Ben Oguntala

Senior payment security executive with 20+ years of progressive leadership delivering 150+ PCI DSS, P2PE, PCI PIN, and enterprise payment compliance programmes across banking, fintech, travel technology, retail, and telecommunications. Expert in zero card data architecture design, cardholder data environment (CDE) scoping, tokenisation strategy, and AOC/ROC production with global QSA management. Specialised in TMC, GDS, and NDC platform compliance including Sabre, Amadeus, Galileo, and Travelport.

Board-level communicator with a proven record of reducing risk footprint while enabling business growth across multi-jurisdiction environments. Deep experience with ISO 27001, NIST CSF, SOC operations, GDPR, BCP/DR, and AI-driven compliance innovation.

Technical Design Authority – Payment & TMC Compliance at Payments and Co (2021-01 – Present)

Independent consultancy delivering PCI DSS 4.0 architecture and TMC/GDS compliance for global merchant and service provider clients

• Architected and delivered a global TMC technology solution integrating Sabre, Amadeus, Galileo, and Travelport GDS platforms with PCI DSS 4.0 compliant payment controls, replacing legacy incumbents across 6+ international markets and standardising licensing governance globally.
• Designed end-to-end zero card data architecture eliminating cardholder data from all payment touchpoints across cardholder-present, card-not-present, and recurring/tokenised channels, achieving full CDE scope reduction and enabling streamlined ROC/AOC sign-off.
• Developed a proprietary PCI DSS 4.0 non-compliance identification framework for Level 1 merchant clients, delivering proactive gap assessment and targeted remediation planning that measurably reduced risk exposure prior to QSA audit engagement.
• Designed third-party compliance technical architecture including CDE delineation, clear separation of card systems, and governance structures for payment integrations with acquirers, processors, and BaaS providers.
• Led BCP, DR, and backup policy implementation meeting PCI DSS v4.0 continuity requirements across multi-region operations, embedding AI-driven threat monitoring and anomaly detection as risk-reduction layer.
• Engaged board-level merchant and service provider stakeholders to translate complex PCI DSS 4.0 requirements into executable compliance programmes aligned to business roadmaps and regulatory deadlines.

P2PE & PCI PIN Project Manager at Ingenico Group (2019-03 – 2020-03)

World's largest payment terminal manufacturer – global P2PE certification programme across UK, France, Italy, Spain, Malaysia, and Vietnam

• Directed global P2PE solution compliance programme covering Certificate Authority management, P2PE solution certification, and Key Injection Facility (KIF) compliance across 6 countries simultaneously, managing all QSA relationships and producing PIM and AOC documentation.
• Delivered P2PE-certified terminals integrated directly into TMC GDS environments, enabling compliant card-present transactions for travel industry clients and positioning Ingenico's TMC vertical as a compliance leader.
• Implemented Axis on Guard global security solution and Veritas backup and recovery platform, enhancing operational resilience and audit readiness across the international estate.
• Led P2PE and PCI PIN compliance engagements with acquirers, commercial banks, retailers, and manufacturing partners, coordinating international audits across 5 countries with zero compliance deficiencies.

PCI Technical Design Authority at BaxterStorey Ltd (2017-11 – 2019-03)

Pan-European Level 1 payment merchant serving 1,000+ catering locations – full PCI DSS compliance architecture ownership

• Designed and executed pan-European PCI DSS compliance strategy for a Level 1 merchant, mapping 1,000+ PED assets (Ingenico Telium/Tetra) and EPOS systems into a maintained compliance asset register across all UK and European locations.
• Executed decommissioning of out-of-scope IT systems and migrated online payment channels to tokenisation and redirection models, materially reducing CDE scope and cutting annual compliance costs.
• Managed Security Operations Centre (SOC), ISO 27001, GDPR, and PCI DSS reporting to board-level audit committees, providing executive-ready compliance dashboards and risk metrics.
• Mobilised multi-supplier ICT rollout across new catering sites, managing end-to-end delivery of PEDs, EPOS, network infrastructure, and P2PE chain-of-custody processes.

PCI DSS Compliance Manager at London Borough of Newham (2018-01 – 2018-12)

Government agency cross-departmental payment compliance programme

• Designed a cross-departmental secure payment service consolidating payment channels, embedding GDPR and ISO 27001 controls, and implementing SOC-based compliance monitoring with direct reporting to CIO, CISO, and Operational Directors on the Audit Committee.

PCI Technical Design Authority at Barclays Bank (2017-04 – 2017-11)

• Evaluated and prepared The Logic Group (Barclays acquisition) for PSD2 impact assessment and PCI DSS 3.2 compliance, including 3rd-party supplier evaluation, policy creation, and BCP/DR implementation.

PCI TDA / Subject Matter Expert at Vaquis Bank (2016-11 – 2017-02)

• Led supply chain security assurance programme, enforcing cybersecurity controls across vendors and embedding risk mitigation into application SDLC processes.

PCI Technical Manager at The Co-operative Bank Group (2015-11 – 2016-10)

• Managed team of security engineers and architects responsible for IAM, MFA, cloud security, container security, encryption, and certificate management across ForgeRock, AWS, CyberArk, and Vormetric platforms.

PCI Technical Design Authority at Carphone Warehouse (2015-06 – 2015-08)

3rd Party Compliance Manager at Thames Water (2013-04 – 2015-05)

Cyber Security Risk Mitigation Manager at Alcatel Lucent (2011-05 – 2012-11)

Principal Information Risk Security Manager at British Gas Insurance (Centrica) (2008-04 – 2010-12)

Fraud Risk & Security Manager at Vodafone UK (2007-06 – 2008-04)

Security Consultant (Aviva) at IBM (2007-02 – 2007-05)

Master of Laws in Banking & Finance Law – Queen Mary University of London (2009-09 – 2010-06)

LLB Law in Law – Birkbeck College, University of London (2004-09 – 2008-06)