> Markdown version of [/jobs/ext/4571427-information-security-specialist-pci-dss-compliance](https://www.wearedevelopers.com/jobs/ext/4571427-information-security-specialist-pci-dss-compliance). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security Specialist - PCI DSS Compliance - **Company:** TD Bank, Inc. - **Location:** Mount Laurel Township, NJ, United States - **Experience:** Expert - **Salary:** $96,900 - $136,800 - **Contract:** Contract - **Skills:** Software System Penetration Testing, Cyber Security, Data Security, Executive Information Systems, Data Flow Control, Identity and Access Management, Network Segmentation, PCI Data Security Standards, Cloud Services, Sharepoint Document Library, Data Streaming, Systems Integration, Tokenization, Software Vulnerability Management, Software Security - **Published:** November 4, 2026 - **Apply:** https://www.techcareers.com/job.asp?id=3494059101&tx=KP7575FFQ&pt=1&aff=0B19D771-A501-4A5E-8338-2A822B784D54&utm_source=Job%20Feed&utm_medium=textkernel&utm_campaign=DE&utm_term=0B19D771-A501-4A5E-8338-2A822B784D54 ## About the Role We recognize that strong candidates bring different experiences. However, because this position carries end-to-end accountability, demonstrated PCI delivery experience is essential., * Direct, hands-on experience owning or leading a PCI DSS compliance program or a substantial PCI workstream through a complete assessment lifecycle. * A proven record of delivering PCI compliance outcomes , including coordinating control owners, collecting and validating evidence, resolving assessment issues, driving remediation, and meeting committed dates. * Previous experience working in a dedicated PCI compliance, PCI controls, payment security, information security, technology risk, or audit-readiness capacity. General exposure to PCI without delivery accountability is not sufficient. * Advanced knowledge of PCI DSS requirements, cardholder-data-environment scoping, evidence expectations, control testing, remediation management, and audit or assessment preparation. * Experience working directly with Qualified Security Assessors, internal or external auditors, security teams, technology owners, business stakeholders, and third-party service providers. * Demonstrated ability to take ownership of complex deliverables, remove obstacles, escalate appropriately, and drive work through to independently validated closure. * Experience developing executive reporting, risk assessments, control documentation, remediation plans, governance materials, and management responses. * Strong stakeholder-management, organizational, analytical, and written and verbal communication skills. * University degree or equivalent practical experience in information security, technology, risk management, audit, business, or a related discipline. Preferred qualifications * Experience managing PCI compliance in large financial services, insurance, payment-processing, or similarly regulated organization. * Professional certification such as PCI Professional, Internal Security Assessor, Qualified Security Assessor, CISSP, CISA, CRISC, or equivalent. * Experience with PCI DSS v4.0.1, targeted risk analyses, compensating controls, customized approaches, third-party service-provider oversight, and payment-page security. * Experience with governance, risk, and compliance platforms, structured evidence repositories, control automation, vulnerability-management tools, and executive dashboards. * Working knowledge of payment architecture, cloud services, identity and access management, network segmentation, encryption, tokenization, application security, penetration testing, and incident response. ## Description The Information Security Specialist is a senior technology professional responsible for end-to-end accountability for the Payment Card Industry Data Security Standard, or PCI DSS, compliance program across the TD Insurance family. You will work with business, technology, cyber security, risk, audit, procurement, finance, payment assessors and third-party partners to maintain a sustainable and evidence-based PCI compliance program. This role is suited to an experienced PCI practitioner who has managed compliance activities, driven remediation, prepared organizations for assessments, and consistently delivered commitments through to closure. The role aligns with the Information Security Specialist individual-contributor profile, which calls for expert information security and risk knowledge, leadership across complex initiatives, communication skills, regulatory consultation, audit preparation, remediation management, governance, and reporting. As the Information Security Specialist responsible for PCI compliance, you will: Own the PCI compliance program * Maintain end-to-end accountability for PCI compliance across the TD Insurance family, from annual planning and scope validation through evidence submission, assessment support, remediation, attestation, and ongoing compliance. * Establish and maintain the annual PCI compliance roadmap, milestones, deliverables, ownership model, and governance calendar. * Translate PCI DSS requirements into clear obligations for business, application, infrastructure, security, operations, and third-party teams. * Act as the primary TD Insurance PCI subject-matter expert and central point of coordination for internal stakeholders and external assessors. Maintain scope and control accountability * Lead the annual confirmation of the cardholder data environment, including payment channels, applications, infrastructure, data flows, integrations, service providers, and connected systems. * Maintain the PCI system inventory, data-flow diagrams, scope rationale, control-owner register, responsibility matrix, evidence catalogue, and applicability decisions. * Challenge unnecessary scope and identify sustainable scope-reduction opportunities through segmentation, tokenization, outsourcing, architectural change, or removal of cardholder data. * Ensure control responsibilities are clearly assigned across all applicable PCI requirements and that accountable owners understand their ongoing obligations. Drive assessments and evidence readiness * Coordinate annual PCI DSS assessments and associated deliverables, including the applicable Report on Compliance, Self-Assessment Questionnaire, and Attestation of Compliance. * Partner with Qualified Security Assessors, Approved Scanning Vendors, internal audit, cyber security, compliance, and control owners throughout the assessment lifecycle. * Implement a disciplined evidence-management process that confirms evidence is complete, current, accurate, approved, traceable, and assessment-ready. * Conduct readiness reviews and control-health assessments before formal testing begins. * Maintain a defensible record of scope determinations, control design decisions, exceptions, targeted risk analyses, and compensating controls. PCI DSS v4.0.1 is the current standard identified in the PCI Security Standards Council document library, which also provides the prioritized approach, assessment templates, attestations, targeted-risk-analysis material, and guidance for compensating controls. Deliver compliance outcomes * Track PCI deliverables, control gaps, evidence deficiencies, risks, dependencies, and remediation commitments from identification through validated closure. * Develop practical remediation plans with named owners, target dates, interim controls, dependencies, and measurable closure criteria. * Escalate overdue or ineffective remediation promptly, clearly articulating customer, business, technology, compliance, and reputational impacts. * Coordinate the resources and decisions required to meet assessment deadlines, rather than limiting the role to status reporting. * Verify that remediation addresses the underlying control weakness and produces sustainable evidence for future assessments. * Identify recurring issues and implement processes, control, automation, or governance improvements to prevent repeat findings. Provide governance and executive reporting * Lead PCI governance meetings and working sessions, ensuring decisions, actions, risks, and accountabilities are documented and followed through. * Produce concise reporting for senior leadership covering compliance status, scope, assessment readiness, control effectiveness, material gaps, remediation progress, and decisions required. * Define and monitor meaningful indicators such as evidence readiness, overdue actions, control-testing results, recurring findings, third-party compliance status, and overall assessment risk. * Communicate complex PCI requirements and security risks in clear business terms. * Escalate material control deficiencies through the appropriate technology, risk, compliance, and business governance channels. Embed continuous compliance * Move the program from annual assessment preparation toward continuous compliance and year-round control ownership. * Establish recurring checkpoints for control validation, evidence refresh, vulnerability management, access reviews, penetration testing, external scans, incident-response exercises, third-party monitoring, and policy reviews. * Assess changes to applications, payment channels, infrastructure, vendors, and business processes for potential PCI scope or control impact. * Monitor changes to PCI standards, supporting guidance, payment-channel risks, and industry practices, and translate them into actionable requirements for TD Insurance. * Develop reusable templates, procedures, playbooks, training materials, and evidence standards to improve consistency and reduce key-person dependency., * Annual PCI assessment and attestation deliverables completed accurately and on schedule. * Clear and current scope, ownership, control, and evidence documentation. * No surprises during formal assessments. * Material risks and compliance gaps identified early and escalated appropriately. * Remediation commitments completed by their target dates and independently validated. * Reduced recurrence of control and evidence deficiencies. * Increased automation, reusable evidence, and year-round control readiness. * Strong engagement and accountability across business and technology control owners. * Reduced dependency on individual resources through documented, repeatable processes.