Group Policies Lead

About Us

We are part of International Airlines Group (IAG), one of the world’s leading airline groups and owner of some of the biggest brands in the sky.

IAG Transform provides creative and innovative solutions to drive sustainable transformation by delivering procurement and airline services, as well as group-wide systems across IAG. Each operating company benefits from the Transform centralised model, driving efficiencies, automation, and economies of scale.

 

 

Role Purpose

Role can be based in the UK or Spain.

Own and operate the Group-wide IT policy framework on behalf of the Group Tech Office, providing a single, authoritative set of technology policies—including AI, data, architecture, cloud, software and IT service management—that applies consistently across IAG and its operating companies.
Manage each Group IT policy through its full lifecycle, from identifying the need and drafting with subject matter experts through governance approval, communication, embedding, periodic review, exception management and retirement. Ensure policies are clear, practical and adopted in practice, enabling the Group’s technology and AI strategy while meeting legal, regulatory and audit requirements. Act as the key point of alignment with Cyber Security Governance so that technology and security policies form one coherent, non-overlapping framework.

 

 

Your responsibilities

Key Responsibilities

• Design, maintain and continually improve the Group IT policy framework, including document hierarchy, templates, taxonomy, ownership model and the authoritative policy library.
• Maintain the Group IT policy register, ensuring each policy has an accountable owner, defined scope and applicability, version history and scheduled review date.
• Lead the creation and refresh of IT policies by engaging relevant subject matter experts across architecture, data and AI, cloud and infrastructure, engineering, service management, Legal, Data Protection, Procurement and HR.
• Take policies through the appropriate governance forums, preparing papers, managing consultation, and tracking decisions and actions.
• Plan and deliver communications and embedding activity for new and changed policies, including launch communications, briefings, training content and intranet publication.
• Run the policy exception process, ensuring requests are assessed by the right experts, risk is accepted at the appropriate level, and exceptions are time-bound, recorded and reviewed.
• Monitor policy adoption and compliance, working with operating companies, Group Risk and Internal Audit to define measures and attestation and provide regular reporting on policy health, overdue reviews, exceptions and gaps.
• Partner with Cyber Security Governance to align frameworks, terminology and review cycles, avoid duplication or conflict, and coordinate joint changes where policies overlap.
• Horizon-scan for changes in regulation, industry standards and Group strategy, including the EU AI Act, data protection requirements and emerging technology risks.
• Support audits, regulatory requests and assurance activity by evidencing policy governance and leading remediation of policy-related findings.
• Champion concise, accessible and proportionate policies, rationalising legacy or duplicated policies across the Group and operating companies.
• Travel and work from multiple sites when required for meetings, workshops and related activities.

Key Relationships

• Internal: AI & Tech Business Strategy & Governance Director; Group Tech Office leadership; Cyber Security Governance & Risk and the Group CISO function; IAG Tech leadership and functional teams; operating company CIOs, technology leadership teams and policy owners; Group Risk, Internal Audit, Legal, Data Protection, Procurement, HR and Internal Communications.
• External: Strategic partners and technology suppliers to whom Group IT policies apply; external auditors and regulators in conjunction with Group Risk and Legal; industry bodies and peer organisations.

 

 

Skills & Experience

Essential

• Educated to degree level or able to demonstrate equivalent experience.
• Strong understanding of IT governance, policy and control frameworks and how they translate into practical ways of working.
• Excellent writing skills, with the ability to convert complex technical and regulatory input into clear, concise and accessible policy.
• Proven ability to influence, facilitate, build consensus and drive decisions across a complex, multi-company organisation.
• Highly organised, with the discipline to manage a large portfolio of documents, reviews and actions to deadline.
• Good working knowledge of modern technology domains, including cloud, data and AI.
• Proven experience owning or managing a policy framework and policy lifecycle in IT governance, technology risk or compliance.
• Experience taking policies and papers through senior governance forums and embedding them in practice.
• Experience working alongside Cyber Security, Risk, Legal or Internal Audit teams, including in audit or regulatory activity.
• Business-partnering experience with internal and external stakeholders across a diverse operation.
• Ability to work under pressure and fluent English.

Desirable

• Recognised IT governance or service management qualification, such as ISACA CGEIT, COBIT 2019 or ITIL 4.
• Familiarity with ISO/IEC 38500, ISO/IEC 27001 and ISO/IEC 42001.
• AI governance qualification, such as IAPP AIGP, or risk management qualification, such as PCIRM or MoR.
• Experience operating across multiple countries and cultures, ideally in a group with multiple operating companies.
• Spanish language capability.

Personal Attributes

• • Pragmatic and enabling, with a focus on proportionate governance.
  • Collaborative and credible with senior stakeholders and technical subject matter experts.
  • Clear, concise and audience-focused communicator.
  • Structured, disciplined and attentive to detail.
  • Comfortable coordinating decisions across organisational boundaries.

What This Role Offers

• A Group-wide role shaping the technology policy framework across IAG and its operating companies, with broad exposure to technology, AI, cyber security, risk, legal, audit and senior governance forums. The role supports the safe and responsible adoption of emerging technology while helping simplify and strengthen ways of working across an international airline group.

 

 

What we offer