Disaster Recovery and Resiliency Specialist

University of Chicago•Chicago, IL

8d•$125,000 - $135,000•Hybrid

About The Position

The Disaster Recovery and Resiliency Specialist supports the University of Chicago’s technology resiliency program within the Information Security Office. The role helps ensure the University can recover critical systems and data following serious disruptions, including cyberattacks, conventional outages, facility events, and failures at cloud and software vendors. Working independently with minimal guidance, the Specialist helps develop resiliency strategy and recovery requirements, coordinates testing, tracks gaps to closure, and reports recovery risk to the CISO and University leadership. ITS service owners remain responsible for operating recovery solutions; this role supports the standard and coordinates validation of recovery capabilities. The Specialist works with campus partners, the University of Chicago Medical Center, UChicago Global, emergency management, business continuity functions, and other stakeholders to understand recovery needs and coordinate on shared infrastructure and risks. The position also serves as a resource to colleagues on recovery practices. The role has a hybrid schedule based on business needs and participates in on-call and incident response rotations, including after-hours work during major incidents and scheduled exercises.

Requirements

College or university degree in a related field.
Five to seven years of work experience in a related job discipline.
At least five years of experience in disaster recovery, IT resiliency, or business continuity in a planning, coordination, or administrative capacity.
Working knowledge of information security, including incident response, identity and access management, and common attack patterns such as ransomware.
Strong written and verbal communication skills.
Ability to collaborate with IT partners and supporting teams and influence without direct authority.
Ability to balance needs of multiple stakeholders, plan and prioritize work, take initiative, work effectively in ambiguity, and navigate complex policies and organizational dynamics.
Participation in on-call and incident response rotations, including after-hours work during major incidents and scheduled exercises.

Nice To Haves

Bachelor's degree in information technology, computer science, information security, or a related field.
Hands-on experience with enterprise backup platforms such as Commvault, NetBackup, Rubrik, or Cohesity; immutable or isolated backup storage; replication and recovery orchestration tools such as VMware Site Recovery Manager; or cloud recovery services such as AWS Elastic Disaster Recovery, AWS Backup, or Azure Site Recovery.
Experience planning and running recovery tests or tabletop exercises.
Experience recovering from or exercising for a real cyber incident.
Familiarity with recovery of identity systems such as Active Directory and Microsoft Entra ID.
Background in higher education, research, or another decentralized IT environment.
Experience balancing multiple stakeholders and navigating complex policy, process, and organizational dynamics.
Experience contributing to and coordinating initiatives across teams, including during periods of change.
Familiarity with HIPAA, NIST SP 800-171, and the NIST Cybersecurity Framework.
Builds trust through honesty, integrity, and collaborative working relationships.
Values differences and encourages open dialogue and inclusive collaboration.

Responsibilities

Assist in developing and maintaining the IT resiliency strategy and multi-year roadmap.
Help develop and maintain the University's IT backup and recovery standard, including requirements for immutability, isolation, encryption, retention, and recovery testing frequency.
Maintain system criticality tiers and assigned recovery time objectives (RTOs) and recovery point objectives (RPOs), working with system owners and business continuity on business impact analysis.
Serve as the Information Security Office's point of contact for resiliency architecture and review new systems and major changes for recoverability before production.
Review requests for exceptions to the standard and recommend approval or denial to the CISO.
Develop and maintain the annual recovery testing and exercise program, prioritized by system criticality.
Plan, facilitate, and report on technical recovery tests and tabletop exercises covering conventional outages and cyber scenarios.
Verify that backups can be restored within required RTOs and RPOs, restored data is free of tampering or malware, and recovery does not reintroduce attacker access.
Coordinate joint exercises with the incident response team and University leadership.
Track remediation of test findings to closure.
Help align the incident response plan and recovery plans, including decisions about system isolation, disaster declarations, and restoration from known-good copies.
Help define recovery order for foundational services and plan recovery when normal tools, accounts, or communication channels are unavailable.
Maintain offline copies of critical recovery documentation and out-of-band communication arrangements.
Coordinate recovery activities during major incidents and participate in post-incident reviews.
Assess architecture against required RTOs and RPOs and record gaps in the ISO risk register with owners and target dates.
Map the program to applicable frameworks and obligations, including NIST, HIPAA, federal research security, and cyber insurance requirements.
Prepare evidence for audits and compliance attestations.
Assess cloud and third-party provider resiliency as part of third-party risk reviews and recommend contract terms.
Report resiliency metrics to the CISO quarterly for executive and Board reporting.
Keep current on attacker techniques targeting backups and recovery and on recovery methods for cloud and distributed platforms.
Use IT expertise to develop and implement security and compliance policies, guidelines, and safe practices for University-wide computing and networking systems.
Guide communications with users to understand security needs and support implementation of procedures; ensure the user community understands and follows necessary procedures.
Perform other related work as needed.