Governance, Risk and Compliance Manager

Virgin holidays; Crawley; Hybrid; GBP 70,000 - 100,000; Full time

Job summary

Virgin Atlantic Airways is seeking a Manager – Governance, Risk & Compliance (GRC) to lead information security governance, risk management and regulatory compliance. The role works with Information Security, Technology and Internal Audit to shape policies, controls and governance frameworks, ensuring robust protection and compliance across the business.

The post requires strong stakeholder engagement, clarifying complex security requirements, and championing improvements while supporting secure

Qualifications

• Proven experience in Information Security Governance, Risk & Compliance.
• Strong understanding of security frameworks, risk management & regulatory requirements.
• Knowledge of PCI DSS, COBIT, privacy legislation and aviation cyber regulations.

Responsibilities

• Maintain security governance, risk & compliance activities.
• Identify, assess and monitor information security risks with stakeholders.
• Oversee audits, compliance with security standards and regulatory requirements.
• Collaborate with Technology and business teams to manage third-party security risks.
• Produce risk and compliance reporting for senior stakeholders.
• Drive continuous improvement of GRC processes and reporting.

Skills

Governance & compliance

Information security

Regulatory requirements

PCI DSS knowledge

CobIT

Security risk assessment

Stakeholder management

Communication

Job description

Location: Hybrid - 3 days at VHQ, Crawley

Hours: Full Time, 37.5 hours per week. Monday to Friday

Contract Type: Permanent

Salary: Competitive

Closing Date: 1st November 2026

We review applications on a rolling basis and may close the advert early if we receive a high volume of applications.

At Virgin Atlantic Airways, we believe that everyone can take on the world, and it's our vision to become the most loved travel company. As we embark on this next exciting stage of our journey, we’re harnessing our spirit of entrepreneurship and innovation to challenge the status quo.

In a nutshell

Keeping our customers', colleagues' and business information safe is essential to everything we do at Virgin Atlantic. As Manager – Governance, Risk & Compliance (GRC), you'll play a key role in making sure our information security risks are understood, managed and aligned with the standards that protect our business.

Working closely with Information Security, Technology, Internal Audit and wider business teams, you'll help shape and maintain the policies, controls and governance frameworks that keep us secure and compliant. From managing cyber risks and overseeing regulatory compliance to working with suppliers and supporting security assurance, you'll bring clarity to complex challenges and help colleagues make confident, risk-informed decisions.

This is a role where your expertise and influence will make a real difference. You'll work with stakeholders across the business, constructively challenge existing practices and champion improvements that strengthen our security culture while supporting the way Virgin Atlantic operates.

Day to day

• Ensuring Information Security governance, risk and compliance activities, ensuring policies, standards and controls are effective, up to date and aligned with business and regulatory requirements
• Identifying, assessing and monitoring information security risks, working with stakeholders to agree practical actions and ensure risks are appropriately managed
• Overseeing compliance with key security standards and regulations, including PCI DSS, and supporting audits, assurance reviews and the resolution of control gaps
• Working with Technology, business teams and external suppliers to assess third-party security risks, strengthen due diligence and ensure appropriate safeguards are in place
• Producing clear risk and compliance reporting for senior stakeholders, highlighting emerging threats, control weaknesses and opportunities for improvement
• Championing continuous improvement across GRC processes, tools and reporting, helping embed a consistent and proactive approach to information security across the business

About you

An experienced and collaborative information security professional, you'll enjoy bringing clarity to complex risks, building trusted relationships and helping others understand why good governance matters. You'll combine technical knowledge with practical judgement, influencing decisions and finding solutions that protect the business while enabling it to move forward.

• Proven experience in Information Security Governance, Risk & Compliance, with a strong understanding of security frameworks, risk management and regulatory requirements
• Knowledge of PCI DSS, COBIT, privacy legislation and relevant information security standards, with awareness of aviation-specific cyber regulations such as CAP1753
• Experience assessing security controls, supporting audits and investigations, identifying risks and working with stakeholders to deliver effective remediation
• Excellent communication and influencing skills, with the confidence to explain complex security requirements clearly, challenge constructively and build relationships across technical and non-technical teams
• Strong analytical and problem-solving skills, with a proactive approach to improving governance processes, managing competing priorities and supporting informed business decisions

A relevant professional certification such as CRISC, CISA or CISM, or an equivalent qualification, is important for this role. Experience within aviation, travel or another highly regulated environment would also be valuable.

If you're passionate about protecting information, strengthening security governance and helping Virgin Atlantic make confident, risk-informed decisions, we'd love to hear from you.

Accessibility and inclusion

We’re committed to making our recruitment process accessible. If you need reasonable adjustments or additional support, you can let us know in your application.

If you’d prefer to speak to someone directly before or during your application, interview or assessment, please contact our recruitment team at [e-mail].

We know every role and candidate is different, so we’ll discuss the adjustments available for the role and at each stage of recruitment, and how best to support you.

At Virgin Atlantic, we’re proud to be an equal opportunities employer and welcome applications from everyone. Whatever your background, identity, experience or perspective, we’d love to hear from you.