Business Analyst - PCI / Payment Systems

About this role

Position Overview
We are seeking a highly analytical and detail-oriented Business Analyst to support a critical enterprise initiative: achieving PCI DSS Level 1 Service Provider compliance through scope reduction, payment flow optimization, and tokenization.


This role will partner closely with the PCI Program Director to map, analyze, and redesign how payment data flows through the organization. The primary objective is to identify and eliminate unnecessary handling of cardholder data (PAN), enabling effective scope reduction and supporting a successful, audit-ready Report on Compliance (ROC).


This is a hands-on, discovery and process-focused role—ideal for someone who excels at understanding complex systems and translating them into clear, actionable insights.


This is a remote position.


Key Responsibilities
Payment Flow & Data Flow Mapping (Core Responsibility)

• Document end-to-end payment workflows, including:

• Customer booking and payment processes
• Internal system interactions (phone system, back-office)
• Third-party integrations (e.g., payment gateways, GDS, vendors)

• Identify where cardholder data (PAN) is:

• Collected
• Processed
• Stored
• Transmitted

• Develop and maintain:

• Data flow diagrams
• System interaction maps
• Process documentation aligned to PCI scope requirements

PCI Scope Identification & Reduction Support

• Analyze payment and data flows to identify opportunities to reduce PCI scope
• Partner with Security, Operations and Finance teams to:

• Eliminate unnecessary PAN handling
• Support segmentation strategies
• Enable system isolation and scope containment

• Ensure all scope-related documentation is accurate, complete, and defensible for audit

Tokenization & Payment Process Redesign

• Support design and implementation of tokenization strategies by:

• Mapping current vs. future-state payment flows
• Identifying systems and processes impacted by tokenization

• Work with Produ...