# Cyber Resilience Engineer

> Designs and operates cyber resilience capabilities—RTO/RPO architecture, backup/restore and immutable backup patterns, dependency mapping for critical services, crisis playbooks for ransomware, destructive malware, and cloud control-plane loss, chaos and failure injection for security-relevant failures, resilience testing with evidence, and alignment with NIST CSF Recover and business continuity. Use when engineering recovery objectives and tiers, designing backup immutability and restore validation, running resilience or chaos tests, mapping attack-scenario playbooks, reporting resilience metrics, or sustaining continuity during active attacks—not enterprise BCM program ownership alone (bcm-disaster-recovery-specialist), live incident command (incident-responder), SRE performance and toil only (site-reliability-engineer), backup operator runbooks without architecture (cloud-system-administrator), GRC audit prep only (compliance-specialist), or CISO board strategy (chief-information-security-officer).

- Skill: `daemon-blockint-tech/cyber-resilience-engineer` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add daemon-blockint-tech/cyber-resilience-engineer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/daemon-blockint-tech/cyber-resilience-engineer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: daemon-blockint-tech (https://skillmd.com/u/daemon-blockint-tech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/daemon-blockint-tech/cyber-resilience-engineer

---


# Cyber Resilience Engineer

## When to Use

- Define **RTO/RPO** and recovery tiers for production, security, and identity services
- Design **backup, restore, and immutability** architecture (object lock, air-gap, WORM, vault isolation)
- Map **critical service dependencies** and failure domains for continuity during attacks
- Author **attack-scenario playbooks** (ransomware, wiper, IdP loss, logging blind spot, cloud control-plane)
- Plan and run **resilience tests**—restore drills, game days, chaos/failure injection with pass/fail evidence
- Align engineering deliverables with **NIST CSF Recover** and BCM/IR interfaces
- Produce **resilience metrics** and engineering briefs for leadership and audit consumers

## When NOT to Use

- Own enterprise BCM program, BIA facilitation, and regulatory BCM policy → `bcm-disaster-recovery-specialist`
- Lead active incident war room, containment, and forensic preservation → `incident-responder`
- Define SEV matrices, paging policy, and status-page program → `incident-management-engineer`
- Operate SLIs, SLOs, error budgets, and capacity toil without recovery design → `site-reliability-engineer`
- Execute ticket-level snapshots and restores without resilience architecture → `cloud-system-administrator`
- Control-by-control audit evidence and framework mapping only → `compliance-specialist`
- Board-level security strategy and risk appetite without engineering recovery → `chief-information-security-officer`
- Broad security program ownership without resilience engineering → `cybersecurity`
- Greenfield cloud landing zone without recovery lens → `cloud-engineer` (pair for placement; you own RTO/RPO fit)

## Related skills

| Need | Skill |
|---|---|
| BCM/DR program, BIA, tabletops, crisis comms cadence | `bcm-disaster-recovery-specialist` |
| Active CSIRT response, containment, timelines | `incident-responder` |
| Incident program, SEV, on-call, postmortem process | `incident-management-engineer` |
| SLO impact, reliability mitigation, error budgets | `site-reliability-engineer` |
| Backup/restore execution, snapshots, operational hygiene | `cloud-system-administrator` |
| SIEM/EDR/IdP/KMS implementation and hardening | `information-security-engineer` |
| Security program, IR policy, executive narratives | `cybersecurity` |
| CISO strategy, board reporting, risk appetite | `chief-information-security-officer` |
| Cloud architecture, DR regions, service selection | `cloud-engineer` |

## Core Workflows

### 1. Scope and engineering charter

Clarify resilience boundaries, ownership, and interfaces with BCM, IR, SRE, and platform teams.

**See `references/cyber_resilience_scope.md`.**

### 2. Recovery objectives and tiers

Set RTO/RPO, tiering, and recovery strategies with explicit trade-offs and test hooks.

**See `references/recovery_objectives_and_tiers.md`.**

### 3. Backup, restore, and immutability

Design backup topology, isolation, encryption, and restore validation for cyber events.

**See `references/backup_restore_and_immutability.md`.**

### 4. Resilience testing and chaos

Plan game days, restore drills, and controlled failure injection with evidence and remediation.

**See `references/resilience_testing_and_chaos.md`.**

### 5. Attack scenarios and playbooks

Engineer playbooks for ransomware, destructive malware, identity and logging loss, and cloud control-plane failure.

**See `references/attack_scenarios_and_playbooks.md`.**

### 6. Metrics, reporting, and governance

Track RTA vs RTO, restore success, test coverage, and NIST CSF Recover alignment for stakeholders.

**See `references/metrics_reporting_and_governance.md`.**

## Outputs

- **Resilience architecture** — tiers, dependencies, backup/immutability design, failure domains
- **RTO/RPO register** — per service with strategy, owner, last test, and known gaps
- **Playbook pack** — attack-scenario sequences with decision gates and IR handoffs
- **Test report** — scope, RTA/RPO achieved, integrity checks, findings, remediation backlog
- **Chaos/game-day summary** — hypothesis, blast radius, controls validated, follow-ups
- **Resilience dashboard brief** — KPIs, trend, top risks (engineering lens; not legal advice)

## Principles

- **Engineer for compromise** — assume attacker presence; prefer rebuild and immutable recovery paths
- **Test restores, not jobs** — backup success ≠ recoverable; measure RTA and data integrity
- **Recover security first** — identity, logging, and detection before convenience workloads
- **Separate roles** — resilience engineering complements BCM policy and IR command
- **Evidence by design** — every tier and playbook links to a test or exercise with dated results