Manager, Cyber Security Operations

Virgin Atlantic is recruiting for the role of Manager, Cyber Security Operations. Lead cyber security operations by responding to complex incidents, improving detection and monitoring, and strengthening resilience across cloud platforms, networks, applications and identity services. The role also involves mentoring analysts, working with technology teams and translating technical findings into clear recommendations.

Role details

• Location: Crawley
• Working pattern: Hybrid
• Job type: Permanent
• Salary: Competitive
• Closing date: 08/09/2026

What you’ll do

• Lead the technical response to complex cyber security incidents from detection through to recovery.
• Act as Cyber Incident Lead during major incidents and provide technical direction and updates to senior stakeholders.
• Investigate threats across cloud environments, endpoints, networks, identity platforms and applications.
• Develop detection rules, SIEM content, investigation playbooks and response procedures.
• Improve monitoring capabilities across Microsoft Sentinel, Microsoft Defender and other security technologies.
• Conduct proactive threat hunting using threat intelligence, behavioural analytics and attacker techniques.
• Mentor Cyber Security Operations Analysts and help build technical capability across the team.
• Translate technical findings into clear, risk-based recommendations that support better business decisions.

What they’re looking for

• Significant experience in Cyber Security Operations, Incident Response or Security Engineering.
• Strong hands-on experience leading security investigations through identification, containment, eradication and recovery.
• Experience using SIEM, EDR/XDR, cloud security and email security platforms, including Microsoft Sentinel, Microsoft Defender, Azure or AWS.
• Strong understanding of attacker tactics, techniques and procedures, including MITRE ATT&CK.

Additional role information

• The role includes an on-call rota and out-of-hours incident response when required.
• The team works across cloud platforms, infrastructure, applications, networks and identity services.