Head of PCI DSS Advisory

OBRYN GUARD Inc.

Remote

Cybersecurity | GRC | PCI DSS | SaaS | Hospitality

About OBRYN GUARDOBRYN GUARD Inc. is a Canadian cybersecurity and governance, risk and compliance technology company building a cloud-based platform for continuous control monitoring, cybersecurity risk management and compliance readiness.

Our initial focus is the hospitality industry, helping hotels and multi-property organizations improve visibility into cybersecurity risk, organize evidence, identify compliance gaps, manage remediation and maintain stronger ongoing readiness for frameworks including PCI DSS, SOC 2 and ISO/IEC 27001.

We are building a global team across security, engineering, product, QA, solutions, operations and sales.

The RoleWe are seeking a Head of PCI DSS Advisory to lead OBRYN GUARD’s PCI DSS and payment-security advisory function.

This is a senior specialist role responsible for shaping how PCI DSS requirements are translated into practical customer workflows, platform methodology, evidence requirements, remediation guidance and hotel payment-security readiness.

You will work closely with our Head of Security, Engineering, Product, QA, Solutions and Leadership teams to ensure OBRYN GUARD’s PCI-related workflows are technically accurate, operationally practical and appropriately positioned as readiness and advisory support.

This role is particularly suited to someone with deep hands-on PCI DSS experience across complex merchant and payment environments.

Key ResponsibilitiesPCI DSS Leadership

- Lead OBRYN GUARD’s PCI DSS advisory methodology.
- Interpret PCI DSS requirements and translate them into practical customer and platform workflows.
- Support PCI DSS v4.x readiness programs.
- Develop PCI control mappings, evidence requirements and remediation methodologies.
- Help establish clear distinctions between automated controls, manual evidence and specialist review.
- Review PCI-related platform functionality for methodological accuracy.

SAQ Readiness
- Support development of SAQ eligibility and readiness workflows.
- Help determine what information must be collected before recommending an appropriate SAQ path.
- Develop questionnaires and decision-support processes around merchant payment environments.
- Identify situations requiring escalation to an appropriately qualified external assessor or QSA
- Company.

CDE & Payment Environment Scoping
- Develop repeatable methodologies for Cardholder Data Workplace discovery and scoping.
- Review payment flows, systems, connected environments and third-party dependencies.
- Support documentation of where account data enters, moves through, is processed or may be stored.
- Review segmentation, remote access, vendor access and systems capable of affecting the security of the CDE.





Hospitality Payment SecuritySupport PCI readiness across hotel environments including:
- Front desk payment terminals
- PMS environments
- POS systems
- Restaurants and bars
- Booking engines
- Hotel websites
- Payment gateways
- Virtual terminals
- Telephone reservations
- E-commerce
- Mobile payment environments
- Spa, retail, parking and event payments
- Franchise and management-company structures
- Multi-property and shared-service environments

Third-Party Service Providers
- Review payment processor and TPSP responsibilities.
- Develop shared-responsibility methodologies.
- Support review of AOCs and vendor compliance evidence.
- Identify gaps in third-party responsibility and evidence.

Evidence & Remediation
- Define acceptable PCI evidence standards.
- Establish evidence freshness and sufficiency expectations.
- Review customer evidence where appropriate.
- Identify PCI readiness gaps.
- Provide practical remediation guidance.
- Support prioritization of material payment-security risks.

Product & Engineering
- Translate PCI requirements into product requirements.
- Work with Engineering on technical feasibility.
- Support Product with workflows and acceptance criteria.
- Work with QA to validate PCI-related platform functionality.
- Help ensure OBRYN GUARD does not incorrectly represent an automated result, integration or uploaded document as complete proof of PCI DSS compliance.

Customer & Solutions Support
- Support Solutions during customer onboarding and payment-environment discovery.
- Participate in selected customer PCI readiness discussions.
- Support complex hotel and enterprise engagements.
- Review difficult PCI questions and escalations.
- Help develop executive-ready PCI readiness reporting.

Required Experience
- Significant hands-on PCI DSS experience.
- Strong understanding of PCI DSS v4.x.
- Experience with merchant and payment environments.
- Experience with SAQs and PCI readiness programs.
- Strong understanding of CDE scoping and payment-flow mapping.
- Experience reviewing PCI evidence and remediation plans.
- Experience with payment gateways, processors, POS systems and third-party service providers.
- Ability to interpret technical and compliance requirements and convert them into practical workflows.
- Experience communicating with technical teams, leadership and customers.
- Strong written documentation and methodology-development skills.

Preferred Experience




- Current or previous PCI SSC Qualified Security Assessor experience.
- Experience working through or alongside a PCI SSC QSA Company.
- Experience preparing or reviewing ROC, AOC or SAQ-related engagements.
- Experience with PCI DSS Level 1 environments.
- Hospitality, retail, payments or multi-location merchant experience.
- ISO/IEC 27001, SOC 2 or broader GRC experience.
- Cloud, network, IAM or application-security experience.
- Experience working with SaaS platforms or technology companies.
- Certifications such as PCIP, PCI ISA, CISSP, CISA, CISM, ISO 27001 or similar are considered an asset.

Professional BoundariesOBRYN GUARD provides cybersecurity and compliance readiness technology and advisory support.

This role does not, by itself, make OBRYN GUARD Inc. a PCI SSC Qualified Security Assessor Company.

Where formal PCI DSS validation requires an appropriately qualified QSA Company or assessor, the engagement must be structured through the appropriate qualified entity.

Candidates with former QSA experience are welcome and encouraged to apply.

Who You’ll Work WithYou will collaborate closely with:

- Head of Security, Risk & Compliance
- Engineering
- Product
- QA
- Solutions
- Customer Success
- Operations
- Sales
- Executive Leadership

The Head of Security retains broader responsibility for enterprise cybersecurity, security governance, SOC 2, ISO 27001, NIST and overall security strategy. The Head of PCI DSS Advisory provides specialist leadership across PCI DSS and payment security.

What Success Looks LikeSuccess in this role means:

- Clear and defensible PCI methodology
- Strong hotel payment-environment discovery
- Accurate SAQ readiness workflows
- Consistent evidence standards
- Practical remediation guidance
- Strong collaboration with Engineering and Product
- Efficient onboarding of paying hotel customers
- Clear separation between readiness support and formal third-party validation
- A scalable PCI advisory model that can support multi-property hospitality organizations

EngagementRemote.

Initial engagement may be structured as an independent contractor arrangement with the potential for expanded long-term responsibility as OBRYN GUARD grows.

Compensation structure may include agreed professional-services compensation and equity participation depending on experience, responsibilities and final agreement.

About YouYou are practical, experienced and comfortable operating in a startup environment.

You can move between detailed PCI requirements, technical teams, customer conversations and executive-level discussions without losing accuracy.

You understand that compliance is not a checkbox exercise and that strong PCI readiness requires proper scoping, evidence, remediation and professional judgment.

OBRYN GUARD Inc.

Continuous Control. Proven Assurance.

📌 Head of PCI DSS Advisory (Canada)
🏢 OBRYN GUARD
📍 Canada