Senior InfoSec Risk & PCI Compliance Lead

Wawa, Inc.; Media (Delaware County); On-site; USD 110,000 - 140,000; Full time

Job summary

Wawa, Inc. is seeking an Information Security Risk and Compliance Senior Analyst to lead and support risk management and PCI DSS compliance activities across the IT environment.

You will manage risk registers, perform assessments, and communicate risk decisions to stakeholders. The role focuses on PCI DSS compliance, risk reporting, and collaboration with technology and business leadership to ensure security controls and remediation efforts are effective.

Qualifications

• Minimum of 5 years of experience in incident response, information security and IT.
• Experience independently performing technology or cybersecurity risk assessments and communicating risk conclusions to stakeholders.
• Experience maintaining risk registers, evaluating risk acceptance requests, assessing controls, determining residual risk and tracking remediation commitments.
• Experience supporting PCI DSS assessments, scoping, evidence collection, control validation or remediation is preferred.

Responsibilities

• Maintain the Information Security Risk Register with clear documentation and ownership.
• Lead technology and information security risk assessments for new initiatives and existing services.
• Evaluate risk scenarios, affected assets, threats, control weaknesses and residual risk.
• Review risk acceptance requests and communicate recommendations to leadership.
• Develop and deliver risk reports for technology and business stakeholders.

Skills

Risk assessments

PCI DSS

Information security

NIST 800-53

Incident response

Communications to leadership

Security governance

Education

Degree in technology-related field

Tools

PCI DSS tools

Risk assessment tools

Job description

Wawa, Inc. is seeking an Information Security Risk and Compliance Senior Analyst to lead and support risk management and PCI DSS compliance activities across the IT environment.

You will manage risk registers, perform assessments, and communicate risk decisions to stakeholders. The role focuses on PCI DSS compliance, risk reporting, and collaboration with technology and business leadership to ensure security controls and remediation efforts are effective.