Security & Compliance Engineer - PCI / AI Governance

About TESO Group

Founded in 2017 in New York, TESO Group is an Asian-inspired lifestyle retail company bringing premium Asian products and culture to the U.S. market. With brands including TESO LIFE, TESO X, and TESO Mini, we offer a curated mix of beauty, snacks, home goods, and trendy collectibles—delivering quality, value, and a unique shopping experience.

Position Overview

This engineer guards both the company's defenses and its compliance cadence. They build and operate the security toolchain while managing the PCI calendar, access reviews, and evidence. As AI tools become part of everyday work, this role also secures the company's AI adoption and uses AI to make security operations faster and more consistent.

This role does not set company-level security or AI strategy, which is owned by the Digital Information Manager. Instead, it lands controls onto systems, endpoints, and AI tools, and keeps compliance continuously attained.

Job Responsibilities

1.Security Toolchain

1. 1. Build and operate EDR, email security, identity security, and logging; land MFA and 802.1X.
   2. Run vulnerability scans and remediation; manage store and cloud baselines.
   3. Use AI-enabled capabilities in the toolchain, such as alert triage, anomaly detection, phishing/BEC detection, and natural-language log queries, to reduce noise and speed up response.

2. AI Security & Governance

1. 1. Implement controls for approved AI tools (e.g., enterprise AI workspaces): SSO/MFA, role-based access, data retention settings, and integration with DLP/SIEM through compliance and audit APIs.
   2. Detect and manage unapproved "shadow AI" use. Prevent sensitive data, including cardholder, customer, and financial data, from being shared with unapproved AI services.
   3. Review the security of new AI tools, connectors, and integrations before rollout. This covers data handling, permissions scope, vendor security documentation, and risks such as prompt injection and over-permissioned access to email and file stores.
   4. Help operationalize the company's AI acceptable-use policy and deliver employee awareness on AI-related threats, such as AI-generated phishing and deepfake voice/video impersonation.

3.PCI Compliance

1. 1. Run quarterly scans and the annual assessment, prepare the SAQ/ROC, and drive remediation to closure.
   2. Maintain the evidence repository and support the QSA and external audits.
   3. Ensure AI tools and workflows are kept out of PCI scope, or properly controlled where they touch in-scope systems. Use automation and AI assistance to streamline evidence collection and control mapping.

4.Access reviews

1. 1. Review business-system, cloud, and MSP access periodically.
   2. Manage third-party access onboarding, approval, and revocation, including warehouse-vendor remote access.
   3. Include AI tool access, AI service accounts, API keys, and AI integration permissions in periodic access reviews.

5.Incidents & reviews

1. 1. Investigate, contain, and review security incidents, including incidents involving AI tools or AI-enabled attacks.
   2. Provide security review for infrastructure and system changes, including new AI features and integrations.

Qualifications

• Education: Bachelor’s degree or above; cybersecurity or computer science preferred.
• Experience: 4+ years in security engineering or operations; PCI or GRC experience preferred. Hands-on experience securing or governing enterprise AI tools is a plus.
• Knowledge & Skills: EDR, SIEM, and vulnerability tooling; PCI-DSS controls and IAM concepts; Python scripting.
• AI Knowledge: Working knowledge of AI/LLM security risks, such as data leakage, prompt injection, and excessive permissions; familiarity with frameworks like the NIST AI RMF or OWASP Top 10 for LLM Applications is a plus. Comfortable using AI assistants to accelerate scripting, investigation, and documentation, while validating AI output before acting on it.
• Competencies: Fast responder with strong evidence discipline; principled; switches fluently between technical and compliance work. Curious and pragmatic about new technology, enabling safe AI adoption rather than simply blocking it.

Compensation

• $100,000 – $150,000 per year
• Quarterly Performance Bonus: This position is eligible for a quarterly performance-based bonus, subject to the eligibility requirements, performance criteria, and terms of the Company's bonus program.

Benefits

• 401(k) & 401(k) matching - subject to the eligibility requirements
• Paid Sick Leave
• Employee discount
• Health insurance
• Paid Time Off

Job Type: Full-Time (On-Site)

Language Requirement: Proficiency in Mandarin is a plus