Security Operations Engineer – PCI DSS

• Implement and verify technical controls across the cardholder data environment, including access management, secure configuration, logging and monitoring, vulnerability management, encryption and key management, and secure development practices
• Deliver PCI DSS v4.0.1 logging and monitoring requirements, including centralised audit-log collection, log protection, retention, automated review, time synchronisation, critical-file change detection, and failure alerting
• Work with the client’s DevOps engineer on rollout of Wazuh, owning compliance outcomes, required log-source coverage, detection and correlation rules, file-integrity monitoring, retention, validation, and evidence
• Define the client team’s day-to-day alert triage and response routine
• Complete SAQ D for Service Providers and assemble supporting evidence
• Maintain network and cardholder dataflow diagrams, scoping and segmentation documentation, policies, and operating procedures
• Engage and manage an Approved Scanning Vendor for quarterly external vulnerability scanning and drive remediation to passing scans
• Scope and coordinate penetration testing with a qualified independent provider; manage remediation and retesting
• Maintain third-party service-provider due diligence, partner AOC collection, and shared-responsibility documentation
• Own the delivery plan, schedule, dependencies, risk log, and weekly leadership reporting
• Strengthen change-management practices so changes are raised, approved, tested, and evidenced consistently
• Document repeatable operational routines for log review, access review, scan cadence, and change approval after the engagement ends

• Demonstrable experience taking an organisation through PCI DSS compliance, ideally more than once and ideally including v4.x
• Working knowledge of PCI DSS v4.0.1, including the changes from v3.2.1 and the requirements mandatory from 31 March 2025
• Direct experience completing SAQ D, or preparing evidence for a Report on Compliance
• Hands-on AWS security engineering: IAM policy design, VPC and network segmentation, audit logging, secrets and key management, and infrastructure-as-code; equivalent depth in another major public cloud considered with transferable design judgement
• Hands-on experience with SIEM or centralised log platforms in a compliance context, including log source onboarding, parsing and normalisation, correlation and alert rule development, file integrity monitoring, retention configuration, and tuning to reduce false positives
• Ability to name platforms worked with and describe configurations, not only monitoring
• Practical experience in vulnerability management, logging and monitoring, access management and secure configuration baselines
• Ability to independently plan, track, report and escalate; no project manager assigned
• Excellent written English
• Willingness to record a control as not in place where that is accurate
• Desirable: payments, fintech or regulated financial services background
• Desirable: understanding of the acquirer, processor and card scheme landscape
• Desirable: Level 1 service provider validation or taking an organisation from self-assessment to QSA-led assessment
• Desirable: PCIP, ISA, CISSP, CISM or equivalent certification
• Desirable: Jira administration and workflow configuration
• Desirable: familiarity with ISO 27001 or SOC 2

• Flexibility in work hours and location, with a focus on managing energy rather than time
• Access to online learning platforms and a budget for professional development
• A collaborative, no-silos environment, encouraging learning and growth across teams
• A dynamic social culture with team lunches, social events, and opportunities for creative input
• Leave Benefits