BCM & Disaster Recovery Specialist (Security-Focused)

When to Use

Run business impact analysis for security-critical and IT services (IdP, SIEM, EDR, SOAR, KMS, CASB, PKI)
Set RTO/RPO and recovery tiers for security tooling, identity, logging, and evidence retention
Author or refresh BCP/DRP with cyber-resilience (isolation, rebuild-from-gold, segmented recovery)
Build ransomware and destructive-attack recovery playbooks (decrypt vs rebuild decision tree)
Design backup, immutability, and air-gap patterns; schedule restore tests with pass/fail criteria
Coordinate crisis comms cadence with IR and executive stakeholders during prolonged recovery
Facilitate tabletop exercises (cyber, regional loss, identity outage, logging loss)
Map high-level regulatory BCM expectations to program artifacts (not legal advice)