Sr Engineer, Regulatory Compliance

panerabread; St. Louis (MO); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Panera Bread is seeking a Sr Engineer, Regulatory Compliance in St. Louis, MO. This role acts as the operational owner for PCI, audit management, third-party oversight, and privacy programs, partnering across Legal, Privacy, IT, and business teams to drive assessments and remediation.

The position emphasizes governance, risk management, and a data-driven approach to maintain audit-readiness and regulatory compliance while enabling business objectives.

Qualifications

• Own security regulatory compliance activities across legal, regulatory, contractual, and industry requirements.
• Coordinate PCI compliance program, evidence collection, control validation, and remediation management.
• Lead security audit activities, including planning, evidence collection, responses, and remediation.
• Conduct cybersecurity risk assessments and maintain risk registers and issue management.

Responsibilities

• Own regulatory compliance program across frameworks and maintain evidence repositories.
• Coordinate PCI compliance readiness, documentation, and controls within the organization.
• Manage internal and external audits, responses, corrective action plans, and remediation activities.
• Perform cybersecurity risk assessments and monitor risk trends and remediation progress.
• Partner with Privacy, Legal, HR, Marketing and Technology to governance initiatives.
• Coordinate third-party security reviews and vendor risk assessments.
• Develop and maintain security compliance metrics and executive reporting.

Job description

Sr Engineer, Regulatory Compliance

Position Summary

The Sr. Information Security GRC Engineer serves as the operational owner for the organization's regulatory compliance, which includes PCI, Information Technology Audit Management, Third-Party service provider oversight, and security-related data privacy programs. This role is responsible for ensuring the organization maintains a strong compliance posture, remains audit-ready, meets regulatory and contractual obligations, and effectively manages security risks through governance and oversight.

As a senior individual contributor, this position drives outcomes through influence, collaboration, and accountability rather than direct authority. The role partners closely with Information Security, Technology, Legal, Privacy, Internal Audit, Procurement, HR, Marketing, and business stakeholders to coordinate assessments, manage audits, oversee remediation efforts, and strengthen the organization's overall security governance framework.

Success in this role is measured by successful audit outcomes, reduction of repeat findings, timely remediation of identified risks, and the ability to make compliance processes efficient, predictable, and business enabling.

Location: St. Louis, MO (hybrid)

Essential Responsibilities

Regulatory Compliance Program Ownership

Serve as the operational owner for security regulatory compliance activities, including monitoring applicable legal, regulatory, contractual, and industry requirements and translating them into actionable security and compliance obligations. Maintain compliance mappings, control inventories, evidence repositories, and assessment documentation across applicable frameworks and standards. Conduct compliance assessments and gap analyses, coordinate remediation efforts, and maintain a centralized tracker for regulatory, PCI, audit, and third-party findings throughout the mitigation lifecycle. Provide guidance to business and technology teams regarding compliance requirements and support responses to regulatory inquiries, assessments, and examinations.

PCI Compliance Program Ownership

Coordinate the organization's PCI compliance program, including assessment readiness, evidence collection, control validation, stakeholder coordination, and remediation management. Partner with business and technology teams to maintain PCI documentation, support annual assessments, monitor control effectiveness, and drive continuous improvement of PCI-related controls and processes.

Audit Management & Assurance

Serve as the operational owner for security audit activities, including internal audits, external audits, customer assessments, and regulatory reviews. Coordinate audit planning, evidence collection, stakeholder engagement, audit responses, corrective action plans, and remediation activities. Maintain audit readiness by ensuring required documentation, evidence, and controls remain current, supportable, and aligned to regulatory and business requirements.

Risk Management

Conduct cybersecurity risk assessments across technology platforms, business processes, third parties, cloud environments, and emerging technologies. Maintain security risk registers and issue management processes while partnering with stakeholders to evaluate risks, validate controls, and implement mitigation strategies. Monitor and report significant compliance and cybersecurity risks, trends, and remediation progress to leadership.

Privacy & Data Governance Partnership

Partner with Privacy, Legal, HR, Marketing, and Technology teams to support privacy, data protection, and information governance initiatives. Participate in privacy impact assessments, data protection reviews, and governance activities related to data classification, retention, acceptable use, AI governance, and emerging technology risks. Evaluate security and compliance risks associated with personal, confidential, and sensitive information and recommend appropriate safeguards.

Third-Party Security Compliance

Coordinate security compliance reviews and risk assessments for vendors, service providers, and strategic partners. Review System and Organization Controls (SOC) reports, certifications, attestations, questionnaires, contracts, and other due diligence documentation. Partner with Procurement, Legal, and business stakeholders to identify third-party risks, manage remediation efforts, and monitor ongoing compliance obligations throughout the vendor lifecycle.

Metrics, Reporting & Program Management

Develop and maintain security compliance metrics, dashboards, and key performance indicators that measure program effectiveness and organizational maturity. Provide executive-level reporting on compliance posture, audit results, regulatory obligations, risk trends, and remediation progress. Support executive leadership, audit committees, and regulatory reporting requirements while identifying opportunities for continuous improvement across governance and compliance programs.

Required Quali