Enterprise Risk and Resilience Manager

PRS for Music; Greater London; Vor Ort; GBP 70.000 - 110.000; Vollzeit

Zusammenfassung

Prs For Music Ltd in Greater London seeks a senior risk and compliance professional to identify, assess and manage enterprise, operational, resilience and third‑party risks. You will maintain risk and control frameworks, coordinate assurance activities, and provide reporting that informs decisions.

The role strengthens business continuity, disaster recovery, incident response and crisis preparedness to protect services, members, colleagues and brand.

Qualifikationen

• Degree-level qualification in Risk Management, Governance, Compliance, Technology, Audit or related discipline.
• Professional certification (e.g. CRISC, CISA, CBCI, MBCI, IRM) or progress towards accreditation.
• Strong knowledge of risk and control frameworks (ISO 31000, ISO 27001, NIST).
• Experience designing and testing controls, business continuity, disaster recovery, incident response and crisis management arrangements.
• Experience in third‑party risk management, supplier assurance, policy governance and regulatory reporting.
• Ability to develop KPIs, KRIs and management reporting for risk-based decisions.
• Strong stakeholder management and communication with senior leaders, auditors and cross-functional teams.

Aufgaben

• Act as a primary contact for the resilience domain and define resilience requirements for critical operations and services.
• Develop and maintain PRS’ Business Resilience document suite, including Policies, BCPs, BIAs, DR Plans and Playbooks.
• Define business continuity, disaster-recovery, incident-response, crisis management plans.
• Lead and coordinate crisis response resources and simulation exercises to validate incident and crisis readiness.
• Work across CIO teams to maintain resilient recovery solutions, including data‑protection features.
• Maintain the PRS Risk Register; identify, assess, prioritise and report risks, controls, mitigations, exceptions and remediation plans.
• Partner with leadership to embed risk ownership, improve processes and monitor risk appetite at process level.
• Test control design and operating effectiveness, including health checks, deep dives, high‑risk process reviews and assurance activity.
• Conduct periodic security reviews, risk assessments, monitoring and internal audits using frameworks like NIST/ISO.
• Coordinate audit activity, annual audit plans, stakeholders and management responses with outsourced audit providers.
• Provide risk, controls, compliance and audit reporting to senior leadership and the Audit & Risk Committee.
• Define, track and communicate KPIs, KRIs and compliance metrics through dashboards and reporting.
• Administer policy governance, including annual reviews and policy attestations.
• Implement and monitor security GRC policies and compliance requirements across Cyber Security and the wider organisation.
• Support Procurement, Legal and business teams with supplier compliance and third‑party risk management.
• Establish and oversee third‑party security‑risk processes and vendor performance against SLAs.
• Deliver security awareness and training with MSPs including third‑party risk-management training.
• Build effective relationships with CIO, Director of Cyber Security, Head of Risk, Legal, Procurement, Technology and Product Teams.
• Champion PRSfM values and risk-aware decision-making.

Kenntnisse

Risk management

Governance

Compliance

Audit

Business continuity

Disaster recovery

Incident response

Stakeholder management

Reporting

Ausbildung

Degree in Risk Management

Tools

ISO 31000

ISO 27001

NIST

Jobbeschreibung

Overview

Work as part of a team to support the organisation in identifying, assessing and managing enterprise, operational, resilience and third-party risks. The role maintains risk and control frameworks, coordinates assurance and compliance activities, and provides clear reporting that enables informed decision-making. It strengthens business continuity, disaster recovery, incident response and crisis preparedness, helping protect critical services, members, colleagues, reputation and brand.

Working collaboratively across Technology, Cyber Security, Legal, Procurement and the wider business, the role embeds practical risk ownership, monitors control effectiveness and supports timely remediation. It also promotes a resilient, compliant and risk‑aware culture while ensuring governance arrangements remain proportionate, effective and aligned with organisational objectives.

Responsibilities

Business Resilience

• Act as a primary contact for the resilience domain and define resilience requirements for critical operations and services.
• Develop and maintain PRS’ Business Resilience document suite, including Policies, BCPs, BIAs, DR Plans and Playbooks.
• Define business continuity, disaster‑recovery, incident‑response, crisis management plans.
• Lead and coordinate crisis response resources and simulation exercises to validate incident and crisis readiness.
• Work across CIO teams to maintain resilient recovery solutions, including appropriate data‑protection features.

Enterprise Risk Management

• Maintain the PRS Risk Register; identify, assess, prioritise and report risks, controls, mitigations, exceptions and remediation plans.
• Partner with leadership to embed risk ownership, improve processes and controls, and monitor risk appetite at process level.
• Test control design and operating effectiveness, including health checks, deep dives, high‑risk process reviews and assurance activity.
• Conduct periodic security reviews, risk assessments, monitoring and internal audits using relevant frameworks, including NIST, ISO 31000 and ISO 27001.

Audit and Assurance

• Coordinate audit activity, annual audit plans, stakeholders and management responses with outsourced audit providers.
• Provide risk, controls, compliance and audit reporting to senior leadership and the Audit & Risk Committee.
• Define, track and communicate KPIs, KRIs and compliance metrics through clear dashboards and business‑focused reporting.
• Administer policy governance, including annual reviews and policy attestations.

Third Party Governance, Risk & Compliance

• Implement and monitor security GRC policies and compliance requirements across Cyber Security and the wider organisation.
• Support Procurement, Legal and business teams with supplier compliance, third‑party risk management and security requirements.
• Establish and oversee third‑party security‑risk processes, governance, vendor performance and delivery against agreed SLAs.
• Deliver security awareness and training with managed service providers, including third‑party risk‑management training.

Stakeholder leadership

• Build effective relationships with the CIO, Director of Cyber Security, Head of Risk, Legal, Procurement, Technology and Product Teams.
• Champion PRSfM values, sound business conduct and practical risk‑aware decision‑making.

About you

Experience and Qualifications

• Degree‑level qualification, or equivalent experience, in Risk Management, Business Continuity, Governance, Compliance, Technology, Compliance, Audit or a related discipline.
• Professional certification in a relevant field (e.g. CRISC, CISA, CBCI, MBCI, IRM) or demonstrable progress towards accreditation.
• Strong knowledge of risk and control frameworks, including ISO 31000, ISO 27001, NIST and recognised business continuity standards.
• Experience designing, implementing and testing controls, business continuity, disaster recovery, incident response and crisis management arrangements.
• Experience of third‑party risk management, supplier assurance, policy governance and regulatory or compliance reporting.
• Demonstrable ability to develop KPIs, KRIs and management reporting that enables effective risk‑based decision making.
• Strong stakeholder management, influencing and communication skills, with experience working with senior leaders, auditors, suppliers and cross‑functional teams.

Driven and motivated

• Shows energy, initiative and determination to achieve results.
• Takes ownership and remains focused when priorities shift or challenges arise.
• Proactively identifies opportunities to improve outcomes.

Makes considered decisions

• Balances short and long‑term implications to make sound decisions.
• Takes responsibility for decisions and their outcomes.

Delivers successfully

• Constructively challenges plans & processes to improve best practice.
• Finds practical solutions rather than simply highlighting problems.
• Responds to customers and stakeholders with urgency and care.

Simplifies complexity

• Draws together diverse perspectives and identifies what matters most.
• Communicates complex information clearly and creates shared understanding.