Governance and Risk and Compliance Analyst

Virgin Atlantic; Crawley; Híbrido; GBP 35.000 - 52.000; Jornada completa

Descripción de la vacante

Virgin Atlantic is seeking an Information Security GRC Analyst – Audit & Compliance to help protect our information and support governance, risk and compliance activities across the business. You’ll coordinate security audits, gather evidence, track improvements and work with security specialists, technology teams and external auditors.

A degree in information security or related field and 1–2 years’ experience are desirable.

Formación

• Degree in Information Security, Cyber Security or related field, or equivalent knowledge.
• 1–2 years’ experience in information security, risk, compliance, audit or assurance.
• Strong organizational skills and attention to detail.
• Analytical mindset with ability to explain findings clearly.
• Provisional knowledge of PCI DSS, ISO 27001 or NIST is helpful.

Responsabilidades

• Coordinate security audits and PCI DSS compliance activities with teams.
• Review evidence for accuracy and completeness; flag gaps.
• Maintain audit records, trackers and action logs.
• Support risk and control assessments; learn ISO 27001 and NIST.
• Prepare progress updates and evidence packs for stakeholders.
• Identify efficiency improvements for evidence gathering and reporting.

Conocimientos

Information Security

Risk assessment

Audit support

Attention to detail

Communication skills

Educación

Bachelor's degree in Information Security or related

Herramientas

GRC tools

PCI DSS

ISO 27001

Descripción del empleo

Location: Hybrid – 3 days at VHQ, Crawley
Hours: Full Time, 37.5 hours per week, Monday to Friday
Contract Type: Permanent
Salary: Competitive
Closing Date: 15th November 2026

In a nutshell

Ready to build your career in information security? At Virgin Atlantic, you’ll help protect the information our customers and colleagues trust us with, while gaining practical experience in cyber governance, risk and compliance.

As our Information Security GRC Analyst – Audit & Compliance, you’ll support security audits, gather evidence and track improvements that help keep our business secure. Working with Information Security specialists, Technology colleagues and external auditors, you’ll develop your understanding of how security standards, including PCI DSS, work in practice. You'll work under the guidance of a Principal Analyst, gathering and checking evidence and raising issues for decision.

This opportunity could suit someone with an Information Security, Cyber Security or related degree, or someone moving into security from a related field, with some relevant experience gained through a placement, work or study. You’ll bring curiosity, attention to detail and a willingness to learn, with opportunities to contribute from the outset. We'll support you to build your knowledge and work towards relevant professional qualifications.

Day to day

• Help coordinate security audits and PCI DSS compliance activities, along with other aviation and regulatory assessments such as CAA cyber oversight, SWIFT CSP and TSA requirements, bringing together information and evidence from teams across the business.
• Review evidence for accuracy and completeness, flagging gaps and asking questions where something needs clarification.
• Keep audit records, compliance trackers and action logs up to date, following up with colleagues on agreed improvements.
• Support security risk and control assessments, building your knowledge of frameworks such as ISO 27001 and NIST.
• Prepare clear progress updates and evidence packs, helping the team understand audit readiness and outstanding actions.
• Suggest ways to make evidence gathering, reporting and everyday compliance processes more efficient.

About you

You’re keen to turn your knowledge and experience into practical skills. You enjoy getting into the detail, solving problems and working with others, and you’re comfortable asking questions as you learn.

We’d love to hear from you if you bring:

• A degree in Information Security, Cyber Security or a related subject, or equivalent knowledge gained through work or other learning.
• One to two years’ relevant experience, which could include a placement or work in information security, risk, compliance, audit, assurance or operational support.
• Strong organisational skills and attention to detail, with the ability to keep accurate records and manage competing deadlines.
• An analytical approach, with the confidence to spot inconsistencies and explain your findings clearly.
• Good communication and digital skills, including using spreadsheets to organise information and track progress.
• You don’t need to be an expert in every framework or tool. Familiarity with PCI DSS, ISO 27001, NIST or GRC tools as would be helpful, but isn’t essential. A degree in Information Security, Cyber Security or a related subject would be an advantage, but equivalent knowledge or experience gained through work or other learning is equally welcome. We’re interested in your potential, your transferable skills and your enthusiasm for developing a career in information security.
• If you’re ready to take your next step and help protect Virgin Atlantic and the people who trust us, we’d love to hear from you.

Accessibility and inclusion

We’re committed to making our recruitment process accessible. Interviews include a short practical exercise reviewing a small set of evidence; no technical preparation is needed. If you need reasonable adjustments or additional support, you can let us know in your application.

If you’d prefer to speak to someone directly before or during your application, interview or assessment, please contact our recruitment team at [e-mail].

We know every role and candidate is different, so we’ll discuss the adjustments available for the role and at each stage of recruitment, and how best to support you.

At Virgin Atlantic, we’re proud to be an equal opportunities employer and welcome applications from everyone. Whatever your background, identity, experience or perspective, we’d love to hear from you.