Governance, Risk & Compliance (GRC) Infosec Manager (PCI)

Overview

In this role you will own the Group’s PCI DSS compliance lifecycle, guiding scoping, gap analyses, evidence collection, and annual certification while managing QSA partnerships. You will also drive third-party security assurance, risk assessments, and governance across privacy and framework controls. You’ll act as a trusted security advisor to business teams, embedding governance into change initiatives and strengthening supply chain risk programs. This is a high-impact role at a FTSE 250 enterprise with a strong PCI focus and cross-functional collaboration.

Pay / Benefits

• Company/Performance related bonus
• Save-as-you-earn & Buy-as-you-earn schemes
• Contributory pension scheme
• Life Insurance
• Private Medical Insurance
• Colleague discount across Group businesses including Toolstation 20% off

Responsibilities

• Lead end-to-end PCI DSS lifecycle across the Group, including scoping, gap analyses, evidence collection, annual certification, and QSA management
• Conduct security risk assessments for partners, suppliers, and third parties throughout contract lifecycles
• Support alignment with frameworks such as NIST CSF 2.0, Cyber Essentials Plus, UK GDPR / Data Protection Act 2018
• Assist IT risk assessments and maintain central risk registers; track remediation actions
• Contribute to policy governance, procedures, and onboarding security training content
• Partner with project and business teams to enable secure innovation and cyber resilience

Key requirements

• Higher education qualification in Cybersecurity or Information Security, or equivalent GRC experience
• Hands-on GRC, risk management, third-party assurance, or information security experience
• Strong practical knowledge of PCI DSS and compliance frameworks
• Solid understanding of NIST 800-53, ISO 27001, SOC 2 Type II, Cyber Essentials Plus, UK DPA 2018
• Excellent verbal and written communication with ability to influence stakeholders

• Influencing cross-functional stakeholders
• Pragmatic security advisory
• Excellent communication skills
• PCI DSS requirements and governance
• NIST CSF 2.0, ISO 27001, SOC 2 Type II, Cyber Essentials Plus, UK DPA 2018
• Cloud security awareness (AWS/Azure/GCP) and API gateways

…