Enterprise Risk and Resilience Manager

Overview:

Work as part of a team to support the organisation in identifying, assessing and managing enterprise, operational, resilience and third-party risks. The role maintains risk and control frameworks, coordinates assurance and compliance activities, and provides clear reporting that enables informed decision-making. It strengthens business continuity, disaster recovery, incident response and crisis preparedness, helping protect critical services, members, colleagues, reputation and brand.

Working collaboratively across Technology, Cyber Security, Legal, Procurement and the wider business, the role embeds practical risk ownership, monitors control effectiveness and supports timely remediation. It also promotes a resilient, compliant and risk-aware culture while ensuring governance arrangements remain proportionate, effective and aligned with organisational objectives.

Responsibilities:

Business Resilience

- Act as a primary contact for the resilience domain and define resilience requirements for critical operations and services. - Develop and maintain PRS’ Business Resilience document suite, including Policies, BCPs, BIAs, DR Plans and Playbooks. - Define business continuity, disaster-recovery, incident-response, crisis management plans. - Lead and coordinate crisis response resources and simulation exercises to validate incident and crisis readiness. - Work across CIO teams to maintain resilient recovery solutions, including appropriate data-protection features.

Enterprise Risk Management

- Maintain the PRS Risk Register; identify, assess, prioritise and report risks, controls, mitigations, exceptions and remediation plans. - Partner with leadership to embed risk ownership, improve processes and controls, and monitor risk appetite at process level. - Test control design and operating effectiveness, including health checks, deep dives, high-risk process reviews and assurance activity. - Conduct periodic security reviews, risk assessments, monitoring and internal audits using relevant frameworks, including NIST, ISO 31000 and ISO 27001.

Audit and Assurance

- Coordinate audit activity, annual audit plans, stakeholders and management responses with outsourced audit providers. - Provide risk, controls, compliance and audit reporting to senior leadership and the Audit & Risk Committee. - Define, track and communicate KPIs, KRIs and compliance metrics through clear dashboards and business-focused reporting. - Administer policy governance, including annual reviews and policy attestations.

Third Party Governance, Risk & Compliance

- Implement and monitor security GRC policies and compliance requirements across Cyber Security and the wider organisation. - Support Procurement, Legal and business teams with supplier compliance, third-party risk management and security requirements. - Establish and oversee third-party security-risk processes, governance, vendor performance and delivery against agreed SLAs. - Deliver security awareness and training with managed service providers, including third-party risk-management training.

Stakeholder leadership

- Build effective relationships with the CIO, Director of Cyber Security, Head of Risk, Legal, Procurement, Technology and Product Teams. - Champion PRSfM values, sound business conduct and practical risk-aware decision-making.

About you:

Experience and Qualifications

- Degree-level qualification, or equivalent experience, in Risk Management, Business Continuity, Governance, Compliance, Technology, Compliance, Audit or a related discipline. - Professional certification in a relevant field (e.g. CRISC, CISA, CBCI, MBCI, IRM) or demonstrable progress towards accreditation. - Strong knowledge of risk and control frameworks, including ISO 31000, ISO 27001, NIST and recognised business continuity standards. - Experience designing, implementing and testing controls, business continuity, disaster recovery, incident response and crisis management arrangements. - Experience of third-party risk management, supplier assurance, policy governance and regulatory or compliance reporting. - Demonstrable ability to develop KPIs, KRIs and management reporting that enables effective risk-based decision making. - Strong stakeholder management, influencing and communication skills, with experience working with senior leaders, auditors, suppliers and cross-functional teams.

Driven and motivated

- Shows energy, initiative and determination to achieve results. - Takes ownership and remains focused when priorities shift or challenges arise. - Proactively identifies opportunities to improve outcomes.

Makes considered decisions

- Balances short and long-term implications to make sound decisions. - Takes responsibility for decisions and their outcomes.

Delivers successfully

- Constructively challenges plans & processes to improve best practice. - Finds practical solutions rather than simply highlighting problems. - Responds to customers and stakeholders with urgency and care.

Simplifies complexity

- Draws together diverse perspectives and identifies what matters most. - Communicates complex information clearly and creates shared understanding.