Description

A focused course, tailored for you

The Security Analyst's PCI and Merchant Risk Triage Playbook

Move a flagged merchant, a third-party SaaS review, and a PCI scope question through the queue without bouncing them to the lead.

The detection queue, a chargeback-flagged merchant, a SaaS review request, and a PCI scope question are all open before the morning standup. The analyst who can close each on their own, in writing, with notes that hold up later, becomes the one the team relies on.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

A Security Analyst at a payments-heavy e-commerce platform does not have a single job. The role is a queue. Detection alerts from the SIEM. Merchant accounts flagged for chargeback velocity or suspicious login patterns. Third-party SaaS reviews that product managers want answered today. PCI scope questions that arrive in a Slack thread and never get a clean answer. Privileged-access exception requests from engineering. Data subject requests routed in from legal. None of these alone are hard. The hard part is moving each one to a defensible close without escalating to the senior analyst every time, and writing the close in a way that the auditor, the legal team, or the next analyst can read six months later and trust. Most analyst notes are too short for that. The result is rework, escalations, and the slow feeling that the queue is winning. This course teaches the artefact for each queue type. The triage note. The merchant-risk decision. The SaaS risk review. The PCI scope question response. The privileged-access exception. The data subject request. Each is a written template with a worked example. The implementation playbook is tuned to the specific queue mix at the analyst's employer.

What you walk away with

Close a detection-queue alert with a written triage note the next reader can rely on.
Make a merchant chargeback-velocity or account-takeover decision with a defensible written record.
Run a third-party SaaS risk review and return a yes, no, or yes-with-conditions answer in one document.
Answer a PCI scope question in writing without expanding scope by accident.
Process a privileged-access exception or a data subject request without bouncing it to the lead.

The 12 modules

Module 1. The triage note that holds up six months later

The written artefact that closes a detection-queue alert. What the note must contain so the next analyst, the senior analyst, and the auditor can each read it and trust it. Includes the template for benign, false-positive, and confirmed-incident closes, the worked example for an off-hours admin login alert, and the rule for when the note must escalate to an incident ticket instead of a close.

Module 2. Merchant chargeback velocity and the fraud decision record

The merchant-risk decision when a seller account trips chargeback or refund-velocity thresholds. The written record that justifies pause, hold, or release. How to separate genuine seasonality from a compromised account and how to write the decision so a merchant escalation does not catch the analyst flat-footed. Includes the template and a worked example for a flagged dropshipper.

Module 3. Account takeover signals and the customer-side close

The customer-account-takeover decision the analyst owns. Reading the login, device, and password-reset signals in the same record. The customer-facing comms the analyst either writes or hands to support, and the internal note that justifies the lock, MFA-reset, or release decision. Worked example for a credential-stuffing burst against a customer cohort.

Module 4. Third-party SaaS risk review in one document

The SaaS review the product manager wants answered today. How to scope the review to data sensitivity and access scope, how to read a SOC 2 report without re-reading the boilerplate, how to ask the vendor the four questions that actually matter, and how to write the yes, no, or yes-with-conditions answer in a document the procurement team and legal can both rely on. Template plus worked example.

Module 5. PCI scope questions answered in writing without expanding scope

The PCI DSS scope question that arrives in a Slack thread. How to answer in writing without creating a new in-scope system by accident. The connected-system, segmentation, and CDE-adjacent decisions the analyst is allowed to make versus the ones that must go to the QSA or the security lead. Worked example for a new payments-adjacent service the product team wants to launch.

Module 6. Privileged-access exception requests and the audit trail

The engineering ask for temporary privileged access. The written exception that grants it, the time-box, the compensating controls, and the close-out note when the exception expires. How to say no in writing without burning the engineering relationship, and how to say yes in a way that does not become permanent. Template and worked example for a production database access request.

Module 7. Data subject requests routed from legal

The data subject access, deletion, or portability request that lands in the queue from legal. The artefacts the analyst is responsible for gathering, the systems-of-record map for the request, and the response document that goes back to legal. How to handle the edge cases (deceased user, account merge, partial data, third-party processor data) without escalating each one. Worked example for a deletion request that touches three systems.

Module 8. The detection-tuning ticket the analyst writes for the engineer

The note an analyst writes when a detection is firing too often, too rarely, or wrong. What the detection engineer needs in the ticket to make the change in code. How to phrase a tuning request so it does not get pushed back as 'analyst opinion.' Worked example for a noisy data-exfiltration rule on a marketing tool.

Module 9. Incident handoff from analyst to incident response

The moment the alert becomes an incident. The handoff note that gives the incident response lead what they need in the first five minutes. The decision rule for when the analyst escalates versus continues to triage. The artefact the analyst keeps for the post-incident review. Worked example for a confirmed compromised internal account.

Module 10. Working with the QSA, the auditor, and external counsel without escalating each ask

The written responses to QSA, internal audit, or external counsel questions that the analyst can sign off on directly. How to answer a sampling request, an evidence request, or a control-walkthrough question in writing without creating new commitments. The template for the response file and a worked example for a PCI sampling request.

Module 11. Weekly queue review, metrics, and what to surface to the lead

The weekly look at the queue the analyst owns. The three numbers the lead actually wants (median time to close, escalation rate, repeat-offender accounts). The two qualitative items that should always make it into the weekly note. How to surface a systemic problem to the lead in writing so it gets prioritised. Template and worked example.

Module 12. The role-progression artefact the senior analyst and the manager actually read

The written record an analyst keeps that supports the move to senior analyst, security engineer, or risk manager. Which decisions to capture, which incidents to write up, which artefacts to keep in a private folder, and how to present them in the year-end conversation. The artefact list and a worked example. Not career-defence, just the written record of the skill the analyst is already building.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Morning queue has a SIEM alert, a flagged merchant, a SaaS review, and a Slack PCI question open at the same time.

Senior analyst is in a meeting and the queue cannot wait for an escalation on every item.

An auditor or QSA is going to read the close notes for last quarter's queue next month.

The analyst wants the role-progression conversation to be supported by written artefacts, not opinions.

What you get with this course

Twelve written modules with the template the analyst writes from and a worked example per module.
Downloadable templates for the triage note, merchant-risk decision, SaaS risk review, PCI scope response, privileged-access exception, data subject request, detection-tuning ticket, and incident handoff.
The hand-built implementation playbook tuned to the specific queue mix at the analyst's employer.
Access to the Art of Service learning environment with the course materials available for revisit.
Thirty-day money-back if the materials do not match the role described above.

What you will have in hand by Day 1, Week 1, Month 1

Within one day: learning environment account provisioned, course materials available, hand-built implementation playbook delivered alongside course access.

Week one to two: work through the alert triage note, the merchant-risk decision, the SaaS review, and the PCI scope response modules in order; apply each to a live queue item.

Week three to four: work through the privileged-access, data subject request, detection-tuning, and incident-handoff modules; apply to live queue items.

Week five onward: the queue review, QSA and audit response, and role-progression modules become part of the regular weekly rhythm.

Before and after

Before

The analyst closes alerts in two-line notes that the next reader cannot rely on, escalates merchant decisions to the lead, and answers PCI scope questions in Slack threads that disappear into history. Rework, escalation, and a slow feeling that the queue is winning.

After

Each queue item closes with a written artefact the next reader, the senior analyst, and the auditor can each rely on. The merchant, SaaS, and PCI decisions are made and recorded by the analyst on their own. The role-progression conversation has a folder of written artefacts behind it.

What happens if you do not address this

The analyst stays in the role for another year writing two-line notes, escalating routine merchant and SaaS decisions, and leaving PCI scope questions to die in Slack. The auditor opens last quarter's queue and the close notes do not hold up. The role-progression conversation has nothing on paper to point at.

Who it is for

Security Analyst (Tier 2 or senior Tier 1) at a large e-commerce, payments, or fintech platform. Owns or contributes to detection triage, merchant or customer risk decisions, third-party SaaS reviews, PCI scope questions, and privileged-access reviews. Reports to a Security Lead or Manager. Is the one who actually writes the notes that legal and the auditor read later.

Who this is NOT for. Not for incident response leads running major-incident bridges, not for security engineers building detections in code, not for a CISO writing strategy. This is for the analyst whose name is on the triage note and the risk decision.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Around two to three hours per module. Twelve modules total. Designed to be worked through alongside the live queue rather than as a separate study block.

Why $199 is the right number

Free blog posts on SIEM triage and PCI scope exist and are useful for the first month of the role. SANS and ISC2 courses cover the broad analyst body of knowledge well but are not desk-level templates for the merchant-risk, SaaS-review, and queue-management work this course is built around. This course is the written desk-level artefact set, not a body-of-knowledge survey.

FAQ

Is this a tools course?

No. It is desk-level written artefacts. The templates apply across the common SIEM, SOAR, and case-management tools without naming a specific stack.

Is this a junior analyst course?

It is for the analyst who is already in the role and is moving from two-line closes to written artefacts that hold up later. A brand new analyst can use it but will benefit most after a month or two in the queue.

Does the playbook get tuned to the actual employer's queue?

Yes. The hand-built implementation playbook is built per buyer based on the queue mix described at enrolment.

What if the role moves into security engineering or risk management?

The role-progression module covers the written record the analyst keeps to support that move.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.