Senior Information Technology Security Analyst

Security Engineer, Davis, California(Hybrid-onsite) Phone + Skype J.D:Location: Davis. CA (candidates must be based in CA, no relocation). This is a hybrid role with the expectation to go on-site 1x a week. a senior PCI Assessor to help support our client's PCI DSS business-as-usual assessments, support the annual PCI DSS compliance assessment, and prepare for PCI 4.0. Essential Responsibilities: 85% Information Security Consulting The Assessor will conduct PCI 3.2.1 compliance assessments, PCI DSS 4.0 readiness assessments, and consult with merchants on PCI related matters. 15% Documentation The Assessor will document PCI assessments and support the development of a roadmap toward PCI 4.0 compliance. The Assessor will produce status reports for the CISO. Experience and Skills

• Practical knowledge of the PCI DSS 3.21 and 4.0 and experience applying PCI principles in various merchant environments;
• Demonstrated experience in performing security and compliance assessments (i.e., SSAE 18 SOC 2, HIPAA, HITRUST, NIST, etc.);
• Demonstrated experience in reviewing SSAE 18 SOC 2, HIPAA, HITRUST, NIST, etc. reports as well as PCI DSS SAQs, AOCs and ROCs);
• Solid understanding of IT security principles, including cloud infrastructure (Azure, AWS, Google Cloud), network, database, and application security, firewalls, and identity and access management;
• Practical ability to interpret processes and controls, identify risks and gaps to framework compliance, articulate remediation plans, and validate remediation of gaps;
• Strong written and oral communication skills; comfortable speaking with and delivering presentations to client and internal Firm audiences;
• Ability to work independently and within a team to accomplish assigned tasks timely and accurately;
• Highly collaborative and innovative;
• Demonstrated work ethic and professionalism

• 3-5 years of information security and PCI DSS experience required;
• Demonstrated success in a client service role

• ISA (Internal Security Assessor), PCIP (PCI Professional), or QSA (Qualified Security Assessor) certification or eligible to achieve certifications required;
• CISA (Certified Information Systems Auditor) or CISSP (Certified Information Systems Security Professional) preferred