We Shipped a Payment Page Nobody Had Inventoried: the 7 Screens I Run Before Hiring in Dubai

The worst conversation I have had with a Dubai client started with a simple question from their acquirer: can you send us the inventory of scripts running on your checkout page? Nobody could. There were nine of them. Two had been added by a marketing contractor who had left eight months earlier, one was loading from a domain that no longer resolved, and the engineer who had built the page had moved to Riyadh. The business was not breached. It was simply unable to answer, and being unable to answer is itself the finding. They had hired a very good backend developer. They had not hired anyone whose job it was to know that list existed.

This guide is the screening process I built afterwards. It is seven screens, it takes about three weeks of calendar time, and it is designed to tell you quickly whether a candidate has actually carried a payment stack through an assessment or has only read the standard.

Before you start: the role you need depends on a decision you have not made

Almost every underpaid and misdirected payment hire I have seen in this market traces back to the same sequence: the business posts a requisition for a “senior backend engineer, payments experience preferred”, then discovers during onboarding what its compliance obligations actually are, then needs someone two bands more senior than the person it hired.

So the preliminary step, before any screening, is to write down two things. First, every system that stores, processes or transmits cardholder data. Second, every system connected to those. That second list is the one that ruins architectures, because it tends to include the logging pipeline, the analytics warehouse, the customer support tool and the backup host that nobody has thought about since it was provisioned.

The current standard is PCI DSS v4, maintained by the PCI Security Standards Council and available from the PCI SSC document library. The version-4 requirements that most often change a hiring decision are the ones covering scripts on payment pages: authorising each script, assuring its integrity, keeping a written inventory with a justification for each, and detecting and alerting on unauthorised changes to the page. Those obligations apply even when the card field itself belongs to your provider, which is the detail most Dubai merchants get wrong.

Screen 1: Scope the environment before you write the advert

This screen is applied to you, not the candidate. Sit with whoever owns the checkout and produce the two lists above. Then classify yourself into one of the three rows in the diagram.

The output is a one-page scope note, and it changes the advert in three concrete ways. It fixes the seniority band, because row one and row three are two bands apart. It gives you a specific first project to describe, which is the single biggest factor in whether a good candidate replies to your message. And it tells you whether you are hiring to maintain compliance or to reduce scope, which are different engineers with different temperaments.

Time: half a day. Output: a scope note and a seniority band. If you cannot produce this, the candidate cannot assess your role either, and the strong ones will decline.

Screen 2: Ask about the script inventory, not the framework

This is the highest-signal question in the process. Phrase it operationally:

“Marketing wants to add a conversion pixel to the checkout page on Thursday. Walk me through what happens between their request and the pixel going live.”

An engineer who has maintained a payment page describes a path: a request that goes somewhere specific, a review of what the script does and where it loads from, a justification recorded against it, a controlled deployment rather than a tag manager that anyone with access can edit, and an alert that fires if the page changes outside that path. They will probably also tell you that marketing finds this annoying, which is how you know it is real.

An engineer who has not will answer with a technology. Content security policy, subresource integrity, maybe a tag manager permission model. Those are all components of a correct answer, but on their own they describe a control without an operating process, and a control without a process is what produced my client’s nine-script page.

Follow up with: “who notices if that pixel changes next month?” The quality of a candidate can be read almost entirely from whether they have an answer to that question or have to invent one.

Screen 3: Test segmentation reasoning rather than certificate recall

Draw four boxes: a web tier, an order service, a logging pipeline and a data warehouse. Add the arrows. Ask which components are in scope and why.

The answer you are grading is the reasoning, not the list. Candidates who trace connectivity will catch the logging pipeline, because they know that a well-drawn boundary leaks through observability first: a debug log of a request body, an error tracker capturing a form payload, an analytics event with a truncated card number that is not truncated enough.

Candidates who recite control numbers will produce a confident, correct-sounding inventory of requirements and miss the logs entirely. I have run this exercise with roughly forty candidates in this market. Catching the logging pipeline unprompted correlates with real assessment experience more reliably than anything else on a CV.

Screen 4: Probe tokenisation and whether they can shrink your problem

The cheapest compliance posture is holding less data, and the engineer worth paying for is the one who reduces your scope rather than defends it. Give them a migration:

“We store card-on-file for 40,000 recurring subscribers in our own database. Move us to provider tokens without breaking a single renewal.”

Strong answers have a shape. They establish what the provider can accept and whether a bulk import is possible. They dual-write new tokens while old values still exist. They order the backfill around billing dates so no subscriber renews mid-migration. They reconcile counts against the provider before deleting anything, and they treat deletion of the old values as a separate, dated, verified step rather than a cleanup task. Several will ask whether you have a legal retention requirement that conflicts, which is a good sign.

Weak answers describe tokenisation as a feature you switch on. That is a candidate who has integrated a payment provider but has never moved an existing book of business, and migrating 40,000 live mandates is not a task you want someone learning on.

Screen 5: Check they can work with an assessor

Compliance programmes do not usually fail on engineering. They fail on evidence: a screenshot that does not show a timestamp, a policy that describes a process nobody follows, a configuration export taken from the wrong host.

So ask: “tell me about a time you disagreed with an assessor or an auditor, and how it ended.”

What you want to hear is someone who argued a position in writing, produced supporting artefacts, and either won on the evidence or accepted the finding and remediated. What you do not want is either extreme: the engineer who treats every finding as an insult to their architecture, or the one who has never pushed back and will let a misapplied requirement cost you a quarter of product work.

A useful second question: “what was the first artefact your assessor asked for?” People who have done this answer instantly and specifically. People who have not describe the standard’s structure.

Screen 6: Add the regional context the stack runs in

A Dubai payment stack is rarely just a card form. There is usually a local acquirer, a regional gateway, multi-currency pricing, settlement that does not land when a European textbook says it should, and often a client with a data residency expectation. None of that is in the standard, and all of it is in the job.

Ask which providers they have integrated in this region and what surprised them. Candidates with genuine UAE experience go straight to operational detail: a settlement file format, a reconciliation mismatch that took a week to trace, a refund flow that behaves differently for a local card than an international one, the weekend that is not the weekend their provider’s support team works. Candidates without it describe the generic card flow accurately and tell you nothing.

This screen is also where you find out whether they can work with your existing team. Our guides on hiring fintech developers in DIFC and the UAE payment regulation landscape cover the surrounding context, and building a payment gateway in the UAE is useful if you are deciding how much of this to own at all.

Screen 7: Run the evidence drill before you make an offer

Forty-five minutes, with the finalist, on a real page of yours or a realistic facsimile. Three tasks:

1. Produce the inventory of scripts on this payment page, with a justification column.
2. Name the control that would tell us if one of them changed tomorrow, and say where the alert goes.
3. List the three artefacts an assessor would ask for first, and who in our organisation would have to produce each.

An engineer who has been through an assessment hands back something usable inside the hour: an imperfect list with open questions marked, a specific detection approach, and three named artefacts with owners. An engineer who has only read the standard hands back a plan to produce those things, which is a different and much more expensive hire.

The third task is the one people underrate. It tests whether the candidate understands that compliance is organisational. An engineer who says “I would need to ask who owns access reviews” has worked somewhere real.

What it costs, and why the top of the band is the cheap option

The reason to pay at the top of the relevant band is not fear of a fine. It is that the expensive outcomes are operational: an acquirer that puts you on a remediation plan, a quarter of product work replaced by compliance work, a forensic engagement if data was actually exposed, and the enterprise deal you cannot close because you failed a security questionnaire. Against those, the difference between the first and second row in that table is a rounding error.

One more piece of advice on sourcing. Nobody in this pool is reading job boards. The engineers who have taken a UAE business through an assessment are concentrated in banking, payment service providers and the larger e-commerce groups, and they move through direct approaches. Budget six to ten weeks and expect to source rather than advertise. If you are building out the wider function, hiring cybersecurity engineers in Dubai and running a security audit before you hire a dev team cover the adjacent decisions.

Frequently asked questions

What does a PCI DSS payment engineer cost in Dubai in 2026?

In Q4 2026 a mid-level engineer who can maintain an already-compliant payment stack in Dubai sits at roughly AED 28,000 to 38,000 per month. An engineer who can lead a scope reduction, own the evidence pack and take a business through an assessment commands AED 40,000 to 58,000 per month, and the upper end goes to people who have done it for a regulated financial institution rather than an e-commerce merchant. Add 15 to 20 percent for benefits and visa costs. For comparison, the cost of a failed assessment is rarely the fine: it is the acquirer relationship, the remediation sprint that stops product work for a quarter, and the forensic engagement if card data was actually exposed. That asymmetry is why this is one of the few roles where paying at the top of the band is usually the cheaper decision.

Do I need a PCI DSS specialist if my payments go through a hosted page?

You need less than you think, but more than nothing. Redirecting to a hosted payment page or using an inline frame served by your provider keeps most of the cardholder data environment out of your systems, which is exactly why that architecture is worth choosing. What remains your problem is the page that hosts the redirect or frame: the scripts loaded on it, who can change them, and whether you would notice an unauthorised change. PCI DSS v4 is explicit about script authorisation, integrity and inventory on payment pages, and that obligation does not disappear because the card field belongs to someone else. Practically, a business in that position usually needs a senior engineer part-time or a strong generalist with a documented tag governance process, not a dedicated full-time payment security hire.

Should I hire for PCI DSS certifications or for experience?

Hire for experience and treat certifications as a tiebreaker. The qualifications that genuinely signal something are the assessor-side ones, because they require ongoing practice, but an engineer who holds them is usually working for an assessment firm rather than looking for an in-house role. Among in-house candidates, the strongest predictor I have found is whether they have personally produced evidence for an assessment that passed. Ask what artefact they were responsible for and what the assessor sent back. Someone who has lived through it answers in specifics within thirty seconds. A certification holder who has not will answer with the structure of the standard, which tells you they can read but not that they can deliver.

How long does it take to hire a payment security engineer in Dubai?

Plan for six to ten weeks from approved requisition to signed offer, which is longer than a general backend hire in this market and for a simple reason: the pool is small and most of it is employed. The engineers who have taken a UAE business through an assessment number in the low hundreds, they are concentrated in banking, payment service providers and the larger e-commerce groups, and they are rarely on job boards. Expect sourcing rather than advertising to produce the shortlist, expect to pay a premium or offer scope that an employer with a bigger brand cannot, and expect at least two of your first five conversations to be with people who maintain compliance rather than people who have built it. The 45-minute evidence drill described above is the fastest way to tell those two groups apart.

Reference

• PCI Security Standards Council document library, for the current text of PCI DSS v4 and the self-assessment questionnaires referenced above.

William

Talent Sourcing Expert at HireDeveloper.ae. Sources payment, security and fintech engineers for employers in Dubai and Abu Dhabi, and builds the screening exercises that separate candidates who have delivered compliance work from candidates who can describe it.