Security Operations Engineer - PCI DSS

Teamified; India; Remote; INR 4,000,000 - 6,000,000; Part time

Benefits offered by this job

Health insurance

Provident Fund

Gratuity

Leave Benefits

Flexible hours

Job summary

Teamified seeks an experienced security engineer on a three‑month contract to drive annual PCI DSS compliance for a cloud-hosted payments platform. You will implement controls, assemble evidence, and prepare the Attestation of Compliance for executive sign-off, working with existing engineering and operations teams.

The role emphasizes hands‑on security and programme ownership. The candidate will manage log collection, configure SIEM, and coordinate vulnerability scanning, penetration testing,

Qualifications

• Experience leading PCI DSS compliance programs, ideally multiple cycles.
• In-depth knowledge of PCI DSS v4.0.1 and its changes.
• Hands-on with SAQ D and evidence collection.
• Hands-on AWS security engineering: IAM, VPC segmentation, logging, key management.
• Experience with SIEM/log platforms: log onboarding, parsing, correlation, alerting.
• Vulnerability management, logging/monitoring, access controls, secure baselines.
• Strong English writing for documentation and evidence.

Responsibilities

• Implement and verify technical controls across cardholder data environment.
• Deliver centralized log collection and log retention per standard.
• Collaborate with DevOps on SIEM deployment and tuning.
• Define alert triage and incident response routines.
• Complete SAQ D and assemble evidence set.
• Maintain PCI DSS documentation and dataflow diagrams.
• Coordinate external vulnerability scanning and remediation.
• Plan delivery schedule, dependencies, risk log, and reporting.
• Strengthen change management and document repeatable routines.

Skills

AWS security

SIEM

Vulnerability management

Access management

Secure configuration

Documentation

English proficiency

Tools

Wazuh

Elastic/OSSEC

Graylog

Security Onion

Jira administration

Job description

About the client

Our client is an innovative payments technology company transforming the way businesses send, receive, pay, and reconcile invoices. With a strong focus on simplifying complex payment processes, they provide a seamless billing and payments ecosystem designed to give businesses and their customers greater flexibility, visibility, and control over cash flow. By integrating with existing accounting platforms and payment workflows, our client helps reduce manual administration, streamline reconciliation, improve payment experiences, and create more efficient and secure financial processes. They are committed to innovation and delivering technology solutions that make payments simpler, faster, and more customer-focused.

Job Summary:

Our client operates a cloud-hosted payment platform and validates against PCI DSS v4.0.1 as a Level 2 service provider via SAQ D for Service Providers. They are seeking an experienced security engineer on a three-month contract to run the annual compliance cycle to completion. This is a hands‑on engineering role combined with programme ownership. The successful candidate will implement technical control changes, assemble and quality‑check the evidence set, complete the self‑assessment questionnaire, and prepare the Attestation of Compliance for executive sign‑off. They will work alongside the client's existing engineering and operations teams. The evidence and documentation produced should be built to a standard suitable for external assessment, as the client anticipates moving to QSA‑led Level 1 validation in a future cycle.

Responsibilities:

• Implement and verify technical controls across the cardholder data environment: access management, secure configuration, logging and monitoring, vulnerability management, encryption and key management, and secure development practices.
• Deliver the logging and monitoring requirements to the standard v4.0.1 expects: centralised collection of audit logs from all in-scope system components, protection of logs against alteration, twelve-month retention with three months immediately available, automated mechanisms for log review rather than manual inspection, time synchronisation, change detection on critical files, and alerting on the failure of critical security control systems.
• Work alongside the client's DevOps engineer on the rollout of an open‑source SIEM and host intrusion detection platform (Wazuh). The DevOps engineer owns the infrastructure build; this role owns the compliance outcome — defining required log sources and coverage, developing and tuning detection and correlation rules, configuring file integrity monitoring and retention to meet the standard, validating that the deployment actually satisfies the requirements, and evidencing it.
• Define the alert triage and response routine the client team will operate day to day.
• Complete SAQ D for Service Providers and assemble the supporting evidence set.
• Maintain compliance documentation: network and cardholder dataflow diagrams, scoping and segmentation documentation, policies and operating procedures.
• Engage and manage an Approved Scanning Vendor for quarterly external vulnerability scanning; drive remediation to passing scans.
• Scope and co‑ordinate penetration testing with a qualified independent provider; manage remediation and retest.
• Maintain third‑party service provider due diligence, including partner AOC collection and shared responsibility documentation.
• Own the delivery plan: schedule, dependencies, risk log, and weekly reporting to leadership.
• Strengthen change management practice so that changes are raised, approved, tested and evidenced consistently.
• Document repeatable operational routines (log review, access review, scan cadence, change approval) for the client team to run after the engagement ends.

Requirements:

Essential experience

• Demonstrable experience taking an organisation through PCI DSS compliance, ideally more than once and ideally including v4.x.
• Working knowledge of PCI DSS v4.0.1, including the changes from v3.2.1 and the requirements mandatory from 31 March 2025.
• Direct experience completing SAQ D, or preparing evidence for a Report on Compliance.
• Hands‑on AWS security engineering: IAM policy design, VPC and network segmentation, audit logging, secrets and key management, and infrastructure‑as‑code. Equivalent depth in another major public cloud will be considered where the candidate can demonstrate transferable design judgement.
• Hands‑on experience with SIEM or centralised log platforms in a compliance context — log source onboarding, parsing and normalisation, correlation and alert rule development, file integrity monitoring, retention configuration, and tuning to reduce false positives. Direct Wazuh experience is a strong advantage; equivalent open‑source stacks (OSSEC, Elastic Security, Graylog, Security Onion) are acceptable. Candidates should be able to name the platforms they have worked with and describe what they configured, not only what they monitored.
• Practical experience in vulnerability management, logging and monitoring, access management and secure configuration baselines.
• Ability to independently plan, track, report and escalation. No project manager will be assigned.
• Excellent written English. A significant portion of this role is documentation and evidence that must be read and accepted by others.
• Willingness to record a control as not in place where that is the accurate position.

Desirable:

• Payments, fintech or regulated financial services background.
• Understanding of the acquirer, processor and card scheme landscape.
• Experience of Level 1 service provider validation, or of taking an organisation from self‑assessment to QSA‑led assessment.
• PCIP, ISA, CISSP, CISM or equivalent certification.
• Jira administration and workflow configuration.
• Familiarity with ISO 27001 or SOC 2.

Benefits:

• Flexibility in work hours and location, with a focus on managing energy rather than time.
• Access to online learning platforms and a budget for professional development.
• A collaborative, no‑silos environment, encouraging learning and growth across teams.
• A dynamic social culture with team lunches, social events, and opportunities for creative input.
• Health insurance.
• Leave Benefits.
• Provident Fund.
• Gratuity.