Location: UK, London
Company: PRS for Music
Work as part of a team to support the organization in identifying, assessing, and managing enterprise, operational, resilience, and third-party risks. The role maintains risk and control frameworks, coordinates assurance and compliance activities, and provides clear reporting that enables informed decision-making. It strengthens business continuity, disaster recovery, incident response, and crisis preparedness, helping protect critical services, members, colleagues, reputation, and brand.
Working collaboratively across technology, cyber security, legal, procurement, and the wider business, the role embeds practical risk ownership, monitors control effectiveness, and supports timely remediation. It also promotes a resilient, compliant, and risk-aware culture while ensuring governance arrangements remain proportionate, effective, and aligned with organizational objectives.
Job role:
Business resilience
- Act as a primary contact for the resilience domain and define resilience requirements for critical operations and services.
- Develop and maintain PRS’ business resilience document suite, including policies, BCPs, BIAs, DR plans, and playbooks.
- Define business continuity, disaster recovery, incident response, and crisis management plans.
- Lead and coordinate crisis response resources and simulation exercises to validate incident and crisis readiness.
- Work across CIO teams to maintain resilient recovery solutions, including appropriate data-protection features.
Enterprise risk management
- Maintain the PRS risk register; identify, assess, prioritise, and report risks, controls, mitigations, exceptions, and remediation plans.
- Partner with leadership to embed risk ownership, improve processes and controls, and monitor risk appetite at process level.
- Test control design and operating effectiveness, including health checks, deep dives, high-risk process reviews, and assurance activity.
- Conduct periodic security reviews, risk assessments, monitoring, and internal audits using relevant frameworks, including NIST, ISO 31000, and ISO 27001.
Audit and assurance
- Coordinate audit activity, annual audit plans, stakeholders, and management responses with outsourced audit providers.
- Provide risk, controls, compliance, and audit reporting to senior leadership and the Audit and Risk Committee.
- Define, track, and communicate KPIs, KRIs, and compliance metrics through clear dashboards and business-focused reporting.
- Administer policy governance, including annual reviews and policy attestations.
Third-party governance, risk, and compliance
- Implement and monitor security GRC policies and compliance requirements across cyber security and the wider organization.
- Support procurement, legal, and business teams with supplier compliance, third-party risk management, and security requirements.
- Establish and oversee third-party security-risk processes, governance, vendor performance, and delivery against agreed SLAs.
- Deliver security awareness and training with managed service providers, including third-party risk-management training.
Stakeholder leadership
- Build effective relationships with the CIO, Director of cyber security, Head of Risk, legal, procurement, technology, and product teams.
- Champion PRSfM values, sound business conduct, and practical risk-aware decision-making.