Sr Compliance Specialist - Security

Williams-Sonoma•Rocklin, CA

5d•Onsite

About The Position

The Sr Compliance Specialist - Security plays a lead role in demonstrating sustained compliance with requirements protecting the company’s high-value systems and information assets. Security Compliance spans the corporate environment and consumer delivery channels, addressing legal requirements and industry standards including PCI-DSS, SOX, ISO, HIPAA, CA1386, and GDPR. The Specialist supports periodic updates to policies, standards, and awareness materials and validates that key controls are implemented soundly and sustainably. The role may identify potential security exceptions, help resolve business requirements, escalate matters requiring management attention, and oversee timely remediation of information security vulnerabilities. It also provides execution support to development and operations teams for risk assessments, due diligence, data management, ongoing oversight, and compliance reporting. The current focus is conducting internal PCI-DSS assessments and assisting business units and functional teams in scope for external PCI-DSS compliance validation. The Specialist helps define assessment scope, verify adherence to PCI requirements, provide PCI-DSS education and mentorship, and maintain productive working relationships with technical and management staff throughout the organization. The role is onsite in the Rocklin, California office Monday through Thursday.

Requirements

BA/BS degree or equivalent experience.
At least 7 years of experience in the information security field.
At least 5 years of experience in a PCI support role or engineering position.
CISSP, CISM, CISA, or similar certification, such as GIAC Certified ISO-17799 Specialist (G7799).
Extensive knowledge and experience with information security standards and methodologies, including PCI-DSS, ISO 9000 series, COBIT, Sarbanes-Oxley, HIPAA, and other relevant industry security standards.
In-depth knowledge of risk assessment and risk analysis.
Excellent written and verbal communication skills.
Leadership experience in a previous job.
Results-oriented and self-motivated.
Ability to work onsite in the Rocklin, California office Monday through Thursday.

Nice To Haves

QSA or ISA qualification.
Experience in an enterprise-class technology organization working with large-scale distributed systems environments.
Experience working with, and ideally writing, information security policies and standards, and/or developing or implementing security-related tools.
Understanding of information security holistically and how it relates to business goals.
Ability to design, implement, reengineer, and manage complex processes.
Privacy certification, such as Certified Information Privacy Professional.
Experience communicating complex privacy and security compliance issues to senior management, business units, and external parties.
Experience presenting IT security issues to large audiences, forums, or communities.
Experience working within the retail sector.

Responsibilities

Plan and conduct PCI assessments and establish remediation plans.
Engage business units at predetermined times to provide summary analyses of their compliance posture at checkpoints throughout the year.
Identify and recommend changes to procedures, processes, and delivery scope needed to demonstrate sustained compliance with PCI requirements.
Assist with PCI-DSS compliance checklists, including review and validation of existing controls and documentation and identification of potential gaps.
Provide management guidance and expertise on PCI gaps and help prioritize remediation targets.
Reduce resource owners’ demand for evidence collection and analysis through use of GRC and related security tools.
Lead remote scoping practices and procedures to reduce the company’s overall PCI-DSS scope where possible.
Provide remediation guidance to technical teams to establish and maintain sustained PCI-DSS compliance.
Provide PCI-DSS education and direct mentorship to develop associates and foster an efficient, innovative, and collaborative work environment.
Support updates to policies, standards, and awareness materials and validate that key controls are implemented and sustained.
Support development teams and operations groups with risk assessments, due diligence, data management, ongoing oversight, and compliance reporting.
Identify potential security exceptions, help resolve business requirements, escalate matters requiring management attention, and oversee timely vulnerability remediation.

Benefits

A generous discount on all WSI brands.
A 401(k) plan and other investment opportunities.
Paid vacations, holidays, and time off to volunteer.
Health benefits, dental and vision insurance, including same-sex domestic partner benefits.
Tax-free commuter benefits.
A wellness program supporting physical, financial, and emotional health.
In-person and online learning opportunities through WSI University.
Cross-brand and cross-function career opportunities.
Resources for self-development.
Advisor (Mentor) program.
Career development workshops, learning programs, and speaker series.
Compensation may include paid time off, merit, and bonus opportunities.