PCI DSS Compliance - Senior Analyst

BP PLC; Chicago (IL); On-site; USD 112,000 - 208,000; Full time

Job summary

BP plc is seeking a PCI Compliance Analyst for North America to support the PCI DSS program, coordinate with business units, technology delivery, the security team, and external assessors to ensure ongoing compliance. You will manage evidence collection, remediation, scope documentation, and governance reviews across teams.

You will also prepare documentation for assessors, train teams, and provide guidance to customers on PCI requirements while maintaining dashboards and reporting for

Qualifications

• Bachelor's degree in Information Security, IT, Cybersecurity or related field.
• One or more Information Security / compliance related certifications preferred (e.g., CISSP, CISA, PCI ISA, PCIP, CISM).
• Practical knowledge of PCI DSS requirements.
• Familiarity with governance, risk, and compliance (GRC) platforms.
• Knowledge of security processes such as vulnerability management, access management, logging and monitoring, encryption, network segmentation, and security incident management.
• Understanding of security frameworks such as NIST CSF, ISO 27001, CIS.

Responsibilities

• Support PCI DSS compliance program and annual assessment activities.
• Drive PCI DSS documentation alignment with security policy and procedures.
• Create and maintain PCI scope docs, network and data flow diagrams.
• Conduct governance reviews across business, technology and security teams.
• Identify compliance gaps and recommend corrective actions; supervise remediation.
• Coordinate collection and validation of evidence for assessments.
• Prepare documentation for QSA reviews, Self-Assessment Questionnaires, and audits.
• Provide guidance and interpretation of PCI requirements to customers.
• Develop awareness and training initiatives related to PCI compliance.
• Develop and maintain PCI compliance dashboards and reports.

Skills

Consulting

Incident investigation

Incident Management

Information Assurance

Information Security

Security behavior change

Risk Management

Stakeholder Management

Supplier Relationship Management

Supplier security management

Education

Bachelor's degree in Information Security / IT / Cybersecurity

Certifications: CISSP, CISA, PCI ISA, PCIP, CISM

Tools

GRC platforms

Job description

Entity:TechnologyJob Family Group:IT&S GroupJob Description:About usOur purpose is to bring together people, energy and markets to power and navigate a changing world. In a time of constant change and possibility we need new talent to pursue commercial opportunities, fueled by extraordinary insight and expertise. We’re alway beginning for more innovative digital solutions, sustainable outcomes and closer collaboration across our company and beyond, and you could be part of that too. Together we continue to grow as the world’s leading energy company!This position is available for Chicago and Ohio Westlake retail support center.Our OrganizationThe PCI Global Compliance Office is an energetic and enthusiastic team under the Technology Digital Delivery, Mobility and Convenience organization. The team exists to ensure consistent, efficient, and sustainable PCI DSS compliance across bp’s role as a Merchant and as Service Provider, while balancing operational perfection and cost efficiency.Our objective is to enable best in class payment solutions that meet business needs, protect customer data, and streamline compliance mechanisms globally. We aim to serve our consumers with best-in-class payment solutions while keeping the cost of compliance at the optimal level.We use our expertise to help improve efficiency, increase effectiveness and harness the ground-breaking potential of digital technologies to deliver value.The Position SummaryAs the PCI Compliance Analyst for North America, you will be responsible for supporting and maintaining the organization's Payment Card Industry Data Security Standard (PCI DSS) compliance program. You will work closely with business units, the Technology digital delivery team, the digital security team, and with external assessors to ensure compliance with PCI DSS requirements, identify and remediate control gaps, and reduce payment card data security risks. You will coordinate compliance activities, supervise control effectiveness, handle evidence collection, support audits and assessments, and provide guidance to collaborators regarding PCI security requirements and guidelines.Summary of the Responsibilities This Role BringsPCI Compliance Program ManagementSupport the organization's PCI DSS compliance program and annual assessment activities.Drive up to date PCI DSS documentation, including alignment with the company digital security policy and procedures and promotion of responsibility matrices.Assist with creation and maintenance of PCI scope documentation, network diagrams, and data flow diagrams.Perform ongoing PCI compliance governance reviews across business, technology, and security teams.Working with other members of the office, supervise changes to PCI DSS requirements and assess organizational impact.Identify compliance gaps and recommend corrective actions.Supervise remediation efforts and validate closure of compliance findings.Assessment & Audit SupportCoordinate the collection and validation of evidence required for PCI assessments.Prepare documentation for Qualified Security Assessor (QSA) reviews, Self-Assessment- Questionnaires, and internal audits.Customer EngagementPartner with the digital Security, the infrastructure, the technology, and Operational teams to ensure PCI requirements are integrated into business processes.Provide guidance and interpretation of PCI DSS requirements to customers.Facilitate compliance meetings and communicate compliance status to management.Assist in developing awareness and training initiatives related to PCI compliance.Reporting & MetricsDevelop and maintain PCI compliance dashboards and reports.Report compliance metrics, remediation status, and emerging risks to your leadership.Maintain accurate records to support regulatory and compliance requirements.Preferred QualificationsEducation / Technical KnowledgeBachelor's degree in Information Security, Information Technology, Cybersecurity or related field.One or more Information Security / compliance related certifications are preferred, such as Certified Information Systems Security Practitioner (CISSP), Certified Information Systems Auditor (CISA), Procurement Card Industry Internal Security Assessor (PCI ISA), PCI Professional (PCIP), Certified Information Security Manager (CISM).Practical knowledge of PCI DSS requirements.Practical knowledge of governance, risk, and compliance (GRC) platforms.Familiarity with security processes such as Vulnerability management, Access management, Logging and monitoring, Encryption technologies, Network segmentation, Security incident management.Understanding of security frameworks such as NIST Cybersecurity Framework, ISO 27001, CIS.Preferred Experience2 or more years of experience in PCI or other regulatory IT compliance, information security efforts.Experience in financial services, payments, retail, healthcare, or other regulated industries.Experience in a similar governance, risk and compliance role for a large-scale organization.Equivalent combination of education and experience will be considered sufficient.Key CompetenciesExcellent verbal and written communication skills; understands current challenges and propose a solution concisely to convince the audience.Excellent teamwork skills; adds value to the team and obtains help from others.Initiative and follow through; navigating through different non-ideal scenarios, drives consistent progress through them; overcomes obstacles and drives problems to a closure.Strong analytical and problem-solving skills.Audit and compliance mindset.Ability to manage multiple priorities and deadlines.Success MeasuresThe PCI Compliance Analyst will be successful when:PCI assessments are completed on schedule.Compliance findings are tracked and remediated effectively.Audit requests are fulfilled accurately and timely.PCI scope documentation remains current and complete.Compliance risks are identified and addressed proactively.Business and technology teams demonstrate sustained adherence to PCI DSS requirements.Travel RequirementUp to 50% travel should be expected with this role.Total Base Pay Range112,000.00 - 208,000.00 USD AnnualWorking Conditions / Physical RequirementsIn this role, the employee is continuously sitting and typing, frequently talking and using eye and hand coordination and may also be required to climb or balance; stoop, kneel, crouch or crawl.The employee is occasionally required to lift and/or move objects. Specific vision abilities required by this job include close vision, distance vision, color vision, peripheral vision, depth perception and ability to adjust focus.Standing, walking, bending over, and repetitive use of legs are done occasionally. All performed with or without a reasonable accommodation.SkillsConsulting, incident investigation and response, Incident Management, Information Assurance, Information Security, Information security behaviour change, Risk Management, Stakeholder Management, Supplier Relationship Management, Supplier security management.Legal DisclaimerWe are an equal opportunity employer. We do not discriminate on the basis of protected characteristics like race, religion, color, sex, national origin, sexual orientation, veteran status or disability status.Individuals with an accessibility need may request an adjustment/accommodation related to bp’s recruiting process (e.g., accessing the job application, completing required assessments, participating in telephone screenings or interviews, etc.). If you would like to request an adjustment/accommodation related to the recruitment process, please contact us. If you are selected for a position and depending upon your role, your employment may be contingent upon adherence to local policy. This may include pre-placement drug screening, medical review of physical fitness for the role, and background checks.Why join bp:At bp, we support our people to learn and grow in a diverse and challenging environment. We believe that our team is strengthened by diversity. We are committed to encouraging an inclusive environment in which everyone is respected and treated fairly.There are many aspects of our employees’ lives that are meaningful, so we offer benefits to enable your work to fit with your life. These benefits can include flexible working options, a generous paid parental leave policy, and excellent retirement benefits, among others!Travel RequirementUp to 50% travel should be expected with this roleRelocation Assistance:This role is not eligible for relocationRemote Type:This position is a hybrid of office/remote workingSkills:Agility core practices, Agility core practices, API and platform design, Benefits Management, Business Analysis, Business modelling, Client Counseling, Cloud Platforms, Configuration management and release, Data Analysis, Data design, Data Management, Demand Management, Design Thinking, Dialogue enablement, Digital Innovation, Digital Product Management, Employee Experience, Empowering Others, Facilitation, Influencing, Long Term Planning, Managing change, Marketing strategy, Measurement and metrics {+ 5 more}.Legal Disclaimer:We are an equal opportunity employer. We do not discriminate on the basis of protected characteristics like race, religion, color, sex, national origin, sexual orientation, veteran status or disability status. Individuals with an accessibility need may request an adjustment/accommodation related to bp’s recruiting process (e.g., accessing the job application, completing required assessments, participating in telephone screenings or interviews, etc.). If you would like to request an adjustment/accommodation related to the recruitment process, please contact us.If you are selected for a position and depending upon your role, your employment may be contingent upon adherence to local policy. This may include pre-placement drug screening, medical review of physical fitness for the role, and background checks.Expand job descriptionDisclaimerThis is a high-level summary only of terms and current discretionary benefits applicable to certain roles. Some rewards, benefits and policies are at managers’ discretion and vary depending on where you work within the business. All terms subject to contract and all discretionary benefits subject to policy and eligibility.