PCI DSS contract jobs: rates and IR35
UK PCI DSS contract jobs are how clients buy this skill without opening a permanent seat. The work is cardholder-data obligations and the gaps a merchant or a platform has to close. This page is the market around that skill: who hires, what the day rate looks like, how IR35 tends to fall, and the live contracts on IR35 Jobs.
Updated 1 November 20264 min read
What a PCI DSS contract is
UK PCI DSS contract jobs are how clients buy this skill without opening a permanent seat. Clients hire for cardholder-data obligations and the gaps a merchant or a platform has to close. The contract is usually three to six months with an extension if the work continues, and the advert should say whether it is outside IR35, inside IR35, or silent. Silent is common, and it is not the same thing as outside.
The title in the advert is often looser than the skill. A role tagged PCI DSS on this board matched the skill in the title or the spec, which is a better filter than a job board's own category. Open the PCI DSS board for the current list rather than a recycled write-up.
Who is hiring
Regulated firms, government, and any board that has just had a finding it cannot leave until next year are the clients behind most PCI DSS adverts. Agencies still post the majority of contract roles in the UK, so the name on the row is often the recruiter, not the end client. The skill and the IR35 line tell you more than the agency brand.
Demand moves with programmes, not with the calendar. A quiet week on PCI DSS is not a dead market. New contracts are added every hour, and the ones from the last 48 hours are visible to members first because that is when they get filled.
PCI DSS day rates
Advertised PCI DSS day rates commonly sit between £500 and £900. That is the headline number, before tax, umbrella margin or the costs of a limited company. Work clusters in London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh. The rate on a specific advert is on the board when the recruiter published one. Where they wrote "competitive" instead, the role is harder to compare and usually not in a hurry to tell you.
A higher inside IR35 rate can be worth less than a lower outside one. Run both numbers before you negotiate, and read the PCI DSS day rate guide for how to compare them. Benchmarks across skills are on UK contractor day rates.
IR35 on these contracts
PCI DSS contracts are genuinely mixed. Product companies and smaller clients more often advertise outside IR35. Large programmes, and anything with a body-shop agency in the chain, more often advertise inside. Treat "outside" as a claim to check, not as a promise, and price an inside offer against take-home rather than against the headline.
PCI DSS outside IR35 jobs collects the point in one place. The live filter is outside IR35 jobs across every skill, and inside IR35 jobs for the other column. We report the status the advert states. We do not decide it, and neither does a keyword.
Where the work is
PCI DSS contracts turn up most often in London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh. A city on the advert is not always a daily commute. Hybrid is the default pitch, and a role marked remote should say so rather than implying it.
Use the board's location and radius filters once you are a member. Free browsing shows the delayed board. The link through to the original advert, on every PCI DSS job, is part of membership and the 14-day pass.
Live roles on the board
These PCI DSS contracts are on the board now. The day rate and IR35 status are public. The link to the original advert is for members.
- AI-Native Cyber Security Manager — Manchester, Greater Manchester, £300-£400/day
See live PCI DSS contracts · Membership unlocks apply links and the first 48 hours