Governance, Risk & Compliance (GRC) Infosec Manager (PCI)

Travis Perkins plc; Northampton; Hybrid; GBP 90,000 - 120,000; Full time

Benefits offered by this job

Bonus

Pension scheme

Private medical insurance

Life Insurance

Colleague discount (Group businesses)

Job summary

Travis Perkins plc is seeking a Governance, Risk, and Compliance Infosec Manager (PCI) to join our central Information Security team in the UK. The role leads PCI DSS programme delivery, QSA engagement and cross‑functional security governance.

Hybrid working pattern with one day per week at the Northampton Head Office; full-time Monday to Friday. You will partner with business teams, suppliers, and IT to ensure secure change across the Group.

Qualifications

• Relevant GRC/InfoSec experience focused on PCI DSS and third‑party risk.
• Experience engaging with QSA teams and external auditors.
• In-depth knowledge of PCI DSS, NIST CSF, ISO 27001 and privacy frameworks.

Responsibilities

• Lead end-to-end PCI DSS programme across the Group, including scoping, evidence collection, and annual certification.
• Manage QSA relationships and external assessments.
• Assess third‑party security controls and supply chain risk.
• Support IT risk assessments and maintain risk registers.
• Develop and maintain information security policies and onboarding training content.
• Partner with business teams to enable secure change initiatives.

Skills

GRC governance

PCI DSS

Third-party risk management

Cloud security

Stakeholder engagement

Communication

Education

Higher education in Cybersecurity/InfoSec

Job description

Travis Perkins plc is now hiring for a proactive and detail-oriented Governance, Risk, and Compliance (GRC) Infosec Manager (PCI) to join our central Information Security team.

This is a high-visibility, specialised role focused on leading our Group-wide Payment Card Industry (PCI) compliance ecosystem. Reporting directly to the Senior GRC Infosec Manager, you will serve as the primary subject matter expert and point of contact for external Qualified Security Assessors (QSAs), while also contributing across wider cyber risk, third-party assurance, and data privacy governance.

If you are a driven GRC professional with a strong grounding in PCI DSS standards, third-party risk management and cloud security frameworks, we’d love to hear from you!

Working Pattern & Location

• Location:Hybrid working with one day working at our Head Office in Northampton

• Working Pattern:Full-time, Monday - Friday.

The Opportunity

As GRC Infosec Manager (PCI), you will take complete ownership of the Group’s PCI DSS compliance lifecycle, managing everything from scoping and gap analyses to annual certifications and QSA engagement.

Beyond payment compliance, you will act as a trusted advisor to key business stakeholders, embedding pragmatic security governance into business change initiatives and managing supply chain risk through robust third-party security assessments.

What You'll Be Doing

• PCI DSS Programme Leadership:Managing the end-to-end PCI DSS lifecycle across the Group, including scoping, gap analyses, evidence collection, annual certification and managing QSA relationships.

• Third-Party Security Assurance: Conducting thorough security risk assessments for partners, suppliers and third parties across the contract lifecycle.

• Framework Compliance: Supporting alignment with key frameworks including NIST CSF 2.0, Cyber Essentials Plus, UK GDPR / Data Protection Act 2018 and relevant industry regulations.

• IT Risk Management: Supporting group IT risk assessments, tracking remediation actions and maintaining central risk registers.

• Policy Governance & Best Practice:Contributing to the maintenance of Group Information Security policies, procedures and onboarding security training content.

• Business Partnering:Acting as a pragmatic security advisor to project and business teams, ensuring secure innovation without compromising cyber resilience.

Essential

• Higher education qualification (HND/Degree) in Cybersecurity, Information Security, or equivalent practical GRC experience.

• Hands-on experience working across GRC, risk management, third-party assurance, or information security environments.

• Strong practical understanding of PCI DSS requirements and compliance frameworks.

• Solid understanding of common security standards and laws (NIST 800-53, ISO 27001, SOC 2 Type II, Cyber Essentials Plus, UK DPA 2018).

• Exceptional verbal and written communication skills with the confidence to influence cross-functional stakeholders.

We'd Particularly Like to See

• Active professional certifications such as CISA, CRISC, CISM, CISSP, or PCI ISA (Internal Security Assessor).

• Prior experience operating within a FTSE 250 or large enterprise environment.

• Understanding of credit card data flows across cloud networks (AWS/Azure/GCP), API gateways and payment processing pipelines.

What's in it for you!

• Company/ Performance related bonus

• Save-as-you-earn & Buy-as-you-earn schemes

• Contributory pension scheme

• Life Insurance

• Private Medical Insurance

• Colleague discount across a variety of Group businesses including with special discounts across our Trade Merchants - 20% off at Toolstation

Ready to Lead Our PCI & Security Governance?

If you're an ambitious GRC manager looking for a high-impact role within a leading UK enterprise, submit your application today!