Have Qualifications

• Internal Security Assessor (ISA) designation (active or previously held) is strongly preferred.
• Industry credentials such as CISA, CISSP, CISM, PCIP, or AAIA.
• Familiarity with data privacy frameworks (PIPEDA, GDPR).

Location & Work Schedule

Work Setup: Hybrid model requiring 2 to 3 days per week on-site at the corporate office in Richmond Hill, ON.

Selection & Interview Process

Our evaluation process is streamlined into two main interview steps following initial recruiter vetting: First Round: Technical & Compliance Deep-Dive with the Hiring Manager (IT GRC Lead). Final Round: Leadership Alignment & Culture Interview. AI may be used to support certain administrative aspects of our recruitment process. However, all applications and resumes are reviewed by qualified human reviewers, and all screening and hiring decisions are made solely by the hiring team. The posted salary range reflects expected compensation for this role in accordance with Ontario pay transparency requirements. Actual compensation will be determined based on the successful candidate’s experience, skills, and qualifications and may fall anywhere within the range.