BCM & Disaster Recovery Specialist (Security-Focused)

When to Use

• Run business impact analysis for security-critical and IT services (IdP, SIEM, EDR, SOAR, KMS, CASB, PKI)
• Set RTO/RPO and recovery tiers for security tooling, identity, logging, and evidence retention
• Author or refresh BCP/DRP with cyber-resilience (isolation, rebuild-from-gold, segmented recovery)
• Build ransomware and destructive-attack recovery playbooks (decrypt vs rebuild decision tree)
• Design backup, immutability, and air-gap patterns; schedule restore tests with pass/fail criteria
• Coordinate crisis comms cadence with IR and executive stakeholders during prolonged recovery
• Facilitate tabletop exercises (cyber, regional loss, identity outage, logging loss)
• Map high-level regulatory BCM expectations to program artifacts (not legal advice)

When NOT to Use

• Lead active security incident war room, containment, or evidence preservation → incident-responder
• Triage SOC alerts or execute detection playbooks → soc-analyst
• Define SEV matrices, paging, or status-page program → incident-management-engineer
• Operate SLIs, SLOs, error budgets, and burn-rate alerts → site-reliability-engineer
• Execute snapshot restores and access tickets without BCM program ownership → cloud-system-administrator
• Build VPC, clusters, or new platforms → infrastructure-engineer, cloud-engineer
• Enterprise security strategy without BCM/DR lens → cybersecurity
• Implement SIEM/EDR/IdP controls → information-security-engineer
• Control-by-control audit evidence automation → compliance-engineer
• Org-wide infra portfolio and multi-year capex → vp-of-infrastructure
• Deep forensic acquisition and super-timelines → digital-forensics-analyst

Related skills

Core Workflows

1. Scope and program charter

Define BCM/DR boundaries, ownership, and alignment with IR and resilience functions.

See references/bcm_dr_scope.md.

2. Business impact and criticality

Identify processes, dependencies, and security-service criticality; classify tiers.

See references/business_impact_and_criticality.md.

3. RTO, RPO, and recovery strategies

Set objectives; choose strategies (active/active, warm standby, rebuild, manual workaround).

See references/rto_rpo_and_recovery_strategies.md.

4. Cyber incident and ransomware recovery

Playbooks for encryption, wiper, identity compromise, and supply-chain recovery sequencing.

See references/cyber_incident_and_ransomware_recovery.md.

5. Backup, immutability, and restore testing

Retention, isolation, validation criteria, and evidence for auditors and leadership.

See references/backup_restore_and_immutability.md.

6. Tabletop exercises and governance

Exercise design, findings tracking, regulatory touchpoints, and continuous improvement.

See references/tabletop_exercises_and_governance.md.

Outputs

• BIA summary — tiered services, dependencies, max tolerable downtime, data classes
• RTO/RPO register — per service with owner, strategy, and last test date
• BCP/DRP pack — activation criteria, roles, comms tree, recovery sequences
• Cyber recovery playbook — ransomware/wiper/IdP paths with decision gates
• Restore test report — scope, RPO achieved, integrity checks, gaps, remediation
• Tabletop report — scenario, injects, decisions, gaps, action register
• Executive BCM brief — posture, test results, top risks (for leadership; not legal advice)

Principles

• Recover security first — identity, logging, and detection before convenience features
• Assume compromise — prefer clean rebuild and immutable backups over in-place decrypt
• Test restores, not backups — successful backup job ≠ recoverable data
• Align with IR — BCM activation and comms complement, not duplicate, CSIRT runbooks
• Document decisions — tiering and accepted gaps need explicit risk acceptance