Senior Security Consultant, Continuity and Compliance - PCI DSS QSA

About the Role:

Pondurance is seeking an active PCI DSS Qualified Security Assessor (QSA) for our Senior Security Consultant, Continuity and Compliance position. This is a senior individual-contributor position for an experienced assessor who can independently manage engagements, evaluate technical and procedural controls, produce high-quality assessment documentation, and communicate findings to both technical teams and executive leaders. You’ll work primarily independently while collaborating with other consultants and internal subject matter experts as needed.

The ideal candidate will also have strong experience with regulatory and security frameworks, including HIPAA, NIST,
CMMC, and related security frameworks based on experience and business needs.

Responsibilities:

• Lead annual PCI DSS compliance assessments, including SAQs, ROCs, and other applicable validation activities in accordance with PCI SSC requirements and QSA responsibilities.
• Serve as a PCI DSS subject-matter expert and trusted advisor to clients throughout the assessment lifecycle.
• Assess client security programs, technical controls, and regulatory requirements to identify risks, vulnerabilities, compliance gaps, and opportunities for improvement.
• Develop practical remediation strategies and recommendations aligned with regulatory requirements, industry frameworks, risk, and client business needs.
• Own assigned consulting engagements from initiation through completion, including the accuracy, quality, documentation, and final readiness of assessment deliverables.
• Conduct client interviews, strategic advisory sessions, and workshops with executive leadership, technical teams, and key stakeholders to evaluate controls and communicate findings.
• Establish, review, and advise on client policies, procedures, and controls to support compliance, security, and risk-management objectives.
• Serve as a trusted security and compliance advisor, providing strategic guidance and applying professional judgment to complex, nuanced, or ambiguous client situations.
• Review the work of other consultants and provide technical guidance and mentorship regarding PCI DSS interpretation and assessment practices.
• Support additional security and compliance engagements involving NIST, HIPAA, CMMC, or related frameworks as needed.

Required Qualifications:

• Bachelor’s degree and 5+ years of experience in information security compliance, auditing, and assessments; or 7+ years of demonstrated experience in a related information security discipline.
• Current or recently active PCI DSS Qualified Security Assessor qualification, with the ability to satisfy applicable PCI SSC and Pondurance affiliation or requalification requirements.
• Demonstrated experience independently leading ROCs for Level 1 merchants, service providers, or similarly complex environments.
• Strong working knowledge of PCI DSS v4.0.1, including scoping, segmentation, evidence sampling, compensating controls, customized approaches, and reporting requirements.
• Experience evaluating payment environments, cardholder data flows, cloud infrastructure, networks, operating systems, databases, applications, identity controls, logging, vulnerability management, and security operations.
• Strong client-facing consulting skills, including the ability to navigate difficult findings and communicate effectively with technical and executive stakeholders.
• Demonstrated ability to manage multiple assessments and produce accurate, timely, and defensible deliverables.

Preferred Qualifications:

• CISSP, CISA, CISM, PCIP, ISA, or other relevant security certification.
• Experience assessing both merchants and service providers.
• Experience with cloud-based, hybrid, multi-tenant, or highly segmented environments.
• Experience with NIST, HIPAA, CMMC, SOC 2, or related frameworks.
• Experience mentoring assessors or performing formal quality reviews of PCI deliverables.

If you meet the QSA requirement but do not meet every preferred qualification, we still encourage you to apply. We value relevant assessment experience, technical depth, sound professional judgment, and strong client-advisory skills.

Work Environment & Schedule:

This is a full-time, U.S.-based remote position open to candidates in all 50 states. Preference will be given to candidates who can consistently work Central or Eastern Time business hours, regardless of where they reside. Team members must be available during established business hours as needed for client collaboration, calls, meetings, and internal teamwork.

Although this is a remote role, if you live close by, you’ll have access to our office located in McLean, VA.

Who we are:

At Pondurance, we embrace, educate, and protect people by helping make our world a better and safer place. We believe in inviting good people into our company who are driven to become great!

Every person at Pondurance is encouraged to focus and grow in their individual areas of interest, passion, and career path. We have accessible leaders as Mentors who believe “None of us are as smart as all of us” (R. Pelletier).

We believe everyone has the freedom to be themselves, especially at work, and so we embrace, support, and celebrate each other. Each one of us influences our company’s direction through speaking up; you have a voice, and we want you to use it.

Do you want to be a part of something different? Do you want to influence real change? Do you want to be part of the solution? Then join us in redefining the security and cyber risk landscape.

What We Offer:

The opportunity to apply your expertise, take on new challenges, and help customers address their biggest security objectives.

An inclusive culture of teamwork that embraces the diversity of our people and communities in which we work.

Compensation & Benefits

The anticipated base salary range for this position is $130,000 - $155,000 annually. Actual compensation will be determined in good faith based on factors such as relevant experience, technical expertise, certifications, geographic location (where applicable), and internal equity. This position may also be eligible for bonus or other incentive compensation, as well as the benefits described below.

Some of the corporate benefits for full-time employees include:

• Medical, dental, vision, disability, FSA, HSA, life and AD&D insurance, 401(k) Plan
• Time off: PTO, sick, holiday, & parental leave details are available

To promote a healthy and safe work community, we require background and drug screenings as part of our hiring process. Details of our process will be provided upon request.

We are an equal opportunity employer focused on celebrating diversity and inclusion. We believe that each individual should be treated equally without regard to race, color, identity, national origin, protected veteran status, religion, sex, including sexual orientation and gender identity, disability, or any other characteristic protected by law.

This job posting describes the general nature and level of work expected for this position and is not intended to be an exhaustive list of all responsibilities, duties, qualifications, or working conditions. Responsibilities and requirements may change based on business needs and applicable law.