PCI Analyst

Your Role:

The PCI ASV Analyst is responsible for guiding Tenable customers through the PCI DSS ASV external scanning process to achieve compliance with requirement 11.3.2. This role focuses on leading all client-facing engagements related to Tenable’s status as a PCI Approved Scanning Vendor (ASV), ensuring a successful and compliant outcome. The PCI ASV Analyst manages client expectations, provides consultative advice on scan findings, and fosters positive relationships by serving as a subject matter expert on the PCI ASV process.

Organisation Structure:

• Reports to: PCI Manager

Principal Accountabilities:

• Analyze and validate client-submitted PCI ASV scans for attestation, ensuring all reviews are conducted with a high degree of accuracy and adherence to PCI DSS standards.
• Conduct in-depth analysis of customer-submitted scan disputes by reviewing required evidence, performing independent verification, and recreating scenarios in a lab environment to ensure a fair and compliant resolution.
• Serve as a trusted advisor by guiding customers through the PCI ASV scan submission process to help them achieve their compliance objectives.
• Collaborate with Technical Support Engineers, providing expert guidance to ensure PCI-related inquiries are handled with accuracy and client success in mind.
• Proactively identify and contribute to workflow and process improvements to enhance the effectiveness and efficiency of the PCI ASV service.
• Maintain all required PCI ASV certifications and CPE hours, upholding the professional practice standards of the role.
• Resolve escalated customer issues by troubleshooting complex technical findings and making decisions on optimal solutions.
• Perform other PCI ASV duties as assigned to support the success of the compliance service and the team.

Other Responsibilities:

• May perform other duties and responsibilities that management may deem necessary from time to time.

Knowledge, Skills and Experience:

• At least five (5) years of information security experience, with specialized experience that includes a minimum of one (1) year in vulnerability scanning and/or penetration testing and at least two (2) years in any two of the following areas: Network security, Application security, System security, IT security auditing, or IT security risk assessment.
• Bachelor’s degree in a related technical field such as Information Technology, Computer Science, or equivalent work experience.
• Experience with Linux/Unix and Windows systems administration and security posturing.
• In-depth knowledge of network devices, their deployment and typical configurations.
• In-depth knowledge of networking.
• Knowledge of various web servers and other externally facing software applications.
• Experience in vulnerability scans and web app configuration scanning.
• Knowledge of CVSS scoring and how to use NVD to verify CVE’s.
• Customer service experience within the technical and cybersecurity background.
• Outstanding written and verbal communication skills.
• Ability to comfortably interact with senior management in a consultative manner.
• Ability to multi-task and manage multiple priorities in a fast-paced environment.
• A high degree of integrity, ethics, and confidentiality.
• Ability to work across different timezones, which may require an adjusted daily schedule on occasion.
• Must obtain PCI Certification within 3 months of employment. Preferably holds one of the current industry-recognized security certifications: CISA, CISM, CISSP, CCSP, GWAPT, Current PCI-QSA or PCI-ASV Certification.

Key Decisions:

• Make final determinations on complex technical issues by troubleshooting disputed findings, analyzing vulnerability data, and implementing optimal solutions to ensure accurate, compliant scan results.
• Drive positive client outcomes by resolving escalated issues, managing expectations through complex compliance scenarios, and ensuring timely service recovery.

Working Environments & Conditions:

• Ability to work remotely in a self-directed manner.
• Ability to sit and work at a computer for extended periods.
• Physically able to participate in training sessions, presentations and meetings.
• Client-facing travel may be required.
• Some Tenable office travel may be required.

#LI-AV1

#LI-Hybrid