Technology Solutions Pay Details: $96,900 - $136,800 CAD TD is committed to providing fair and equitable compensation opportunities to all colleagues. Our compensation policies and practices have been designed to allow colleagues to progress through the salary range over time as they progress in their role.

The Information Security

Specialist is a senior technology professional responsible for end-to-end accountability for the Payment Card Industry Data Security Standard, or PCI DSS, compliance program across the TD Insurance family. You will work with business, technology, cyber security, risk, audit, procurement, finance, payment assessors and third-party partners to maintain a sustainable and evidence-based PCI compliance program. This role is suited to an experienced PCI practitioner who has managed compliance activities, driven remediation, prepared organizations for assessments, and consistently delivered commitments through to closure.

The role aligns with the Information Security Specialist individual-contributor profile, which calls for expert information security and risk knowledge, leadership across complex initiatives, communication skills, regulatory consultation, audit preparation, remediation management, governance, and reporting.As the Information Security Specialist responsible for PCI compliance, you will:Own the PCI compliance programMaintain end-to-end accountability for PCI compliance across the TD Insurance family, from annual planning and scope validation through evidence submission, assessment support, remediation, attestation, and ongoing complianceEstablish and maintain the annual PCI compliance roadmap, milestones, deliverables, ownership model, and governance calendarTranslate PCI DSS requirements into clear obligations for business, application, infrastructure, security, operations, and third-party teamsAct as the primary TD Insurance PCI subject-matter expert and central point of coordination for internal stakeholders and external assessorsMaintain scope and control accountability Lead the annual confirmation of the cardholder data setting, including payment channels, applications, infrastructure, data flows, integrations, service providers, and connected systemsMaintain the PCI system inventory, data-flow diagrams, scope rationale, control-owner register, responsibility matrix, evidence catalogue, and applicability decisionsChallenge unnecessary scope and identify sustainable scope-reduction opportunities through segmentation, tokenization, outsourcing, architectural change, or removal of cardholder dataEnsure control responsibilities are clearly assigned across all applicable PCI requirements and that accountable owners understand their ongoing obligationsDrive assessments and evidence readiness Coordinate annual PCI DSS assessments and associated deliverables, including the applicable Report on Compliance, Self-Assessment Questionnaire, and Attestation of CompliancePartner with Qualified Security Assessors, Approved Scanning Vendors, internal audit, cyber security, compliance, and control owners throughout the assessment lifecycleImplement a disciplined evidence-management process that confirms evidence is complete, current, accurate, approved, traceable, and assessment-readyConduct readiness reviews and control-health assessments before formal testing beginsMaintain a defensible record of scope determinations, control design decisions, exceptions, targeted risk analyses, and compensating controlsPCI DSS v4.0.1 is the current standard identified in the PCI Security Standards Council document library, which also provides the prioritized approach, assessment templates, attestations, targeted-risk-analysis material, and guidance for compensating controlsDeliver compliance outcomes Track PCI deliverables, control gaps, evidence deficiencies, risks, dependencies, and remediation commitments from identification through validated closureDevelop practical remediation plans with named owners, target dates, interim controls, dependencies, and measurable closure criteriaEscalate overdue or ineffective remediation promptly, clearly articulating customer, business,



technology, compliance, and reputational impactsCoordinate the resources and decisions required to meet assessment deadlines, rather than limiting the role to status reportingVerify that remediation addresses the underlying control weakness and produces sustainable evidence for future assessmentsIdentify recurring issues and implement processes, control, automation, or governance improvements to prevent repeat findingsProvide governance and executive reporting Lead PCI governance meetings and working sessions, ensuring decisions, actions, risks, and accountabilities are documented and followed throughProduce concise reporting for senior leadership covering compliance status, scope, assessment readiness, control effectiveness, material gaps, remediation progress, and decisions requiredDefine and monitor meaningful indicators such as evidence readiness, overdue actions, control-testing results, recurring findings, third‑party compliance status, and overall assessment riskCommunicate complex PCI requirements and security risks in clear business termsEscalate material control deficiencies through the appropriate technology, risk, compliance, and business governance channelsEmbed continuous compliance Move the program from annual assessment preparation toward continuous compliance and year‑round control ownershipEstablish recurring checkpoints for control validation, evidence refresh, vulnerability management, access reviews, penetration testing, external scans, incident‑response exercises, third‑party monitoring, and policy reviewsAssess changes to applications, payment channels, infrastructure, vendors, and business processes for potential PCI scope or control impactMonitor changes to PCI standards, supporting guidance, payment‑channel risks, and industry practices, and translate them into actionable requirements for TD InsuranceDevelop reusable templates, procedures, playbooks, training materials, and evidence standards to improve consistency and reduce key‑person dependencyWhat You Need to Succeed Direct, hands‑on experience owning or leading a PCI DSS compliance program or a substantial PCI workstream through a complete assessment lifecycle.A proven record of delivering PCI compliance outcomes, including coordinating control owners, collecting and validating evidence, resolving assessment issues, driving remediation, and meeting committed dates.Previous experience working in a dedicated PCI compliance, PCI controls, payment security, information security, technology risk, or audit‑readiness capacity.Advanced knowledge of PCI DSS requirements, cardholder‑data‑environment scoping, evidence expectations, control testing, remediation management, and audit or assessment preparation.Experience working directly with Qualified Security Assessors, internal or external auditors, security teams, technology owners, business stakeholders, and third‑party service providers.Experience developing executive reporting, risk assessments, control documentation, remediation plans, governance materials, and management responses.University degree or equivalent practical experience in information security, technology, risk management, audit, business, or a related discipline.Experience managing PCI compliance in large financial services, insurance, payment‑processing, or similarly regulated organization.Professional certification such as PCI Professional, Internal Security Assessor, Qualified Security Assessor, CISSP, CISA, CRISC, or equivalent.0.1, targeted risk analyses, compensating controls, customized approaches, third‑party service‑provider oversight, and payment‑page security.Experience with governance, risk, and compliance platforms, structured evidence repositories,



control automation, vulnerability‑management tools, and executive dashboards.Working knowledge of payment architecture, cloud services, identity and access management, network segmentation, encryption, tokenization, application security, penetration testing, and incident response.Clear and current scope, ownership, control, and evidence documentation.Material risks and compliance gaps identified early and escalated appropriately.Reduced recurrence of control and evidence deficiencies.Increased automation, reusable evidence, and year‑round control readiness.Strong engagement and accountability across business and technology control owners.TD is one of the world's leading global financial institutions and is the fifth largest bank in North America by branches/stores. Together, we are reimagining what banking can be for our clients, colleagues and communities.Our Total Rewards package reflects the investments we make in our colleagues to help them and their families achieve their financial, physical, and mental well‑being goals.

Total

Rewards at TD includes a base salary, variable compensation, and several other key plans such as health and well‑being benefits, savings and retirement programs, paid time off, banking advantages and discounts, career development, and reward and recognition programs. We’re delighted that you’re considering building a career with TD. Through regular development conversations, training programs, and a competitive benefits plan, we’re committed to providing the support our colleagues need to thrive both at work and at home.

If you’re interested in a specific career path or are looking to build certain skills, we want to help you succeed. You’ll have regular career, development, and performance conversations with your manager, as well as access to an online learning platform and a variety of mentoring programs to help you unlock future opportunities. If you’re passionate about helping clients and building deep, lasting relationships, TD offers diverse career paths where you can grow your expertise and make a meaningful impact.

Here at TD, we hire and develop the best.Training & Onboarding We will provide training and onboarding sessions to ensure that you’ve got everything you need to succeed in your new role.We do our best to communicate outcomes to all applicants by email or phone call.Please let us know if you’d like accommodations (including accessible meeting rooms, captioning for virtual interviews, etc.) to help us remove barriers so that you can participate throughout the interview process.

Language

Requirement (Quebec only) At TD we’re guided by our purpose to enrich the lives of our customers, communities and colleagues, and share a set of values that shape our culture and guide our behavior. In exchange for how our colleagues show up to help TD succeed, we are committed to delivering a colleague experience grounded in Impact, Growth and a Culture of Care. No matter where you work across TD, we empower you to make an impact at work and in your community, explore and grow your career and be part of our caring and inclusive culture.Our Commitment to Diversity, Equity, and Inclusion At TD, we’re committed to fostering an environment where all colleagues are encouraged to bring their authentic selves to work, experience equitable opportunities, and feel respected and supported.

We’re dedicated to building an inclusive workforce that reflects the diversity of the customers and the communities in which we live and serve.Helping to Make an Impact in Communities – TD Ready Commitment TD has a long‑standing commitment to help drive progress towards a more inclusive and sustainable future. Under the TD Ready Commitment, we are targeting a total of C$1 billion by 2030 in community giving across four key, interconnected drivers of change: Financial Security, Vibrant Planet, Connected Communities, and Better Health. It’s our goal to help support change, nurture progress, and contribute to making the world a better, more inclusive place for our customers, colleagues, and communities.

📌 Information Security Specialist - Pci Dss Compliance (Winnipeg)
🏢 The Toronto-Dominion Bank (Canada)
📍 Winnipeg