PCI & SOX Compliance Specialist
HybridLondon, England, United Kingdom
Job Summary
Own vulnerability remediation loops by tracking quarterly PCI ASV scans and penetration testing cycles, collaborating with IT and engineering teams to execute patches within strict SLA windows. Lead the integration pipeline through continuous gap analyses that map security controls while merging legacy travel infrastructure into Navan's modern cloud frameworks. Drive SOX 404 controls by testing and validating IT General Controls, with heavy emphasis on access management and secure code deployment. Embed with engineering teams to automate manual evidence gathering and translate compliance jargon into actionable JIRA tickets. Collaborate globally with US-based audit firms, managing the risk register and remediation tracking lifecycle from initial identification to final verification. This role supports the London-based GRCT team, requiring a hybrid schedule with occasional evening shifts for US alignment.
Required Qualifications
- Minimum of 3+ years of hands-on, corporate operational experience in information security compliance
- Active experience sitting on a corporate security or IT team
- Proved, practical exposure executing compliance frameworks for transactional environments
- Understanding of Section 404 ITGCs
- Understanding of the technical mechanics of PCI DSS
- Understanding of cardholder data protection environments
- Understanding of SAQs
- Comfortable navigating tracking platforms such as JIRA, ServiceNow GRC, or AuditBoard
- Baseline technical background (e.g., computer science, systems administration, or IT support)
- Willingness to work under a hybrid model out of our London office (4 days a week)
- Routine flexibility needed to support monthly evening shifts for US team synchronization
- Full proficiency in English
Desired Qualifications
- Certifications such as CompTIA Security+ or ISO 27001 Internal Auditor
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.