Information Security Specialist - PCI DSS Compliance

TD•Toronto, ON

3d•CA$96,900 - CA$136,800•Onsite

About The Position

The Information Security Specialist is a senior technology professional with end-to-end accountability for the PCI DSS compliance program across the TD Insurance family. The role works with business, technology, cyber security, risk, audit, procurement, finance, payment assessors, and third-party partners to maintain a sustainable, evidence-based compliance program. It is suited to an experienced PCI practitioner who has managed compliance activities, prepared organizations for assessments, driven remediation, and delivered commitments through closure. The position aligns with an individual-contributor profile requiring expert information security and risk knowledge, leadership across complex initiatives, strong communication, regulatory consultation, audit preparation, remediation management, governance, and reporting. The specialist owns annual planning, scope validation, assessment coordination, evidence submission, remediation, attestation, and ongoing compliance; maintains the compliance roadmap and governance; and translates PCI DSS requirements into obligations for relevant teams. The role leads cardholder-data-environment scope confirmation, maintains scope and control documentation, identifies scope-reduction opportunities, coordinates annual assessments and evidence readiness, and maintains defensible records of control decisions and exceptions. It tracks and drives remediation through validated closure, leads governance and executive reporting, and embeds continuous compliance through recurring control checkpoints, change-impact assessments, monitoring of PCI guidance, and reusable procedures and training materials. Success is measured by accurate, on-time assessment and attestation deliverables; current scope, ownership, control, and evidence documentation; early identification and escalation of risks; on-time, validated remediation; fewer recurring deficiencies; increased automation and year-round readiness; strong control-owner accountability; and repeatable processes that reduce reliance on individual resources.

Requirements

Direct, hands-on experience owning or leading a PCI DSS compliance program or substantial PCI workstream through a complete assessment lifecycle.
Proven record delivering PCI compliance outcomes, including coordinating control owners, collecting and validating evidence, resolving assessment issues, driving remediation, and meeting committed dates.
Previous experience in a dedicated PCI compliance, PCI controls, payment security, information security, technology risk, or audit-readiness capacity; general PCI exposure without delivery accountability is not sufficient.
Advanced knowledge of PCI DSS requirements, cardholder-data-environment scoping, evidence expectations, control testing, remediation management, and audit or assessment preparation.
Experience working directly with Qualified Security Assessors, internal or external auditors, security teams, technology owners, business stakeholders, and third-party service providers.
Demonstrated ability to own complex deliverables, remove obstacles, escalate appropriately, and drive work through independently validated closure.
Experience developing executive reporting, risk assessments, control documentation, remediation plans, governance materials, and management responses.
Strong stakeholder-management, organizational, analytical, written, and verbal communication skills.
University degree or equivalent practical experience in information security, technology, risk management, audit, business, or a related discipline.

Nice To Haves

Experience managing PCI compliance in a large financial services, insurance, payment-processing, or similarly regulated organization.
Professional certification such as PCI Professional, Internal Security Assessor, Qualified Security Assessor, CISSP, CISA, CRISC, or equivalent.
Experience with PCI DSS v4.0.1, targeted risk analyses, compensating controls, customized approaches, third-party service-provider oversight, and payment-page security.
Experience with governance, risk, and compliance platforms, structured evidence repositories, control automation, vulnerability-management tools, and executive dashboards.
Working knowledge of payment architecture, cloud services, identity and access management, network segmentation, encryption, tokenization, application security, penetration testing, and incident response.

Responsibilities

Own end-to-end PCI DSS compliance across the TD Insurance family, from annual planning and scope validation through evidence submission, assessment support, remediation, attestation, and ongoing compliance.
Establish and maintain the annual PCI compliance roadmap, milestones, deliverables, ownership model, and governance calendar.
Translate PCI DSS requirements into clear obligations for business, application, infrastructure, security, operations, and third-party teams.
Serve as the primary TD Insurance PCI subject-matter expert and coordination point for internal stakeholders and external assessors.
Lead annual confirmation of the cardholder data environment, including payment channels, applications, infrastructure, data flows, integrations, service providers, and connected systems.
Maintain the PCI system inventory, data-flow diagrams, scope rationale, control-owner register, responsibility matrix, evidence catalogue, and applicability decisions.
Identify sustainable opportunities to reduce PCI scope through segmentation, tokenization, outsourcing, architectural change, or removal of cardholder data.
Assign and clarify control responsibilities and ensure accountable owners understand their ongoing obligations.
Coordinate annual PCI DSS assessments and deliverables, including applicable Reports on Compliance, Self-Assessment Questionnaires, and Attestations of Compliance.
Partner with Qualified Security Assessors, Approved Scanning Vendors, internal audit, cyber security, compliance, and control owners throughout the assessment lifecycle.
Implement evidence-management processes to ensure evidence is complete, current, accurate, approved, traceable, and assessment-ready.
Conduct readiness reviews and control-health assessments before formal testing.
Maintain defensible records of scope determinations, control design decisions, exceptions, targeted risk analyses, and compensating controls.
Track deliverables, control gaps, evidence deficiencies, risks, dependencies, and remediation commitments through validated closure.
Develop remediation plans with owners, target dates, interim controls, dependencies, and measurable closure criteria; escalate overdue or ineffective remediation and communicate impacts.
Coordinate resources and decisions needed to meet assessment deadlines and verify that remediation addresses underlying weaknesses and creates sustainable evidence.
Identify recurring issues and implement process, control, automation, or governance improvements to prevent repeat findings.
Lead PCI governance meetings and working sessions, documenting and following through on decisions, actions, risks, and accountabilities.
Produce senior-leadership reporting on compliance status, scope, assessment readiness, control effectiveness, material gaps, remediation progress, and decisions required.
Define and monitor indicators such as evidence readiness, overdue actions, control-testing results, recurring findings, third-party compliance status, and assessment risk.
Communicate complex PCI requirements and security risks in business terms and escalate material control deficiencies through appropriate governance channels.
Move the program toward continuous compliance and year-round control ownership.
Establish recurring checkpoints for control validation, evidence refresh, vulnerability management, access reviews, penetration testing, external scans, incident-response exercises, third-party monitoring, and policy reviews.
Assess changes to applications, payment channels, infrastructure, vendors, and business processes for PCI scope or control impacts.
Monitor changes to PCI standards, supporting guidance, payment-channel risks, and industry practices, and translate them into actionable requirements.
Develop reusable templates, procedures, playbooks, training materials, and evidence standards to improve consistency and reduce key-person dependency.