Security, Risk & Compliance Architect (Payments Certification)

Project overview

We are co-creating a landmark merchant acquiring and SoftPOS transaction ecosystem for a next-generation European Digital Currency. Operating under an ambitious timeline, this greenfield initiative requires world-class cryptographic security and formal institutional laboratory certification from day one.

As the Security, Risk & Compliance Architect, you will safeguard the entire hardware and software stack and shepherd the product through formal PCI-MPOC and EMVCo security approvals.

What we offer:

• Strategic leadership role bridging high-security payment cryptography with formal international certification pipelines.
• Greenfield architecture without legacy constraints, shaping a flagship European Digital Currency infrastructure.
• Long-term B2B collaboration, full remote flexibility.
• Establish the end-to-end security architecture, threat modeling, data-at-rest/data-in-transit encryption standards, and tokenization frameworks across both the payment gateway and mobile terminal landscape.
• Own the compliance roadmap by mapping out, documenting, and architecting the exact software structures required to achieve formal PCI-MPOC, PCI-DSS, and EMVCo security approvals.
• Act as the primary technical point of contact for external security evaluation laboratories (such as FIME or Brightsight), managing technical documentation, penetration testing responses, and formal certification tracking.
• Architect structural integration points for real-time fraud mitigation tools, risk scoring engines, automated AML velocity checks, and internal operational security auditing dashboards
• 7+ years of experience in payment security architecture, cryptography engineering, or acting as a specialized technical lead navigating complex payment compliance frameworks.
• Proven track record of successfully taking at least 2 distinct software products through formal PCI-MPOC, CPoC, SPoC, or EMVCo certification cycles.
• Expert-level knowledge of Hardware Security Modules (HSMs), Key Management Blocks (DUKPT, TR-31), tokenization schemas, secure attestation infrastructure, and code obfuscation tooling.
• Direct experience coordinating formal security evaluations and penetration testing responses with accredited third-party laboratories (e.g., FIME, Brightsight).
• Strong architectural understanding of real-time fraud mitigation tools, risk scoring engines, and automated AML velocity checks.

Project details

• Start: ASAP
• Remote: remote
• Location: Remote, PL
• Languages: English