PCI & SOX Compliance Specialist

Join Navan, a leading global travel and expense platform, as a PCI & SOX Compliance Specialist. In this hands-on role, you will be embedded in London and drive the compliance integration between Navan and Reed & Mackay. You will own the day-to-day transaction compliance and technical evidence pipeline, actively track and oversee vulnerability remediation loops, conduct continuous gap analyses, and take ownership of testing and validating IT General Controls under Sarbanes-Oxley Section 404. You will also partner with development teams to automate manual evidence gathering and collaborate closely with US-based audit firms and compliance bodies.

• Actively track and oversee quarterly PCI ASV scans and penetration testing cycles, collaborating directly with IT and engineering teams to ensure patches are executed within strict SLA windows.
• Conduct continuous gap analyses and map security controls as we merge legacy travel infrastructure into Navan's modern cloud frameworks.
• Take ownership of testing and validating IT General Controls (ITGCs) under Sarbanes-Oxley Section 404, with a heavy emphasis on access control management (Joiners/Movers/Leavers) and secure code deployment.
• Bonus Points: Certifications such as CompTIA Security+ or ISO 27001 Internal Auditor
• Tools & Systems Mastery: Comfortable navigating tracking platforms such as JIRA, ServiceNow GRC, or AuditBoard to monitor, assign, and resolve open compliance findings
• PCI & SOX Technical Depth: Proved, practical exposure executing compliance frameworks for transactional environments. You must understand Section 404 ITGCs and the technical mechanics of PCI DSS (including cardholder data protection environments and SAQs)
• Experience: Minimum of 3+ years of hands-on, corporate operational experience in information security compliance. You must have active experience sitting on a corporate security or IT team—purely academic, training, or governmental advisory backgrounds will not fit the speed of this role
• Language requirements: Full proficiency in English
• Location & Hours Flexibility: Willingness to work under a hybrid model out of our London office (4 days a week) and the routine flexibility needed to support monthly evening shifts for US team synchronization
• A Technical Edge: A baseline technical background (e.g., computer science, systems administration, or IT support) that allows you to confidently push back on or guide engineers during patch cycles