Security Operations Engineer - PCI DSS

Teamified

1d

About The Position

The Security Operations Engineer will lead the client’s annual PCI DSS v4.0.1 compliance cycle for a cloud-hosted payment platform validated as a Level 2 service provider through SAQ D for Service Providers. This is a three-month contract combining hands-on security engineering with ownership of the compliance programme. The engineer will implement technical controls, assemble and quality-check evidence, complete the self-assessment questionnaire, and prepare the Attestation of Compliance for executive sign-off, working alongside the client’s engineering and operations teams. Documentation and evidence should be suitable for external assessment, as the client anticipates moving to QSA-led Level 1 validation in a future cycle.

The role includes defining and validating logging and monitoring controls, working with a DevOps engineer on a Wazuh SIEM and host intrusion detection rollout, coordinating external vulnerability scanning and penetration testing, maintaining compliance documentation and third-party service provider due diligence, and establishing repeatable routines the client team can continue after the engagement. The engineer owns the compliance outcome and delivery plan; the DevOps engineer owns the infrastructure build.

Requirements

• Demonstrable experience taking an organisation through PCI DSS compliance, ideally more than once and ideally including v4.x.
• Working knowledge of PCI DSS v4.0.1, including changes from v3.2.1 and requirements mandatory from 31 March 2025.
• Direct experience completing SAQ D or preparing evidence for a Report on Compliance.
• Hands-on AWS security engineering experience covering IAM policy design, VPC and network segmentation, audit logging, secrets and key management, and infrastructure-as-code. Equivalent depth in another major public cloud is acceptable if transferable design judgement can be demonstrated.
• Hands-on experience with SIEM or centralised log platforms in a compliance context, including log-source onboarding, parsing and normalisation, correlation and alert-rule development, file integrity monitoring, retention configuration, and tuning to reduce false positives.
• Ability to identify platforms previously used and explain what was configured, rather than only what was monitored.
• Practical experience in vulnerability management, logging and monitoring, access management, and secure configuration baselines.
• Ability to independently plan, track, report, and escalate; no project manager will be assigned.
• Excellent written English for producing documentation and evidence that others must read and accept.
• Willingness to record a control as not in place when that is accurate.

Nice To Haves

• Direct experience with Wazuh; equivalent open-source stacks such as OSSEC, Elastic Security, Graylog, or Security Onion are acceptable.
• Payments, fintech, or regulated financial services background.
• Understanding of the acquirer, processor, and card scheme landscape.
• Experience with Level 1 service provider validation or taking an organisation from self-assessment to QSA-led assessment.
• PCIP, ISA, CISSP, CISM, or equivalent certification.
• Jira administration and workflow configuration.
• Familiarity with ISO 27001 or SOC 2.

Responsibilities

• Implement and verify technical controls across the cardholder data environment, including access management, secure configuration, logging and monitoring, vulnerability management, encryption and key management, and secure development practices.
• Deliver PCI DSS v4.0.1 logging and monitoring requirements, including centralised audit-log collection, protection against alteration, twelve-month retention with three months immediately available, automated log review, time synchronisation, critical-file change detection, and alerts for failures of critical security control systems.
• Work with the DevOps engineer on the Wazuh SIEM and host intrusion detection rollout by defining log sources and coverage, developing and tuning detection and correlation rules, configuring file integrity monitoring and retention, validating compliance, and documenting evidence.
• Define the client team’s day-to-day alert triage and response routine.
• Complete SAQ D for Service Providers and assemble the supporting evidence set.
• Maintain network and cardholder dataflow diagrams, scoping and segmentation documentation, policies, and operating procedures.
• Engage and manage an Approved Scanning Vendor for quarterly external vulnerability scans and drive remediation to passing results.
• Scope and coordinate penetration testing with a qualified independent provider, and manage remediation and retesting.
• Maintain third-party service provider due diligence, including collecting partner AOCs and documenting shared responsibilities.
• Own the delivery plan, including schedule, dependencies, risk log, and weekly leadership reporting.
• Strengthen change management so changes are consistently raised, approved, tested, and evidenced.
• Document repeatable operational routines for the client team, including log review, access review, scan cadence, and change approval.

Benefits

• Flexibility in work hours and location, with a focus on managing energy rather than time.
• Access to online learning platforms and a budget for professional development.
• Collaborative, no-silos environment encouraging learning and growth across teams.
• Dynamic social culture with team lunches, social events, and opportunities for creative input.
• Leave benefits.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed