Cybersecurity PCI Compliance Advisor

Elevance Health•Indianapolis, IN

1d•Hybrid

About The Position

The Information Security Advisor leads and supports Payment Card Industry Data Security Standard (PCI DSS) compliance activities across the enterprise. The role provides subject matter expertise in interpreting PCI DSS controls, assessment readiness, evidence review, remediation tracking, scope validation, control testing, and stakeholder engagement. It supports PCI Internal Security Assessor (ISA), Qualified Security Assessor (QSA), Report on Compliance (ROC), Self-Assessment Questionnaire (SAQ), Attestation of Compliance (AOC), and related assessment activities across business, technology, security, compliance, and third-party environments. The Advisor applies knowledge of PCI DSS requirements, payment environments, cardholder data flows, segmentation, compensating controls, evidence validation, and risk-based compliance decisions. The role partners with internal teams, external assessors, business and technology owners, service providers, and leadership to maintain PCI compliance, support audit readiness, and strengthen payment security controls. It also supports broader information security engineering, risk, incident response, change control, and audit activities. This is a hybrid role requiring associates to work in-office one to two days per week. Alternate locations may be considered for candidates within commuting distance of an office; candidates outside a reasonable commuting distance will not be considered unless an accommodation is granted as required by law.

Requirements

A BS/BA degree in Information Technology or a related field and at least 5 years of experience in systems support, system administration, system engineering, system security, access management, network security, network communications, computer networking, telecommunications, systems development and management, hardware, software, and/or data; or an equivalent combination of education and experience.
Knowledge of PCI DSS requirements, payment environments, cardholder data flows, segmentation, compensating controls, evidence validation, and risk-based compliance decision-making.

Nice To Haves

Experience planning and designing highly complex systems.
Experience with multiple technical and business disciplines.
CISSP or another technical security certification, such as Systems Security Certified Practitioner or Certification and Accreditation Professional.
A bachelor's degree in cybersecurity, information systems, computer science, risk management, business, audit, or a related field, or an equivalent combination of education, training, and work experience.
At least 5 years of experience in cybersecurity, PCI compliance, IT audit, GRC, technology risk management, information security, regulatory compliance, or a related field.
Experience with GRC, workflow, ticketing, audit management, or evidence management tools.
Active or prior PCI Internal Security Assessor (ISA) or PCI Qualified Security Assessor (QSA) certification.
Familiarity with PCI-related standards and guidance, including PCI DSS, PCI 3DS, PCI P2PE, PCI PIN Security, PCI Secure Software Standard, PCI SSF, and PCI SSC guidance documents.

Responsibilities

Lead and support enterprise PCI DSS compliance activities, including control interpretation, assessment readiness, evidence review, remediation tracking, scope validation, and control testing.
Support PCI ISA, QSA, ROC, SAQ, AOC, and related assessment activities across business, technology, security, compliance, and third-party environments.
Support PCI governance, including maintaining PCI policies, standards, procedures, control matrices, evidence repositories, assessment schedules, risk registers, and compliance dashboards.
Evaluate third-party service provider PCI responsibilities by reviewing AOCs, responsibility matrices, shared responsibility documentation, contracts, service descriptions, and security evidence.
Support internal and external audits related to PCI DSS, HIPAA, HITRUST, SOC 2, NIST, and other cybersecurity or regulatory compliance requirements.
Provide first-level engineering design functions and trouble resolution, and serve as a technical escalation point for complex problems.
Develop testing plans to ensure quality of implementation.
Provide system and network architecture support for information and network security technologies.
Provide technical support to business and technology associates on risk assessments and implementation of information security procedures, standards, and technologies.
Maintain security incident response plans.
Represent major upgrades and business system replacements in change control.
Design and engineer repeatable technical solutions based on business requirements and defined technology standards.
Develop support procedures and performance metrics reports.
Lead level 1 and 2 incident recoveries and potentially organize other analysts' efforts during recovery.
Mentor analysts and control owners on PCI evidence quality, control interpretation, assessment documentation, remediation planning, and stakeholder communication.
Contribute to improvements in PCI compliance processes, templates, workflows, reporting, evidence management, automation, and program maturity.
Use AI-enabled tools and emerging technologies responsibly to improve productivity, research, documentation, control analysis, workflows, reporting, and decision support while maintaining data protection, confidentiality, and compliance.