Governance, Risk & Compliance (GRC) Infosec Manager (PCI)

About the role

Travis Perkins plc is seeking a proactive Governance, Risk & Compliance (GRC) Infosec Manager (PCI) to lead its Group‑wide PCI DSS compliance programme. Reporting to the Senior GRC Infosec Manager, you will be the primary point of contact for external Qualified Security Assessors and support broader cyber risk, third‑party assurance and data privacy governance.

Key responsibilities

• Manage the end‑to‑end PCI DSS lifecycle across the Group, including scoping, gap analysis, evidence collection, annual certification and QSA relationships.
• Conduct security risk assessments for partners, suppliers and third parties throughout the contract lifecycle.
• Support alignment with frameworks such as NIST CSF 2.0, Cyber Essentials Plus, UK GDPR/Data Protection Act 2018 and industry regulations.
• Assist with group IT risk assessments, track remediation actions and maintain central risk registers.
• Provide pragmatic security advice to project and business teams, embedding governance into change initiatives.

Required profile

• Higher education qualification (HND/Degree) in Cybersecurity, Information Security or equivalent practical GRC experience.
• Hands‑on experience in GRC, risk management, third‑party assurance or information security environments.
• Strong practical understanding of PCI DSS requirements and related compliance frameworks.
• Excellent verbal and written communication skills with the ability to influence cross‑functional stakeholders.

Required skills

• PCI DSS compliance
• NIST CSF 2.0
• Cyber Essentials Plus
• UK GDPR / Data Protection Act 2018
• ISO 27001, SOC 2 Type II
• Cloud platforms (AWS, Azure, GCP) and API gateway security

What we offer

• Competitive salary plus performance‑related bonus
• Save‑as‑you‑earn & Buy‑as‑you‑earn schemes
• Contributory pension scheme
• Life insurance, private medical insurance
• Colleague discount across Group businesses, including 20% off at Toolstation