Selfridges
PCI Assurance Analyst
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Job Introduction
What is the role?
Reporting to the IT Security and IT GRC Manager, the PCI Assurance Analyst acts as our Payment Card Industry Data Security Standard (PCI DSS) subject matter expert and lead for the PCI-DSS compliance process.
Our PCI Assurance Analyst is responsible for ensuring compliance with the PCI DSS by assessing, validating, and evidencing how cardholder data is protected across people, processes, and technology.
The role involves interpreting PCI requirements, conducting control assessments and gap analyses, coordinating self-assessments or external audits, reviewing technical and procedural evidence, and working closely with IT, security, and business teams to remediate compliance gaps. Our PCI Assurance Analyst also maintains compliance documentation, tracks remediation plans, supports Qualified Security Assessor (QSA) engagements, and provides clear assurance reporting to stakeholders, helping reduce regulatory, financial, and reputational risk associated with payment card data.
The role can be based in either London or Leicester.
Role Responsibilities
- Interpret and apply PCI DSS requirements to our payment card environment across people, process, and technology
- Perform PCI DSS gap assessments against current controls and identify areas of non-compliance or control weakness
- Coordinate and manage PCI compliance activities including Self-Assessment Questionnaires (SAQs), Attestations of Compliance (AOC), and annual validation cycles
- Collect, review, and validate evidence
- Act as the primary liaison with Qualified Security Assessors (QSAs), acquirers, and payment brands during audits and assessments
- Track and support remediation plans, ensuring issues are clearly documented, risk-assessed, prioritized, and resolved
- Maintain accurate PCI documentation, including scoping diagrams, diagrams, risk assessments, policies, and procedures
- Support PCI scoping decisions, ensuring only necessary systems are in scope and controls are applied appropriately
- Provide assurance reporting to senior management on compliance status, risks, exceptions, and audit readiness
- Advise delivery teams on secure design and change impacts related to PCI-scoped systems
- Monitor changes to the PCI DSS standard and assess their impact on existing controls and future compliance obligations
- Promote a strong compliance and security culture through guidance, education, and pragmatic risk-based advice
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Skills & Experience
- Experience as an Information Security Governance Analyst is necessary for this role.
- Strong working knowledge of PCI DSS (scoping, requirements, validation methods, evidence expectations)
- Ability to interpret control intent and apply it pragmatically in real environments
- Understanding of risk-based assurance and control effectiveness
- General understanding of IT infrastructure, cloud services, networks, and application architecture
- Familiarity with payment environments, including POS, ecommerce platforms, payment gateways, tokenisation, and third-party service providers
- Ability to read and critique technical evidence (e.g. firewall rules, vulnerability scans, access logs)
- Experience performing gap analyses, control testing, and evidence reviews
- Strong attention to detail with the ability to spot control weaknesses or inconsistencies
- Ability to work effectively with IT, Security, POS, Infrastructure, DevOps, and suppliers
- Confident communicator who can explain compliance requirements to non-specialists
- Capable of producing clear assurance reporting for senior stakeholders
- Experience working in PCI DSS compliance, IT security assurance, audit, GRC, or risk management
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Desirable qualifications:
- PCI Professional (PCIP)
- ISO 27001 foundation / lead implementer / lead auditor
- CISM, CISSP, CRISC, or similar (beneficial, not always required)
Company:
Selfridges
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location