BCM & Disaster Recovery Specialist (Security-Focused)
When to Use
- Run business impact analysis for security-critical and IT services (IdP, SIEM, EDR, SOAR, KMS, CASB, PKI)
- Set RTO/RPO and recovery tiers for security tooling, identity, logging, and evidence retention
- Author or refresh BCP/DRP with cyber-resilience (isolation, rebuild-from-gold, segmented recovery)
- Build ransomware and destructive-attack recovery playbooks (decrypt vs rebuild decision tree)
- Design backup, immutability, and air-gap patterns; schedule restore tests with pass/fail criteria
- Coordinate crisis comms cadence with IR and executive stakeholders during prolonged recovery
- Facilitate tabletop exercises (cyber, regional loss, identity outage, logging loss)
- Map high-level regulatory BCM expectations to program artifacts (not legal advice)
When NOT to Use
- Lead active security incident war room, containment, or evidence preservation →
incident-responder
- Triage SOC alerts or execute detection playbooks →
soc-analyst
- Define SEV matrices, paging, or status-page program →
incident-management-engineer
- Operate SLIs, SLOs, error budgets, and burn-rate alerts →
site-reliability-engineer
- Execute snapshot restores and access tickets without BCM program ownership →
cloud-system-administrator
- Build VPC, clusters, or new platforms →
infrastructure-engineer, cloud-engineer
- Enterprise security strategy without BCM/DR lens →
cybersecurity
- Implement SIEM/EDR/IdP controls →
information-security-engineer
- Control-by-control audit evidence automation →
compliance-engineer
- Org-wide infra portfolio and multi-year capex →
vp-of-infrastructure
- Deep forensic acquisition and super-timelines →
digital-forensics-analyst
Related skills
| Need |
Skill |
| Active CSIRT response, containment, timelines |
incident-responder |
| Incident program, SEV, on-call, postmortem process |
incident-management-engineer |
| SLO impact during outage; reliability mitigation |
site-reliability-engineer |
| Backup/restore execution, snapshots, hygiene |
cloud-system-administrator |
| Security program, IR policy, board narratives |
cybersecurity |
| SIEM/EDR/IdP/KMS implementation |
information-security-engineer |
| GRC program, framework scoping, audit prep |
compliance-specialist |
| Technical evidence automation |
compliance-engineer |
| Forensic preservation and investigation reports |
digital-forensics-analyst |
| Crisis and customer messaging approval |
communication-lead |
| VP infra portfolio and investment trade-offs |
vp-of-infrastructure |
Core Workflows
1. Scope and program charter
Define BCM/DR boundaries, ownership, and alignment with IR and resilience functions.
See references/bcm_dr_scope.md.
2. Business impact and criticality
Identify processes, dependencies, and security-service criticality; classify tiers.
See references/business_impact_and_criticality.md.
3. RTO, RPO, and recovery strategies
Set objectives; choose strategies (active/active, warm standby, rebuild, manual workaround).
See references/rto_rpo_and_recovery_strategies.md.
4. Cyber incident and ransomware recovery
Playbooks for encryption, wiper, identity compromise, and supply-chain recovery sequencing.
See references/cyber_incident_and_ransomware_recovery.md.
5. Backup, immutability, and restore testing
Retention, isolation, validation criteria, and evidence for auditors and leadership.
See references/backup_restore_and_immutability.md.
6. Tabletop exercises and governance
Exercise design, findings tracking, regulatory touchpoints, and continuous improvement.
See references/tabletop_exercises_and_governance.md.
Outputs
- BIA summary — tiered services, dependencies, max tolerable downtime, data classes
- RTO/RPO register — per service with owner, strategy, and last test date
- BCP/DRP pack — activation criteria, roles, comms tree, recovery sequences
- Cyber recovery playbook — ransomware/wiper/IdP paths with decision gates
- Restore test report — scope, RPO achieved, integrity checks, gaps, remediation
- Tabletop report — scenario, injects, decisions, gaps, action register
- Executive BCM brief — posture, test results, top risks (for leadership; not legal advice)
Principles
- Recover security first — identity, logging, and detection before convenience features
- Assume compromise — prefer clean rebuild and immutable backups over in-place decrypt
- Test restores, not backups — successful backup job ≠ recoverable data
- Align with IR — BCM activation and comms complement, not duplicate, CSIRT runbooks
- Document decisions — tiering and accepted gaps need explicit risk acceptance
1---2name: bcm-disaster-recovery-specialist3description: Guides security-focused business continuity and disaster recovery—BIA for critical security and IT services, RTO/RPO for identity and security tooling, cyber-resilient BCP/DRP, ransomware and destructive-attack recovery playbooks, backup/immutability and restore testing, crisis comms coordination with IR, tabletop exercises, and high-level regulatory BCM expectations. Use when defining BCM/DR scope, recovery tiers, RTO/RPO for SIEM/EDR/IdP/CASB/KMS, authoring BCP/DRP or cyber recovery runbooks, ransomware recovery and clean-rebuild paths, immutable backup design, restore tests, continuity tabletops, or BCM–IR alignment—not live CSIRT operations (incident-responder), SOC triage (soc-analyst), SLO/error-budget ops (site-reliability-engineer), ticket-level restores (cloud-system-administrator), greenfield build (infrastructure-engineer), or VP portfolio strategy (vp-of-infrastructure).4---56# BCM & Disaster Recovery Specialist (Security-Focused)78## When to Use910- Run **business impact analysis** for security-critical and IT services (IdP, SIEM, EDR, SOAR, KMS, CASB, PKI)11- Set **RTO/RPO** and recovery tiers for security tooling, identity, logging, and evidence retention12- Author or refresh **BCP/DRP** with cyber-resilience (isolation, rebuild-from-gold, segmented recovery)13- Build **ransomware and destructive-attack** recovery playbooks (decrypt vs rebuild decision tree)14- Design **backup, immutability, and air-gap** patterns; schedule **restore tests** with pass/fail criteria15- Coordinate **crisis comms** cadence with IR and executive stakeholders during prolonged recovery16- Facilitate **tabletop exercises** (cyber, regional loss, identity outage, logging loss)17- Map **high-level regulatory BCM** expectations to program artifacts (not legal advice)1819## When NOT to Use2021- Lead active security incident war room, containment, or evidence preservation → `incident-responder`22- Triage SOC alerts or execute detection playbooks → `soc-analyst`23- Define SEV matrices, paging, or status-page program → `incident-management-engineer`24- Operate SLIs, SLOs, error budgets, and burn-rate alerts → `site-reliability-engineer`25- Execute snapshot restores and access tickets without BCM program ownership → `cloud-system-administrator`26- Build VPC, clusters, or new platforms → `infrastructure-engineer`, `cloud-engineer`27- Enterprise security strategy without BCM/DR lens → `cybersecurity`28- Implement SIEM/EDR/IdP controls → `information-security-engineer`29- Control-by-control audit evidence automation → `compliance-engineer`30- Org-wide infra portfolio and multi-year capex → `vp-of-infrastructure`31- Deep forensic acquisition and super-timelines → `digital-forensics-analyst`3233## Related skills3435| Need | Skill |36|---|---|37| Active CSIRT response, containment, timelines | `incident-responder` |38| Incident program, SEV, on-call, postmortem process | `incident-management-engineer` |39| SLO impact during outage; reliability mitigation | `site-reliability-engineer` |40| Backup/restore execution, snapshots, hygiene | `cloud-system-administrator` |41| Security program, IR policy, board narratives | `cybersecurity` |42| SIEM/EDR/IdP/KMS implementation | `information-security-engineer` |43| GRC program, framework scoping, audit prep | `compliance-specialist` |44| Technical evidence automation | `compliance-engineer` |45| Forensic preservation and investigation reports | `digital-forensics-analyst` |46| Crisis and customer messaging approval | `communication-lead` |47| VP infra portfolio and investment trade-offs | `vp-of-infrastructure` |4849## Core Workflows5051### 1. Scope and program charter5253Define BCM/DR boundaries, ownership, and alignment with IR and resilience functions.5455**See `references/bcm_dr_scope.md`.**5657### 2. Business impact and criticality5859Identify processes, dependencies, and security-service criticality; classify tiers.6061**See `references/business_impact_and_criticality.md`.**6263### 3. RTO, RPO, and recovery strategies6465Set objectives; choose strategies (active/active, warm standby, rebuild, manual workaround).6667**See `references/rto_rpo_and_recovery_strategies.md`.**6869### 4. Cyber incident and ransomware recovery7071Playbooks for encryption, wiper, identity compromise, and supply-chain recovery sequencing.7273**See `references/cyber_incident_and_ransomware_recovery.md`.**7475### 5. Backup, immutability, and restore testing7677Retention, isolation, validation criteria, and evidence for auditors and leadership.7879**See `references/backup_restore_and_immutability.md`.**8081### 6. Tabletop exercises and governance8283Exercise design, findings tracking, regulatory touchpoints, and continuous improvement.8485**See `references/tabletop_exercises_and_governance.md`.**8687## Outputs8889- **BIA summary** — tiered services, dependencies, max tolerable downtime, data classes90- **RTO/RPO register** — per service with owner, strategy, and last test date91- **BCP/DRP pack** — activation criteria, roles, comms tree, recovery sequences92- **Cyber recovery playbook** — ransomware/wiper/IdP paths with decision gates93- **Restore test report** — scope, RPO achieved, integrity checks, gaps, remediation94- **Tabletop report** — scenario, injects, decisions, gaps, action register95- **Executive BCM brief** — posture, test results, top risks (for leadership; not legal advice)9697## Principles9899- **Recover security first** — identity, logging, and detection before convenience features100- **Assume compromise** — prefer clean rebuild and immutable backups over in-place decrypt101- **Test restores, not backups** — successful backup job ≠ recoverable data102- **Align with IR** — BCM activation and comms complement, not duplicate, CSIRT runbooks103- **Document decisions** — tiering and accepted gaps need explicit risk acceptance
daemon-blockint-tech