Director, Security Compliance

If you need assistance during the recruiting process due to a disability, please reach out to our Recruiting Accommodations Team through the Accommodation Request form. This form is used only by individuals with disabilities who require assistance or adjustments in applying and interviewing for a job. This form is not for inquiring about a position or the status of an application.

Director - Security Compliance 

Our worldview at Expedia Group is “Travel is a force for good”; we believe travel is a force for good in the world. You don’t have to look too closely to realize right now that the world needs all the goodness it can get – it needs more travel. And with that as our worldview, the work we do at Expedia Group becomes more important than ever. Expedia Services is where exceptional technical and businesspeople come together to leverage our two decades in travel and invest in scalable solutions. 

The Expedia Security & Privacy Organization is seeking a highly motivated, collaborative Director - Security Compliance, with a practical self-starter mindset to be responsible for driving the overall development, implementation, and maintenance and management of the Global Compliance Program, including but not limited to regulatory needs such as PCI-DSS, GDPR/CCPA, etc. and best practices from SOC2, NIST CSF, ISO, etc. Additionally, this role is responsible for driving compliance focus and accountability across the organization and ensuring global compliance to all current regulatory guidelines and to Expedia Security & Privacy policies and standards. This position will serve as a primary liaison between internal and external auditor groups to integrate compliance regulation and controls to protect the Expedia’s assets and data globally. This is a unique role that will develop and drive operational excellence and program improvement and accelerate our mission to power global travel for everyone, everywhere. 

To be successful, you are organized, resourceful, possess domain knowledge on PCI DSS and security compliance and have a “can-do” attitude. You will be a key member of our security governance, risk, compliance, and privacy leadership team and responsible for providing expert risk analysis and information to business and risk management leadership. In this role, you will establish rapport with cybersecurity leadership, as well as external consultants to help support the company’s overall PCI DSS compliance. The role is charged with implementing and maintaining policies, as well as managing a comprehensive controls framework with industry requirements to ensure enterprise-wide PCI DSS compliance.

The ideal candidate will have diverse backgrounds and understand a variety of systems and services, including new technologies and legacy systems that are intertwined with PCI DSS scope. You will report to Senior Director – GRC and Privacy Operations. 

We believe diversity and inclusion among our teammates produces better results and is critical to our success as a global company and are committed to recruiting, developing, and retaining the most talented people from a diverse candidate pool.

What you'll do:

• Work in tandem with Product & Technology, risk management, cybersecurity and business leads to incorporate compliance practices and industry standards

• Develop and implement a comprehensive and Global Cybersecurity compliance program including but not limited to PCI-DSS, SOC2, GDPR, CCPA, HIPPA, NIST, ISO, etc. to achieve a strong compliance maturity model

• Ownership of a formal Compliance Governance process which aligns and prioritizes security initiatives, driving compliance focus and accountability across the organization

• Develop and establish executive dashboard reporting on compliance events, findings, accomplishments and publish to senior management and key stakeholders

• Manage the Global Compliance Program, which includes conducting the required testing and assessments including but not limited to PCI-DSS, SOC2, GDPR, HIPPA, NIST, ISO; and determine scope, process, testing, documentation, reporting, and remediation Continuously monitor changes to regulatory requirements, the threat landscape and business impact

• Partner with internal and external auditors to validate controls for compliance

• Direct compliance teams to document, communicate and enforce security improvements that balance risk with business operations and ensure controls do not weaken efficiencies o