Enterprise Risk and Resilience Manager

PRS for Music; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

PRS for Music is seeking an experienced Risk & Compliance professional to identify, assess and manage enterprise, operational, resilience and third‑party risks. You will maintain risk frameworks, coordinate assurance activities and report to enable informed decisions, strengthening business continuity and incident response across the organisation.

You will work across Technology, Cyber Security, Legal and Procurement to embed risk ownership, monitor controls and support remediation while

Qualifications

• Degree or equivalent in Risk Management, Governance, Compliance or related
• Professional certification in risk/compliance field (CRISC, CISA, CBCI, MBCI) or progress toward accreditation
• Strong knowledge of risk and control frameworks (ISO 31000, ISO 27001, NIST)
• Experience designing, implementing and testing controls, continuity, DR, incident response and crisis management
• Experience with third-party risk management, supplier assurance and policy governance
• Ability to develop KPIs/KRIs and management reporting for risk-based decisions
• Strong stakeholder management and communication with senior leadership and auditors

Responsibilities

• Act as a primary resilience domain contact and define resilience requirements for critical operations
• Develop and maintain resilience documents (Policies, BCPs, BIAs, DR Plans) and playbooks
• Define business continuity, disaster recovery, incident response and crisis management plans
• Lead crisis response resources and run simulation exercises to test readiness
• Coordinate with CIO teams to maintain resilient recovery solutions and data protection

Skills

Risk management

Business continuity

Governance

Communication

Education

Degree in Risk Mgmt

Certification: CRISC / CISA

Tools

NIST framework

ISO 31000

ISO 27001

Job description

Overview Work as part of a team to support the organisation in identifying, assessing and managing enterprise, operational, resilience and third-party risks. The role maintains risk and control frameworks, coordinates assurance and compliance activities, and provides clear reporting that enables informed decision-making. It strengthens business continuity, disaster recovery, incident response and crisis preparedness, helping protect critical services, members, colleagues, reputation and brand.

Overview Work as part of a team to support the organisation in identifying, assessing and managing enterprise, operational, resilience and third-party risks. The role maintains risk and control frameworks, coordinates assurance and compliance activities, and provides clear reporting that enables informed decision-making. It strengthens business continuity, disaster recovery, incident response and crisis preparedness, helping protect critical services, members, colleagues, reputation and brand. Working collaboratively across Technology, Cyber Security, Legal, Procurement and the wider business, the role embeds practical risk ownership, monitors control effectiveness and supports timely remediation. It also promotes a resilient, compliant and risk-aware culture while ensuring governance arrangements remain proportionate, effective and aligned with organisational objectives.

Responsibilities

Business Resilience

• Act as a primary contact for the resilience domain and define resilience requirements for critical operations and services.
• Develop and maintain PRS’ Business Resilience document suite, including Policies, BCPs, BIAs, DR Plans and Playbooks.
• Define business continuity, disaster-recovery, incident-response, crisis management plans.
• Lead and coordinate crisis response resources and simulation exercises to validate incident and crisis readiness.
• Work across CIO teams to maintain resilient recovery solutions, including appropriate data-protection features.

Enterprise Risk Management

• Maintain the PRS Risk Register; identify, assess, prioritise and report risks, controls, mitigations, exceptions and remediation plans.
• Partner with leadership to embed risk ownership, improve processes and controls, and monitor risk appetite at process level.
• Test control design and operating effectiveness, including health checks, deep dives, high-risk process reviews and assurance activity.
• Conduct periodic security reviews, risk assessments, monitoring and internal audits using relevant frameworks, including NIST, ISO 31000 and ISO 27001.

Audit and Assurance

• Coordinate audit activity, annual audit plans, stakeholders and management responses with outsourced audit providers.
• Provide risk, controls, compliance and audit reporting to senior leadership and the Audit & Risk Committee.
• Define, track and communicate KPIs, KRIs and compliance metrics through clear dashboards and business-focused reporting.
• Administer policy governance, including annual reviews and policy attestations.

Third Party Governance, Risk & Compliance

• Implement and monitor security GRC policies and compliance requirements across Cyber Security and the wider organisation.
• Support Procurement, Legal and business teams with supplier compliance, third-party risk management and security requirements.
• Establish and oversee third-party security-risk processes, governance, vendor performance and delivery against agreed SLAs.
• Deliver security awareness and training with managed service providers, including third-party risk-management training.

Stakeholder leadership

• Build effective relationships with the CIO, Director of Cyber Security, Head of Risk, Legal, Procurement, Technology and Product Teams.
• Champion PRSfM values, sound business conduct and practical risk-aware decision-making.

About You

Experience and Qualifications

• Degree-level qualification, or equivalent experience, in Risk Management, Business Continuity, Governance, Compliance, Technology, Compliance, Audit or a related discipline.
• Professional certification in a relevant field (e.g. CRISC, CISA, CBCI, MBCI, IRM) or demonstrable progress towards accreditation.
• Strong knowledge of risk and control frameworks, including ISO 31000, ISO 27001, NIST and recognised business continuity standards.
• Experience designing, implementing and testing controls, business continuity, disaster recovery, incident response and crisis management arrangements.
• Experience of third-party risk management, supplier assurance, policy governance and regulatory or compliance reporting.
• Demonstrable ability to develop KPIs, KRIs and management reporting that enables effective risk-based decision making.
• Strong stakeholder management, influencing and communication skills, with experience working with senior leaders, auditors, suppliers and cross-functional teams.

Driven and motivated

• Shows energy, initiative and determination to achieve results.
• Takes ownership and remains focused when priorities shift or challenges arise.
• Proactively identifies opportunities to improve outcomes.

Makes considered decisions

• Balances short and long-term implications to make sound decisions.
• Takes responsibility for decisions and their outcomes.

Delivers successfully

• Constructively challenges plans & processes to improve best practice.
• Finds practical solutions rather than simply highlighting problems.
• Responds to customers and stakeholders with urgency and care.

Simplifies complexity

• Draws together diverse perspectives and identifies what matters most.
• Communicates complex information clearly and creates shared understanding.