Work

Location:
Toronto, Ontario, Canada Hours: 37.5 Line of Business: Technology Solutions Pay Details: $96,900
- $136,800 CAD TD is committed to providing fair and equitable compensation opportunities to all colleagues. Growth opportunities and skill development are defining features of the colleague experience at TD. Our compensation policies and practices have been designed to allow colleagues to progress through the salary range over time as they progress in their role. The base pay actually offered may vary based upon the candidate's skills and experience, job-related knowledge, geographic location, and other specific business and organizational needs. As a candidate, you are encouraged to ask compensation related questions and have an open dialogue with your recruiter who can provide you more specific details for this role.

Job Description

The Information Security Specialist is a senior technology professional responsible for end-to-end accountability for the Payment Card Industry Data Security Standard, or PCI DSS, compliance program across the TD Insurance family. You will work with business, technology, cyber security, risk, audit, procurement, finance, payment assessors and third-party partners to maintain a sustainable and evidence-based PCI compliance program. This role is suited to an experienced PCI practitioner who has managed compliance activities, driven remediation, prepared organizations for assessments, and consistently delivered commitments through to closure. The role aligns with the Information Security Specialist individual-contributor profile, which calls for expert information security and risk knowledge, leadership across complex initiatives, communication skills, regulatory consultation, audit preparation, remediation management, governance, and reporting.




As the Information Security Specialist responsible for PCI compliance, you will:Own the PCI compliance programMaintain end-to-end accountability for PCI compliance across the TD Insurance family, from annual planning and scope validation through evidence submission, assessment support, remediation, attestation, and ongoing complianceEstablish and maintain the annual PCI compliance roadmap, milestones, deliverables, ownership model, and governance calendarTranslate PCI DSS requirements into explicit obligations for business, application, infrastructure, security, operations, and third-party teamsAct as the primary TD Insurance PCI subject-matter expert and central point of coordination for internal stakeholders and external assessorsMaintain scope and control accountability Lead the annual confirmation of the cardholder data environment, including payment channels, applications, infrastructure, data flows, integrations, service providers, and connected systemsMaintain the PCI system inventory, data-flow diagrams, scope rationale, control-owner register, responsibility matrix, evidence catalogue, and applicability decisionsChallenge unnecessary scope and identify sustainable scope-reduction opportunities through segmentation, tokenization, outsourcing, architectural change,



or removal of cardholder dataEnsure control responsibilities are clearly assigned across all applicable PCI requirements and that accountable owners understand their ongoing obligationsDrive assessments and evidence readiness Coordinate annual PCI DSS assessments and associated deliverables, including the applicable Report on Compliance, Self-Assessment Questionnaire, and Attestation of CompliancePartner with Qualified Security Assessors, Approved Scanning Vendors, internal audit, cyber security, compliance, and control owners throughout the assessment lifecycleImplement a disciplined evidence-management process that confirms evidence is complete, current, accurate, approved, traceable, and assessment-readyConduct readiness reviews and control-health assessments before formal testing beginsMaintain a defensible record of scope determinations, control design decisions, exceptions, targeted risk analyses, and compensating controlsPCI DSS v4.0.1 is the current standard identified in the PCI Security Standards Council document library, which also provides the prioritized approach, assessment templates, attestations, targeted-risk-analysis material, and guidance for compensating controlsDeliver compliance outcomes Track PCI deliverables, control gaps, evidence deficiencies, risks, dependencies, and remediation commitments from identification through validated closureDevelop practical remediation plans with named owners, target dates, interim controls, dependencies, and measurable closure criteriaEscalate overdue or ineffective remediation promptly, clearly articulating customer, business, technology, compliance, and reputational impactsCoordinate the resources and decisions required to meet assessment deadlines, rather than limiting the role to status reportingVerify that remediation addresses the underlying control weakness and produces sustainable evidence for fu

📌 Information Security Specialist (Canada)
🏢 TD Bank Group
📍 Canada