QSA stands for Qualified Security Auditor. A QSA is someone who has undergone training in and around PCI standards and is qualified by the PCI SSC to advise organisations on how to achieve compliance and to perform Reports on Compliance (ROCs).