GRC Infosec Manager; PCI

This is a high-visibility, specialised role focused on leading our Group-wide Payment Card Industry (PCI) compliance ecosystem. Reporting directly to the Senior GRC Infosec Manager, you will serve as the primary subject matter expert and point of contact for external Qualified Security Assessors (QSAs), while also contributing across wider cyber risk, third-party assurance, and data privacy governance., As GRC Infosec Manager (PCI), you will take complete ownership of the Group's PCI DSS compliance lifecycle, managing everything from scoping and gap analyses to annual certifications and QSA engagement.

Beyond payment compliance, you will act as a trusted advisor to key business stakeholders, embedding pragmatic security governance into business change initiatives and managing supply chain risk through robust third-party security assessments.

• PCI DSS Programme Leadership:
  Managing the end-to-end PCI DSS lifecycle across the Group, including scoping, gap analyses, evidence collection, annual certification and managing QSA relationships.
• Third-Party Security Assurance:
  Conducting thorough security risk assessments for partners, suppliers and third parties across the contract lifecycle.
• Framework Compliance:
  Supporting alignment with key frameworks including NIST CSF 2.0, Cyber Essentials Plus, UK GDPR / Data Protection Act 2018 and relevant industry regulations.
• IT
  
  Risk Management:
  
  Supporting group IT risk assessments, tracking remediation actions and maintaining central risk registers.
• Policy Governance & Best Practice:
  Contributing to the maintenance of Group Information Security policies, procedures and onboarding security training content.
• Business Partnering:
  Acting as a pragmatic security advisor to project and business teams, ensuring secure innovation without compromising cyber resilience.

• If you are a driven GRC professional with a strong grounding in PCI DSS standards, third-party risk management and cloud security frameworks, we'd love to hear from you!,
• Higher education qualification (HND/Degree) in Cybersecurity, Information Security, or equivalent practical GRC experience.
• Hands-on experience working across GRC, risk management, third-party assurance, or information security environments.
• Strong practical understanding of PCI DSS requirements and compliance frameworks.
• Solid understanding of common security standards and laws (NIST 800-53, ISO 27001, SOC 2 Type II, Cyber Essentials Plus, UK DPA 2018).
• Exceptional verbal and written communication skills with the confidence to influence cross-functional stakeholders.

• Active professional certifications such as CISA, CRISC, CISM, CISSP, or PCI ISA (Internal Security Assessor).
• Prior experience operating within a FTSE 250 or large enterprise environment.
• Understanding of credit card data flows across cloud networks (AWS/Azure/GCP), API gateways and payment processing pipelines.

• Contributory pension scheme
• Life Insurance
• Private Medical Insurance
• Colleague discount across a variety of Group businesses including with special discounts across our Trade Merchants - 20% off at Toolstation