Governance, Risk and Compliance Manager

Virgin Atlantic; Crawley; Hybrid; GBP 65,000 - 90,000; Full time

Job summary

Virgin Atlantic is seeking a Governance, Risk & Compliance (GRC) Manager to lead information security governance, risk assessment and regulatory compliance. You will shape policies and controls, work with Information Security, Technology and Internal Audit, and guide risk-informed decisions across the business.

You'll build robust risk reporting, oversee third‑party security, support audits, and champion continuous improvement of GRC frameworks while aligning with aviation regulatory

Qualifications

• Proven experience in Information Security Governance, Risk & Compliance.
• Knowledge of PCI DSS, COBIT, privacy legislation and aviation cyber regulations.
• Experience assessing security controls and supporting audits.
• Excellent communication and stakeholder management skills.
• Professional certification such as CRISC, CISA or CISM is important.

Responsibilities

• Ensure information security governance, risk and compliance activities are effective and aligned.
• Identify, assess and monitor information security risks with stakeholders.
• Oversee compliance with key standards including PCI DSS and support audits.
• Assess third‑party security risks with technology and suppliers.
• Produce clear risk and compliance reporting for senior stakeholders.
• Champion continuous improvement across GRC processes and reporting.

Skills

Information Security Governance

Risk Management

Regulatory Compliance

Security Frameworks

Communication & Influence

Analytical Thinking

Stakeholder Management

Education

CRISC / CISA / CISM certification

Tools

PCI DSS

COBIT

CAP1753

Job description

Location: Hybrid - 3 days at VHQ, Crawley

Hours: Full Time, 37.5 hours per week. Monday to Friday

Contract Type: Permanent

Closing Date: 1st November 2026

We review applications on a rolling basis and may close the advert early if we receive a high volume of applications.

At Virgin Atlantic Airways, we believe that everyone can take on the world, and it's our vision to become the most loved travel company. As we embark on this next exciting stage of our journey, we’re harnessing our spirit of entrepreneurship and innovation to challenge the status quo.

In a nutshell

Keeping our customers', colleagues' and business information safe is essential to everything we do at Virgin Atlantic. As Governance, Risk & Compliance (GRC) Manager, you'll play a key role in making sure our information security risks are understood, managed and aligned with the standards that protect our business.

Working closely with Information Security, Technology, Internal Audit and wider business teams, you'll help shape and maintain the policies, controls and governance frameworks that keep us secure and compliant. From managing cyber risks and overseeing regulatory compliance to working with suppliers and supporting security assurance, you'll bring clarity to complex challenges and help colleagues make confident, risk-informed decisions.

This is a role where your expertise and influence will make a real difference. You'll work with stakeholders across the business, constructively challenge existing practices and champion improvements that strengthen our security culture while supporting the way Virgin Atlantic operates.

Day to day

• Ensuring Information Security governance, risk and compliance activities, ensuring policies, standards and controls are effective, up to date and aligned with business and regulatory requirements
• Identifying, assessing and monitoring information security risks, working with stakeholders to agree practical actions and ensure risks are appropriately managed
• Overseeing compliance with key security standards and regulations, including PCI DSS, and supporting audits, assurance reviews and the resolution of control gaps
• Working with Technology, business teams and external suppliers to assess third‑party security risks, strengthen due diligence and ensure appropriate safeguards are in place
• Producing clear risk and compliance reporting for senior stakeholders, highlighting emerging threats, control weaknesses and opportunities for improvement
• Championing continuous improvement across GRC processes, tools and reporting, helping embed a consistent and proactive approach to information security across the business

About you

An experienced and collaborative information security professional, you'll enjoy bringing clarity to complex risks, building trusted relationships and helping others understand why good governance matters. You'll combine technical knowledge with practical judgement, influencing decisions and finding solutions that protect the business while enabling it to move forward.

• Proven experience in Information Security Governance, Risk & Compliance, with a strong understanding of security frameworks, risk management and regulatory requirements
• Knowledge of PCI DSS, COBIT, privacy legislation and relevant information security standards, with awareness of aviation-specific cyber regulations such as CAP1753
• Experience assessing security controls, supporting audits and investigations, identifying risks and working with stakeholders to deliver effective remediation
• Excellent communication and influencing skills, with the confidence to explain complex security requirements clearly, challenge constructively and build relationships across technical and non-technical teams
• Strong analytical and problem‑solving skills, with a proactive approach to improving governance processes, managing competing priorities and supporting informed business decisions

A relevant professional certification such as CRISC, CISA or CISM, or an equivalent qualification, is important for this role. Experience within aviation, travel or another highly regulated environment would also be valuable.

If you're passionate about protecting information, strengthening security governance and helping Virgin Atlantic make confident, risk-informed decisions, we'd love to hear from you.

Accessibility and inclusion

We’re committed to making our recruitment process accessible. If you need reasonable adjustments or additional support, you can let us know in your application.

If you’d prefer to speak to someone directly before or during your application, interview or assessment, please contact our recruitment team at [e-mail].

We know every role and candidate is different, so we’ll discuss the adjustments available for the role and at each stage of recruitment, and how best to support you.

At Virgin Atlantic, we’re proud to be an equal opportunities employer and welcome applications from everyone. Whatever your background, identity, experience or perspective, we’d love to hear from you.