Director - Business Continuity

Methodist Le Bonheur Healthcare•Memphis, TN

About The Position

The Director of Business Continuity is responsible for building, leading, and maturing Methodist Le Bonheur Healthcare’s enterprise Business Continuity Management (BCM) program as a core capability of the Security and Emergency Management function. The Director establishes governance, an operating model, standards, tools, methods, and executive reporting to help the organization sustain or rapidly restore critical clinical, operational, financial, digital, and administrative services during and after disruptive events. The role provides enterprise leadership across acute care, ambulatory operations, clinical and ancillary services, revenue cycle, supply chain, digital health, information technology, facilities, compliance, and third-party partners. It integrates BCM with crisis management and IT disaster recovery while maintaining clear distinctions in their ownership and scope. The Director also supports crisis activation, executive decision-making, continuity and recovery coordination, and continuous improvement through after-action processes. The position manages and directs assigned Associates and models behavior consistent with MLH’s Mission, Vision, and Values. Work is generally performed in office, administrative, hospital, command center, and remote or virtual collaboration settings. The role requires periodic travel to MLH locations, vendor meetings, and exercises; on-call escalation and after-hours support; and possible onsite reporting during emergencies or other operational incidents.

Requirements

Bachelor’s degree required.
At least 10 years of progressive experience in business continuity, operational resilience, emergency management, crisis management, enterprise risk, IT disaster recovery coordination, healthcare operations, or related disciplines.
At least 7 years leading enterprise BCM, resilience, crisis readiness, emergency preparedness, or cross-functional operational risk programs.
Required Certified Business Continuity Professional (CBCP) certification from the Disaster Recovery Institute International.
Executive presence and ability to influence senior leaders, physicians, clinical executives, operational and IT leaders, and external partners without relying solely on direct authority.
Strong knowledge of business continuity, crisis and emergency management, IT disaster recovery, cyber and operational resilience, enterprise risk, and third-party risk.
Strong understanding of healthcare operations, patient safety, clinical workflows, hospital and ambulatory operations, clinical support services, revenue cycle, digital health, supply chain, and regulatory expectations.
Working knowledge of EHR and other clinical and business technology dependencies sufficient to translate disruptions into operational and patient-care impacts.
Ability to design and facilitate executive, operational, clinical, technical, and vendor exercises.
Ability to develop policies, standards, playbooks, dashboards, executive briefings, after-action reports, and board-ready materials.
Strong analytical ability to assess risk, business impact, downtime tolerance, recovery requirements, dependencies, and readiness gaps.
Ability to lead through ambiguity, competing priorities, high-pressure incidents, and matrixed stakeholder environments.
Strong change management, facilitation, conflict resolution, negotiation, storytelling, and consensus-building skills.
Ability to manage sensitive information and remain composed during high-impact events involving patient care, workforce safety, regulatory exposure, or operational disruption.
Demonstrated experience building or materially maturing a BCM program, including governance, policy, BIA methodology, plan standards, training, exercises, reporting, and continuous improvement.
Demonstrated experience leading BIAs, dependency mapping, recovery strategy development, RTO/RPO alignment, downtime readiness assessments, and continuity plan development.
Substitution allowed: a combination of education and substantial enterprise BCM leadership experience in a complex healthcare system, Fortune 500 resilience program, academic medical center, government emergency management environment, or similarly regulated mission-critical organization equivalent to 14 years.
Physical activities may include climbing, pushing, standing, hearing, walking, reaching, grasping, kneeling, stooping, and repetitive motion; good balance and coordination are required.
Light physical work: exerting up to 25 pounds occasionally and/or up to 10 pounds frequently; close visual acuity is required.
Requires periodic travel, on-call escalation, incident response, emergency operations center participation, and after-hours support; may require onsite reporting during emergencies, exercises, outages, or other incidents.

Nice To Haves

Healthcare provider experience is strongly preferred; academic medical center, pediatric, acute care, ambulatory, integrated delivery network, or large health system experience is highly desirable.
Certificate of the Business Continuity Institute (CBCI).
Master Business Continuity Professional (MBCP) from the Disaster Recovery Institute International.
Certified Cyber Resilience Professional from the Disaster Recovery Institute International.
FEMA IS-00800.b National Response Framework: An Introduction.
FEMA IS-100c Introduction to the Incident Command System (ICS 100).
FEMA IS-200c Basic Incident Command System for Initial Response (ICS-200).
FEMA IS-700b An Introduction to the National Incident Management System.
Six Sigma Black Belt, Green Belt, Master Black Belt, White Belt, or Yellow Belt.
Project Management Professional (PMP).
Certified Healthcare Provider Continuity Professional (CHPCP).
ITIL Certification.
Certified Information Security Manager (CISM).
Certified Information Systems Security Professional (CISSP).
Certified Healthcare Privacy Compliance (CHPC).

Responsibilities

Establish systemwide BCM governance, including executive sponsorship, steering committee oversight, operational workgroups, and integration with related enterprise functions.
Develop and maintain a RACI/RASCI model clarifying responsibilities across continuity, emergency management, crisis management, disaster recovery, incident response, facilities, clinical operations, and third-party resilience.
Set annual and multi-year BCM objectives aligned with strategic priorities, patient safety, regulatory readiness, operational risk, cyber resilience, and enterprise transformation.
Lead the development, deployment, and annual refresh of a standardized, process-first, business-led Business Impact Analysis methodology across organizational functions.
Coordinate with IT Disaster Recovery and application owners to align business recovery expectations with RTOs, RPOs, application dependencies, data recovery expectations, and restoration sequencing.
Develop and maintain enterprise BCM standards, templates, playbooks, planning tools, and documentation requirements.
Oversee creation, review, approval, and maintenance of business continuity plans for critical functions across clinical, operational, administrative, technology-enabled, and supply chain areas.
Develop phased continuity strategies for short-duration downtime and extended disruptions, including technology outages, cyber events, utility disruptions, supply shortages, facility loss, public health emergencies, and regional disasters.
Partner with Security and Emergency Management leadership to integrate BCM with crisis management, emergency operations, Hospital Incident Command System, executive escalation, and incident response structures.
Support crisis activation, executive decision-making, situational awareness, operational prioritization, and continuity and recovery coordination during actual or potential disruptive events.
Coordinate post-incident recovery planning and after-action processes, capture lessons learned, assign corrective actions, and strengthen readiness.
Maintain a clear distinction between BCM and IT Disaster Recovery while integrating business priorities with technology recovery.
Facilitate operational validation of IT Disaster Recovery plans to confirm that recovered systems and restored data support critical clinical and business processes.
Support extended IT downtime preparedness for EHR and other critical clinical, operational, and technology dependencies.
Design and lead an enterprise BCM exercise strategy, including tabletop and functional exercises, department downtime drills, vendor exercises, technology disruption scenarios, and enterprise resilience simulations.
Ensure exercises test realistic clinical and operational scenarios and that results inform governance, plans, training, resource allocation, controls, and executive readiness.
Establish and maintain a third-party resilience framework for vendors and partners supporting critical organizational functions.
Ensure critical vendor contracts and service relationships address continuity expectations, incident notification, recovery commitments, testing participation, service levels, data recovery, transition support, and exit considerations.
Coordinate vendor participation in exercises where third-party services materially affect patient care or operational, revenue, technology, or supply continuity.
Ensure the BCM program supports applicable Joint Commission, CMS, HIPAA, state, local, healthcare accreditation, and regulatory requirements; maintain supporting documentation.
Align BCM program design with recognized frameworks and leading practices, including ISO 22301, BCI Good Practice Guidelines, DRII Professional Practices, ASIS guidance, FEMA/NIMS, and healthcare emergency management practices.
Develop executive dashboards, briefings, board-level narratives, risk summaries, maturity updates, and decision materials communicating continuity posture.
Provide regular updates to BCM governance bodies and Security and Emergency Management, IT, clinical, and operational leadership.
Partner with Communications, Legal, Compliance, Privacy, Emergency Management, and executive leadership on internal and external crisis communication needs.
Define and maintain BCM performance metrics, maturity and risk indicators, and executive scorecards.
Track measures including BIA and plan completion, plan validation, exercise participation, corrective action closure, vendor review, training, downtime readiness, RTO/RPO alignment, and plan review timeliness.
Benchmark BCM maturity and recommend improvements to operational resilience.
Manage and direct assigned Associates.