PCI DSS Compliance - Senior Analyst

BP•Chicago, IL

10d•$112,000 - $208,000•Hybrid

About The Position

The PCI Compliance Analyst for North America supports and maintains the organization’s Payment Card Industry Data Security Standard (PCI DSS) compliance program. The role works with business units, Technology Digital Delivery, Digital Security, operational teams, and external assessors to maintain compliance, identify and remediate control gaps, and reduce payment-card data security risks. Responsibilities include coordinating compliance activities, overseeing control effectiveness, collecting evidence, supporting audits and assessments, and advising collaborators on PCI security requirements. The PCI Global Compliance Office is part of the Technology Digital Delivery, Mobility and Convenience organization. It works to maintain consistent, efficient, and sustainable PCI DSS compliance for bp as both a merchant and a service provider, while supporting effective payment solutions, customer-data protection, and cost-efficient compliance. The position is available at the Chicago and Ohio Westlake retail support center locations and is hybrid. Up to 50% travel is expected. The annual base pay range is $112,000–$208,000. The role is not eligible for relocation assistance.

Requirements

Practical knowledge of PCI DSS requirements.
Practical knowledge of governance, risk, and compliance (GRC) platforms.
Excellent verbal and written communication skills, including the ability to explain challenges and propose solutions concisely.
Strong teamwork skills and ability to obtain help from others.
Initiative and follow-through, including the ability to navigate challenging situations, overcome obstacles, and drive problems to closure.
Strong analytical and problem-solving skills.
Audit and compliance mindset.
Ability to manage multiple priorities and deadlines.
A bachelor's degree in Information Security, Information Technology, Cybersecurity, or a related field is listed under preferred qualifications.
Equivalent combinations of education and experience are considered sufficient.

Nice To Haves

One or more information security or compliance-related certifications, such as CISSP, CISA, PCI ISA, PCIP, or CISM.
Familiarity with vulnerability management, access management, logging and monitoring, encryption technologies, network segmentation, and security incident management.
Understanding of security frameworks such as the NIST Cybersecurity Framework, ISO 27001, and CIS.
Two or more years of experience in PCI or other regulatory IT compliance or information security efforts.
Experience in financial services, payments, retail, healthcare, or another regulated industry.
Experience in a similar governance, risk, and compliance role at a large-scale organization.

Responsibilities

Support the organization’s PCI DSS compliance program and annual assessment activities.
Maintain current PCI DSS documentation, align it with company digital security policies and procedures, and promote responsibility matrices.
Assist with creating and maintaining PCI scope documentation, network diagrams, and data-flow diagrams.
Conduct ongoing PCI compliance governance reviews across business, technology, and security teams.
Monitor changes to PCI DSS requirements and assess their organizational impact.
Identify compliance gaps, recommend corrective actions, oversee remediation, and validate closure of findings.
Coordinate collection and validation of evidence for PCI assessments.
Prepare documentation for Qualified Security Assessor reviews, Self-Assessment Questionnaires, and internal audits.
Partner with Digital Security, infrastructure, technology, and operational teams to integrate PCI requirements into business processes.
Provide customers with guidance and interpretation of PCI DSS requirements.
Facilitate compliance meetings and communicate compliance status to management.
Assist with developing PCI compliance awareness and training initiatives.
Develop and maintain PCI compliance dashboards and reports.
Report compliance metrics, remediation status, and emerging risks to leadership.
Maintain accurate records supporting regulatory and compliance requirements.