Bigcommerce
Senior Security GRC Analyst (PCI ISA Specialist)
Austin, TX, USA · Senior
Stay score
odds of building a lasting career here
Sponsors, but it's cap-subject — you still face the weighted lottery (~30% per draw at Level II). Good if you win; have a cap-exempt backup on your list.
Lottery odds assume a STEM candidate.
Personalize to your clock →H-1B wage level
the lottery is wage-weighted — each level is one more entry
$22,911 more — $111,862 — moves this role to Level II and 2 lottery entries. That figure is inside the range the employer already advertised.
Based on the DOL prevailing wage for this occupation and worksite, a base salary of $111,862 would place this position at wage Level II. That figure is within the posted range, and I'd like to target it. This role classifies under "Information Security Analysts" for prevailing-wage purposes.
DOL prevailing wage, 2026-27 wage year · Information Security Analysts (15-1212) · Austin-Round Rock-San Marcos, TX. Wage level is derived by USCIS from the offered wage, occupation and worksite; the occupation shown is inferred from the job title.
Employer immigration record
from this employer's Department of Labor filings
Green-card follow-through: 60%
Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.
Community outcomes
No reports yet — be the first to help the next applicant.
About the role
- As a Senior Security GRC Analyst and Internal Security Assessor (ISA), you will serve as the primary Subject Matter Expert (SME) for our global PCI DSS program at Commerce.
- While your primary focus is PCI, you will be a key player in our broader GRC function, supporting our SOC2 and ISO 27001 certifications.
- You will act as the technical bridge between our Engineering, Infrastructure, and IT teams and external auditors, ensuring that our high-security standards are documented, validated, and maintained.
Responsibilities
- Scoping & Segmentation: Partner with Cloud Engineering to validate PCI scope across our global footprint, ensuring effective network segmentation and data flow isolation.
- Unified Control Framework: Support the broader GRC team in managing our SOC2 Type 2, ISO 27001, and other regulatory audits (as seen on https://www.google.com/search?q=security.commerce.com).
- Technical Advisory: Provide GRC perspective on architectural designs, product launches, and infrastructure changes to ensure "compliance by design."
- Remediation Management: Track and drive the remediation of audit findings and security gaps, working closely with asset owners to find pragmatic, secure solutions.
Requirements
- Regulatory Expertise: Thorough understanding of PCI DSS 4.0 requirements and the practical application of the standard in modern environments.
- Audit Fluency: Proven experience leading Level 1 Service Provider assessments.
- Communication: Ability to explain complex compliance requirements to developers and business leaders in a way that emphasizes enablement rather than "blockage."
- 6+ years in an Information Security or IT Audit role, with at least 3 years of deep focus on PCI DSS within a major cloud-native environment.
- Regulatory Expertise:
- Proven experience leading Level 1 Service Provider assessments.
- Ability to explain complex compliance requirements to developers and business leaders in a way that emphasizes enablement rather than "blockage."
Nice to have
- Broad Framework Knowledge:
- Experience with SOC2 and ISO 27001:2022.
- Experience with GRC automation and familiarity with modern cloud-native security and observability tools.
- Experience using GRC platforms and a desire to automate manual evidence collection to reduce audit fatigue.
- Broad Framework Knowledge: Experience with SOC2 and ISO 27001:2022.
- Cloud Security: Experience with GRC automation and familiarity with modern cloud-native security and observability tools.
- Automation Mindset: Experience using GRC platforms and a desire to automate manual evidence collection to reduce audit fatigue.
- You understand the "Why": You don't just "do compliance"
Skills
- Welcome to the Agentic Commerce Era
Compensation
- ISA Leadership: Serve as the officially designated PCI ISA for the organization. Manage the annual assessment lifecycle, including scoping, evidence collection, and validation of controls.
Company info
- Welcome to the Agentic Commerce Era At Commerce, our mission is to empower businesses to innovate, grow, and thrive with our open, AI-driven commerce ecosystem.
- We believe in harnessing AI responsibly to unlock new possibilities, and we're looking for individuals who use it intentionally to solve problems, accelerate outcomes, and expand what's possible in their role.
- If you want to be part of a team of bold builders, sharp thinkers, and technical trailblazers who shape the future of commerce, this is the place for you.
- attempt to solicit money from you as part of the hiring process or as part of an employment offer;
- solicit money to complete visa requirements as part of a job offer.
Visa & Work Authorization
- solicit money to complete visa requirements as part of a job offer.
This listing is sourced directly from Bigcommerce's careers page and normalized into a canonical job model.